https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 00:29:15 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-265999 EUVD-2026-265999 https://cve.radiocsirt.org/vuln/euvd-2026-265999 https://cve.radiocsirt.org/vuln/fkie_cve-2026-23634 <p>Pepr is a type safe K8s middleware. Prior to 1.0.5 , Pepr defaults to a cluster-admin RBAC configuration and does not explicitly force or enforce least-privilege guidance for module authors. The default behavior exists to make the “getting started” experience smooth: new users can experiment with Pepr and create resources dynamically without needing to pre-configure RBAC. This vulnerability is fixed in 1.0.5.</p> <p>Pepr is a type safe K8s middleware. Prior to 1.0.5 , Pepr defaults to a cluster-admin RBAC configuration and does not explicitly force or enforce least-privilege guidance for module authors. The default behavior exists to make the “getting started” experience smooth: new users can experiment with Pepr and create resources dynamically without needing to pre-configure RBAC. This vulnerability is fixed in 1.0.5.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-23634 https://cve.radiocsirt.org/vuln/ghsa-w54x-r83c-x79q <p><strong>Affected:</strong> npm: pepr</p> <p>Severity: LOW Target: /workspace/pepr/src/lib/assets/rbac.ts Endpoint: Kubernetes RBAC configuration Method: Deployment</p> <p>## Response / Rationale Pepr defaults to `rbacMode: &#34;admin&#34;` because the initial experience is designed to be frictionless for new users. This mode ensures that users can deploy and run the default `hello-pepr.ts` module without needing to understand or pre-configure RBAC rules.</p> <p>It’s important to note that `hello-pepr.ts` is intended strictly as a demo to showcase Pepr features and workflow. It is not intended for production use, and the documentation explicitly calls out that admin RBAC should not be used in production environments.</p> <p>That said, if a user skips the documentation and does not review the `npx pepr build` options, they could deploy a module with broader privileges than necessary.</p> <p>We consider this low severity because Pepr is a framework: the module author is ultimately responsible for selecting the appropriate RBAC scope for their module and environment as each module has different RBAC needs and requirements.</p> <p>Our security focus is on ensuring the Pepr controller and runtime components operate securely within Kubernetes, while still allowing developers the flexibility to build modules with the access they require.</p> <p>In order to fix this we will warn the user in logs that the default `ClusterRole` is `cluster-admin` and that it is not recommended for production.</p> <p>## How this can be exploited</p> <p>This is not an inherently exploitable CVE in the…</p> <p><strong>Affected:</strong> npm: pepr</p> <p>Severity: LOW Target: /workspace/pepr/src/lib/assets/rbac.ts Endpoint: Kubernetes RBAC configuration Method: Deployment</p> <p>## Response / Rationale Pepr defaults to `rbacMode: &#34;admin&#34;` because the initial experience is designed to be frictionless for new users. This mode ensures that users can deploy and run the default `hello-pepr.ts` module without needing to understand or pre-configure RBAC rules.</p> <p>It’s important to note that `hello-pepr.ts` is intended strictly as a demo to showcase Pepr features and workflow. It is not intended for production use, and the documentation explicitly calls out that admin RBAC should not be used in production environments.</p> <p>That said, if a user skips the documentation and does not review the `npx pepr build` options, they could deploy a module with broader privileges than necessary.</p> <p>We consider this low severity because Pepr is a framework: the module author is ultimately responsible for selecting the appropriate RBAC scope for their module and environment as each module has different RBAC needs and requirements.</p> <p>Our security focus is on ensuring the Pepr controller and runtime components operate securely within Kubernetes, while still allowing developers the flexibility to build modules with the access they require.</p> <p>In order to fix this we will warn the user in logs that the default `ClusterRole` is `cluster-admin` and that it is not recommended for production.</p> <p>## How this can be exploited</p> <p>This is not an inherently exploitable CVE in the…</p> https://cve.radiocsirt.org/vuln/ghsa-w54x-r83c-x79q