Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4

Export CSV
CVE-2026-87050

operator-foundry: operator-foundry: GitHub Actions and reusable workflow not pinned to commit SHA

A flaw was found in operator-foundry. GitHub Actions and reusable workflows within the component are referenced using mutable tags (e.g., `@v0`, `@v4`) instead of fixed commit SHAs. This allows an attacker to potentially alter the code executed in the Continuous Integration (CI) pipeline through an upstream compromise or by re-pointing a tag, leading to unauthorized code execution or manipulation.

CVSS 3.1 · 4.2 Medium EPSS n/a KEV · Not listed
Vendors
Operator-foundry
Products
Operator-foundry
CVE-2026-87049

operator-foundry: operator-foundry: Over-permissive GITHUB_TOKEN and GCP WIF secrets granted to third-party reusable workflow on untrusted-triggerable events

A flaw was found in operator-foundry. Untrusted external actors can exploit over-permissive GitHub access tokens and Google Cloud Platform (GCP) Workload Identity Federation credentials granted to a third-party reusable workflow. By invoking this workflow on untrusted-triggerable events without sufficient authorization checks, an attacker could gain highly privileged access to GitHub and cloud resources, potentially leading to unauthorized control.

CVSS 3.1 · 8.7 High EPSS n/a KEV · Not listed
Vendors
Operator-foundry
Products
Operator-foundry
CVE-2026-87051

operator-foundry: operator-foundry: resolveAndValidatePath performs lexical containment only — symlinks can escape the build context

A flaw was found in operator-foundry. The path-containment check, designed to restrict file access within a build context, only performs string-based validation. It fails to resolve symbolic links (symlinks), allowing an attacker to create a symlink within the build context that points to files or directories outside of it. This could enable unauthorized access to files beyond the intended confinement.

CVSS 3.1 · 2.6 Low EPSS n/a KEV · Not listed
Vendors
Operator-foundry
Products
Operator-foundry
CVE-2026-87052

operator-foundry: operator-foundry: No automated dependency-update or vulnerability-scanning configuration

A flaw was found in operator-foundry. The absence of automated dependency-update and vulnerability-scanning configurations in the repository increases the risk of undetected security vulnerabilities. This lack of automated security checks could potentially lead to the inclusion of known vulnerable components, which might then be exploited by an attacker if those underlying vulnerabilities are present and exploitable.

CVSS 3.1 · 2.6 Low EPSS n/a KEV · Not listed
Vendors
Operator-foundry
Products
Operator-foundry