CVE-2026-123665 · Package
NO FIX YET · SEE WHAT TO DO
Kubescape up to 4.0.15 mishandles the outputFile argument in its result printer, so a manipulated value can lead to permission problems. An attacker needs local access to exploit it.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams that run the Kubescape CLI or scanner on shared machines or CI runners where other users can influence the output file argument. Systems where only trusted users run Kubescape locally are at low risk. The sources do not describe a remote path.
Not affected if single-trusted-user, version-4.0.16-or-later
Who cares ci, kubernetes, kubescape
kubescape version4.0.15 are affected4.0.16A weakness has been identified in kubescape up to 4.0.15. Impacted is the function GetWriter of the file core/pkg/resultshandling/printer/printresults.go of the component Output. Executing a manipulation of the argument outputFile can lead to permission issues. The attack requires local access. Upgrading to version 4.0.16 is recommended to address this issue. This patch is called d90f77314c7d4f2b53cf2425844bde2315bd26d2. Upgrading the affected component is advised.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.