CVE-2026-64858 · Other
NO FIX YET · SEE WHAT TO DO
vulnerability-operator serves its vulnerability scan reports over HTTP at /report/ with no authentication. Anyone who can reach the operator's HTTP port (default 8080) can list and download every report, revealing CVE IDs, package versions and container image names for every scanned workload.
first public Jul 3, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams running the vulnerability-operator in a Kubernetes cluster to scan SBOMs and container images. Any client that can reach the operator's HTTP port can read the reports, so exposure depends on the network path to that port. Teams on 0.28.16 or later, or with the port unreachable from untrusted clients, are not exposed.
Not affected if port-not-reachable, version-0.28.16-or-later
Who cares kubernetes, self-hosted, vulnerability-operator
0.28.16.8080) is reachable from outside the cluster or from untrusted networks./report/ on the operator's service and see whether a directory listing is returned without credentials.0.28.16.vulnerability-operator scans SBOMs and Images for vulnerabilities. Prior to version 0.28.16, an unauthenticated information-disclosure vulnerability exposes all vulnerability scan reports served by the operator. The /report/ HTTP endpoint mounts a raw http.FileServer over the reports directory (default /reports) with no authentication, authorization, or middleware. Any client that can reach the operator's HTTP port (default 8080) can list and download every JSON vulnerability report, disclosing CVE IDs, affected package names/versions, and container image identifiers for every workload scanned in the cluster. This issue has been patched in version 0.28.16.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.