Unauthenticated Information Disclosure in Vulnerability Operator by Ckotzbauer

CVE-2026-64858

What is CVE-2026-64858?

The Vulnerability Operator prior to version 0.28.16 has a significant design flaw that allows unauthenticated users to access all generated vulnerability scan reports. This security oversight arises from the lack of authentication and authorization controls at the /report/ HTTP endpoint, which exposes a file server serving JSON reports from the /reports directory. Any external client that can connect to the operator's HTTP port, typically port 8080, can enumerate and download these sensitive reports, revealing critical information such as CVE IDs, affected package names and versions, as well as container image identifiers for all scanned workloads. The issue has been resolved in version 0.28.16.

References