{"id":"CVE-2026-64858","kind":"vulnerability","aliases":["CVE-2026-64858"],"related":[],"title":"vulnerability-operator: unauthenticated endpoint exposes all scan reports","description":"vulnerability-operator scans SBOMs and Images for vulnerabilities. Prior to version 0.28.16, an unauthenticated information-disclosure vulnerability exposes all vulnerability scan reports served by the operator. The /report/ HTTP endpoint mounts a raw http.FileServer over the reports directory (default /reports) with no authentication, authorization, or middleware. Any client that can reach the operator's HTTP port (default 8080) can list and download every JSON vulnerability report, disclosing CVE IDs, affected package names/versions, and container image identifiers for every workload scanned in the cluster. This issue has been patched in version 0.28.16.","summary":"vulnerability-operator serves its vulnerability scan reports over HTTP at /report/ with no authentication. Anyone who can reach the operator's HTTP port (default 8080) can list and download every report, revealing CVE IDs, package versions and container image names for every scanned workload.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["kubernetes","other","self-hosted","vulnerability-operator"],"not_affected_if":["port-not-reachable","version-0.28.16-or-later"],"how_to_check":"- Check the operator's version and confirm it is below `0.28.16`.\n- Check whether the operator's HTTP port (default `8080`) is reachable from outside the cluster or from untrusted networks.\n- Request `/report/` on the operator's service and see whether a directory listing is returned without credentials.","fix":"- vulnerability-operator: upgrade to `0.28.16`.","status":"open","published_at":"2026-11-11T18:19:47+00:00","first_seen_at":"2026-11-11T18:28:43+00:00","triaged_at":"2026-11-11T18:29:40+00:00","updated_at":"2026-11-11T18:29:40+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-11-11T18:29:40Z","model":"claude-haiku-5-5","output":{"fix":"- vulnerability-operator: upgrade to `0.28.16`.","reach":"network","title":"vulnerability-operator: unauthenticated endpoint exposes all scan reports","impact":"low","summary":"vulnerability-operator serves its vulnerability scan reports over HTTP at /report/ with no authentication. Anyone who can reach the operator's HTTP port (default 8080) can list and download every report, revealing CVE IDs, package versions and container image names for every scanned workload.","audience":"businesses","category":"other","nicknames":[],"who_cares":["kubernetes","vulnerability-operator","self-hosted"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Attackers read every vulnerability report and workload image identifier.","analyst_note":"","how_to_check":"- Check the operator's version and confirm it is below `0.28.16`.\n- Check whether the operator's HTTP port (default `8080`) is reachable from outside the cluster or from untrusted networks.\n- Request `/report/` on the operator's service and see whether a directory listing is returned without credentials.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["version-0.28.16-or-later","port-not-reachable"],"who_is_affected":"Teams running the vulnerability-operator in a Kubernetes cluster to scan SBOMs and container images. Any client that can reach the operator's HTTP port can read the reports, so exposure depends on the network path to that port. Teams on `0.28.16` or later, or with the port unreachable from untrusted clients, are not exposed.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000764,"input_tokens":4704,"output_tokens":587,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-64858':12A,15A '/report':35B,98C '/reports':110C '0.28.16':81C,161C '8080':49B,128C 'affect':140C 'anyon':39B 'authent':38B,113C 'author':114C 'client':118C 'cluster':153C 'contain':62B,144C 'cve':10A,13A,57B,138C 'default':48B,109C,127C 'directori':108C 'disclos':137C 'disclosur':86C 'download':53B,132C 'endpoint':5A,100C 'everi':54B,66B,133C,148C 'expos':6A,88C 'host':20B 'http':33B,46B,99C,125C 'http.fileserver':104C 'id':58B,139C 'identifi':146C 'imag':63B,75C,145C 'inform':85C 'information-disclosur':84C 'issu':155C 'json':134C 'kubernet':16B 'list':51B,130C 'middlewar':116C 'mount':101C 'name':64B 'names/versions':142C 'oper':3A,23B,26B,44B,71C,96C,123C 'packag':59B,141C 'patch':158C 'port':47B,126C 'prior':78C 'raw':103C 'reach':42B,121C 'report':9A,31B,55B,92C,107C,136C 'reveal':56B 'sbom':73C 'scan':8A,30B,67B,72C,91C,150C 'self':19B 'self-host':18B 'serv':27B,93C 'unauthent':4A,83C 'version':60B,80C,160C 'vulner':2A,22B,25B,29B,70C,77C,87C,90C,135C 'vulnerability-oper':1A,21B,24B,69C 'workload':68B,149C","nicknames":[],"mitigations":[],"who_affected":"Teams running the vulnerability-operator in a Kubernetes cluster to scan SBOMs and container images. Any client that can reach the operator's HTTP port can read the reports, so exposure depends on the network path to that port. Teams on `0.28.16` or later, or with the port unreachable from untrusted clients, are not exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["kubernetes","medium","other","selfhosted","vulnerabilityoperator"],"campaign_type":null,"search_a":"'-2026':11A,14A '-64858':12A,15A 'cve':10A,13A 'endpoint':5A 'expos':6A 'oper':3A 'report':9A 'scan':8A 'unauthent':4A 'vulner':2A 'vulnerability-oper':1A","search_b":"'/report':35B '8080':49B 'anyon':39B 'authent':38B 'contain':62B 'cve':57B 'default':48B 'download':53B 'everi':54B,66B 'host':20B 'http':33B,46B 'id':58B 'imag':63B 'kubernet':16B 'list':51B 'name':64B 'oper':23B,26B,44B 'packag':59B 'port':47B 'reach':42B 'report':31B,55B 'reveal':56B 'scan':30B,67B 'self':19B 'self-host':18B 'serv':27B 'version':60B 'vulner':22B,25B,29B 'vulnerability-oper':21B,24B 'workload':68B","search_c":"'/report':98C '/reports':110C '0.28.16':81C,161C '8080':128C 'affect':140C 'authent':113C 'author':114C 'client':118C 'cluster':153C 'contain':144C 'cve':138C 'default':109C,127C 'directori':108C 'disclos':137C 'disclosur':86C 'download':132C 'endpoint':100C 'everi':133C,148C 'expos':88C 'http':99C,125C 'http.fileserver':104C 'id':139C 'identifi':146C 'imag':75C,145C 'inform':85C 'information-disclosur':84C 'issu':155C 'json':134C 'list':130C 'middlewar':116C 'mount':101C 'names/versions':142C 'oper':71C,96C,123C 'packag':141C 'patch':158C 'port':126C 'prior':78C 'raw':103C 'reach':121C 'report':92C,107C,136C 'sbom':73C 'scan':72C,91C,150C 'serv':93C 'unauthent':83C 'version':80C,160C 'vulner':70C,77C,87C,90C,135C 'vulnerability-oper':69C 'workload':149C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-07-03T07:51:29+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-64858","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64858","severity":null,"published_at":"2026-11-11T18:19:47+00:00","modified_at":"2026-11-11T18:19:47+00:00","first_seen_at":"2026-11-11T18:28:43+00:00","fetched_at":"2026-11-11T18:28:43+00:00","note":null}],"documents":[{"id":127744,"url":"https://github.com/ckotzbauer/vulnerability-operator/commit/b083ab0146e7fb301be6b5a4bc917b5e5fad6eae","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":127745,"url":"https://github.com/ckotzbauer/vulnerability-operator/releases/tag/0.28.16","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":127746,"url":"https://github.com/ckotzbauer/vulnerability-operator/security/advisories/GHSA-6v6c-4cxg-cc93","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-03T07:51:29+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}