Multicloud-operators-subscription: multicloud-operators-subscription: helmrelease chart applied with controller sa without gvk or namespace restriction

Lighthouse: lighthouse: arbitrary namespace injection via attacker-controlled broker label

Search-v2-operator: search-v2-operator: operator clusterrole is cluster-admin equivalent via impersonate, rbac write, csr approve, and manifestwork

Multicloud-operators-subscription: multicloud-operators-subscription: isclusteradmin() trusts user-settable annotations on managed clusters

Multicloud-operators-subscription: multicloud-operators-subscription: hub and spoke serviceaccounts bound to wildcard rbac (*/*/*)

Multicloud-integrations: multicloud-integrations: pull-model propagation allows hub tenant to target arbitrary spoke cluster via unvalidated ocm-managed-cluster annotation

Multicloud-integrations: multicloud-integrations: gitopscluster.spec.argoserver.argonamespace writes spoke bearer tokens to attacker-chosen namespace

Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html`

Submariner: submariner: ipsec.conf stanza injection via remote-supplied cablename and subnets

Acm-search-v2-rhel9: search-v2-operator: search cr imageoverride/arguments/envvar flow unsanitized into pods running impersonating sa

Acm-search-v2-rhel9: search-v2-operator: shell-command and sql injection in postgresql-start.sh via cr-supplied work_mem

Acm-search-v2-rhel9: search-v2-operator: hub search cr collector.imageoverride propagated to every spoke as arbitrary container image

Multicluster-operators-subscription: multicluster-operators-subscription: namespace edit user can deploy cluster-scoped clusterrolebinding and become cluster-admin via application subscription

Governance-policy-addon-controller: governance-policy-addon-controller: arbitrary container image override via managedclusteraddon annotation enables rce on spoke

Search-v2-operator: search-v2-operator: cluster-wide impersonate on users/groups shared across 4 pods grants hub system:masters

Lighthouse: lighthouse: cross-cluster dns spoofing via unvalidated endpointslice ip addresses

Submariner: submariner: missing validation of remote endpoint subnets and clusterid enables cross-cluster traffic hijack

Acm-search-v2-rhel9: search-v2-operator: addonfactory.getvaluesfromaddonannotation enables arbitrary helm-values override per spoke

Acm-operator-bundle: acm-operator-bundle: bundle build execs unpinned stolostron/release@master with full build credentials

Stolostron/multicluster-observability-addon: cross-namespace secret disclosure in multicluster-observability-addon via unvalidated configuration references

Multicloud-operators-subscription: multicloud-operators-subscription: cross-namespace secret exfiltration via helmrelease.repo.secretref.namespace

Multicloud-operators-channel: multicloud-operators-channel: auto-generated role grants every managed-cluster agent secrets:get,list,watch in channel namespaces

Multicloud-operators-subscription: multicloud-operators-subscription: fetchchannelreferences honours channel.spec.secretref.namespace enabling cross-namespace secret exfiltration

Insights-client: insights-client: ccx_token bearer credential logged in clear text at startup via setdefault()

Acm-search-v2-api-rhel9: search-v2-api: unbounded tokenreviews cache allows unauthenticated memory-exhaustion dos

Acm-search-v2-api-rhel9: search-v2-api: authentication bypass on /federated via upgrade: websocket header spoofing

fast-uri vulnerable to host confusion via failed IDN canonicalization

iskorotkov/avro: CPU Exhaustion in Avro Decoder

iskorotkov/avro: Integer Overflow in Avro Decoder

Prometheus: remote read endpoint allows denial of service via crafted snappy payload

Prometheus Azure AD remote write OAuth client secret exposed via config API

Insights-client-rhel9: insights-client: pull-secret bearer token written to logs on non-200 ccx response

Search-indexer: search-indexer: update/delete operations not scoped to caller's cluster (cross-tenant data tampering)

Insights-client-rhel9: insights-client: spoke-controlled clusterid injected unencoded into insights api url path

Submariner-operator: broker serviceaccount secret (token + ca) logged in full at trace verbosity

Insights-client: insights-client: clusterrole grants cluster-wide secrets get/list/watch beyond least privilege

Inefficient candidate hostname parsing in crypto/x509

Multicloud-operators-channel: multicloud-operators-channel: cross-namespace secret and configmap mutation via spec.secretref.namespace confused deputy

Volsync-addon-controller: volsync-addon-controller: annotation values rendered into yaml via text/template without escaping allows yaml injection into subscription

Submariner-operator: operator clusterrole grants cluster-wide create/update on all configmaps

Must-gather: /tmp/kubeconfig retention

Must-gather: must-gather: embedded secret data in acm wrapper crs collected without redaction

Submariner-operator: pprof debug endpoint enabled by default on 0.0.0.0:8082 without authentication

Acm-search-v2-api-rhel9: search-v2-api: cross-user bearer-token reuse via global federation-config cache

Submariner-operator: release workflow consumes same-org composite action via mutable @devel branch ref