Skip to content
fr Sign in
9.6 Critical

CVE-2026-8715 Vault Secrets Operator 1.3.0 up to 1.4.1 is vulnerable to an arbitrary file read and credential exfiltration issue in…

Description

Vault Secrets Operator 1.3.0 up to 1.4.1 is vulnerable to an arbitrary file read and credential exfiltration issue in the AppRole authentication configuration that may allow a tenant with limited Kubernetes RBAC permissions to read files from the operator pod's filesystem and transmit their contents to a tenant-controlled endpoint, potentially leading to privilege escalation within the cluster. This vulnerability (CVE-2026-8715) is fixed in Vault Secrets Operator 1.5.0.

Affected products and versions

Product Affected versions Fixed in
Tooling 1.3 1.3.0 → < 1.5.0 1.5.0

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Tooling

The 13 CVEs of Tooling →
CVE-2026-110720 Consul-k8s versions 0.42.0 and later are vulnerable to a cross-namespace authorization bypass in component ACL binding… 9.9 Critical CVE-2026-87993 The consul-template library is vulnerable to an information disclosure issue in its error handling path that may allow… 7.7 High CVE-2026-16326 In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not properly isolate session state in stateless mode, which may… 10.0 Critical CVE-2026-16328 In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not restrict how the Consul backend address was supplied,… 8.6 High
Track this CVE