CVE-2026-64858

MEDIUM 5.3

vulnerability-operator: IDOR exposing vulnerability reports via unauthenticated Report Handler

CVSS Score

5.3

EPSS Score

0.0%

EPSS Percentile

0th

vulnerability-operator scans SBOMs and Images for vulnerabilities. Prior to version 0.28.16, an unauthenticated information-disclosure vulnerability exposes all vulnerability scan reports served by the operator. The /report/ HTTP endpoint mounts a raw http.FileServer over the reports directory (default /reports) with no authentication, authorization, or middleware. Any client that can reach the operator's HTTP port (default 8080) can list and download every JSON vulnerability report, disclosing CVE IDs, affected package names/versions, and container image identifiers for every workload scanned in the cluster. This issue has been patched in version 0.28.16.

CWE	CWE-306 CWE-548
Vendor	ckotzbauer
Product	vulnerability-operator
Published	Nov 11, 2026

Stay Ahead of the Next One

Get instant alerts for ckotzbauer vulnerability-operator

Be the first to know when new medium vulnerabilities affecting ckotzbauer vulnerability-operator are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Affected Versions

ckotzbauer / vulnerability-operator

< 0.28.16

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/ckotzbauer/vulnerability-operator/security/advisories/GHSA-6v6c-4cxg-cc93 github.com: https://github.com/ckotzbauer/vulnerability-operator/commit/b083ab0146e7fb301be6b5a4bc917b5e5fad6eae github.com: https://github.com/ckotzbauer/vulnerability-operator/releases/tag/0.28.16