---
id: "CVE-2026-64858"
page: "https://infrastack.ai/live/CVE-2026-64858"
kind: "vulnerability"
aliases: ["CVE-2026-64858"]
title: "vulnerability-operator: unauthenticated endpoint exposes all scan reports"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["kubernetes", "other", "self-hosted", "vulnerability-operator"]
not_affected_if: ["port-not-reachable", "version-0.28.16-or-later"]
published_at: "2026-11-11T18:19:47+00:00"
first_seen_at: "2026-11-11T18:28:43+00:00"
updated_at: "2026-11-11T18:29:40+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64858", "first_seen_at": "2026-11-11T18:28:43+00:00"}]
exploit_sources: []
---

# vulnerability-operator: unauthenticated endpoint exposes all scan reports

Link for people: https://infrastack.ai/live/CVE-2026-64858 (this .md is for agents)

vulnerability-operator serves its vulnerability scan reports over HTTP at /report/ with no authentication. Anyone who can reach the operator's HTTP port (default 8080) can list and download every report, revealing CVE IDs, package versions and container image names for every scanned workload.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the operator's version and confirm it is below `0.28.16`.
- Check whether the operator's HTTP port (default `8080`) is reachable from outside the cluster or from untrusted networks.
- Request `/report/` on the operator's service and see whether a directory listing is returned without credentials.

## Fix

- vulnerability-operator: upgrade to `0.28.16`.

## Timeline

- 2026-11-11T18:28:43+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-64858

## Documents

- [advisory] Vendor advisory: github.com https://github.com/ckotzbauer/vulnerability-operator/security/advisories/GHSA-6v6c-4cxg-cc93
- [fix] Patch: github.com https://github.com/ckotzbauer/vulnerability-operator/commit/b083ab0146e7fb301be6b5a4bc917b5e5fad6eae
- [fix] Release notes: github.com https://github.com/ckotzbauer/vulnerability-operator/releases/tag/0.28.16

## From the sources

vulnerability-operator scans SBOMs and Images for vulnerabilities. Prior to version 0.28.16, an unauthenticated information-disclosure vulnerability exposes all vulnerability scan reports served by the operator. The /report/ HTTP endpoint mounts a raw http.FileServer over the reports directory (default /reports) with no authentication, authorization, or middleware. Any client that can reach the operator's HTTP port (default 8080) can list and download every JSON vulnerability report, disclosing CVE IDs, affected package names/versions, and container image identifiers for every workload scanned in the cluster. This issue has been patched in version 0.28.16.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_