https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-17T15:59:18.323386+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-159368 EUVD-2026-159368 2026-10-17T15:59:18.381997+00:00 EUVD-2026-159368 https://cve.radiocsirt.org/vuln/fkie_cve-2024-43403 fkie_cve-2024-43403 2026-10-17T15:59:18.382039+00:00

Kanister is a data protection workflow management tool. The kanister has a deployment called default-kanister-operator, which is bound with a ClusterRole called edit via ClusterRoleBinding. The "edit" ClusterRole is one of Kubernetes default-created ClusterRole, and it has the create/patch/udpate verbs of daemonset resources, create verb of serviceaccount/token resources, and impersonate verb of serviceaccounts resources. A malicious user can leverage access the worker node which has this component to make a cluster-level privilege escalation.

 https://cve.radiocsirt.org/vuln/ghsa-h27c-6xm3-mcqp Withdrawn: GHSA-h27c-6xm3-mcqp — Withdrawn Advisory: Kanister vulnerable to cluster-level privilege escalation 2026-10-17T15:59:18.382076+00:00

Withdrawn by the publisher.

Affected: Go: github.com/kanisterio/kanister

# Withdrawn Advisory

This advisory has been withdrawn because the vulnerability does not affect a released Go package. For more information, see github/advisory-database/issues/5029.

# Original Advisory

### Summary This advisory affects the Kanister helm charts and not the go package

### Details The kanister has a deployment called default-kanister-operator, which is bound with a ClusterRole called edit via ClusterRoleBinding(https://github.com/kanisterio/kanister/blob/master/helm/kanister-operator/templates/rbac.yaml#L49). The "edit" ClusterRole is one of Kubernetes default-created ClusterRole, and it have create/patch/udpate verbs of daemonset resources, create verb of serviceaccount/token resources, and impersonate verb of serviceaccounts resources. If a malicious user can access the worker node which has this component, he/she can:

For the create/patch/update verbs of daemonset resources, the malicious user can abuse it to create or modify a set of Pods to mount a high-privilege service account (e.g., the cluster-admin service account). After that, he/she can abuse the high-privilege SA token of created Pod to take over the whole cluster.

For the create verb of serviceaccount/token resources, a malicious user can abuse this permission to generate new Service Account tokens and use them to operate with high-privilege roles, such as cluster administrators. These tokens can be used to access and manipulate any resources within the cluster.

For the impersonate verb of…