Vulnerabilities

TI-2026-42460 CVE-2026-59341

Sealed Secrets: decryption oracle via Go template injection in unauthenticated controller endpoints

MEDIUM 53

A security vulnerability exists in the Sealed Secrets controller's unauthenticated POST endpoints.

CVSS 3.1MEDIUM 4.2 Network High privileges User interaction EPSS 0.00403 Published 2026-09-15 Fixed in 0.40.0 CWE-203

TI-2026-35298 CVE-2026-47846

Hard-coded credentials in bitnami/cassandra

MEDIUM 49

Bitnami Cassandra container images are affected by a retained default superuser vulnerability.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00483 Published 2026-06-18 Fixed in 4.0.20-photon-5-r7, 4.1.11-photon-5-r7 +1 CWE-798

TI-2026-35299 CVE-2026-47847

Hard-coded credentials in bitnami/mariadb-galera

LOW 30

Bitnami MariaDB Galera container images and Helm chart are affected by a hardcoded default credential vulnerability in the Galera replication health-check user.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00313 Published 2026-06-18 Fixed in 10.6.27-photon-5-r0, 10.11.17-photon-5-r1 +4 CWE-798

TI-2026-18253 CVE-2026-22728 · GHSA-465p-v42x-3fmj

sealed-secrets /v1/rotate can widen sealing scope to cluster-wide via attacker-controlled template annotations

LOW 23

Bitnami Sealed Secrets is vulnerable to a scope-widening attack during the secret rotation (/v1/rotate) flow.

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00408 Published 2026-02-26 Fixed in <0.36.0, 0.36.0 CWE-284

TI-2021-05023 CVE-2021-21979 · GHSA-fqf3-g95f-m2v9

Hard-coded credentials in Bitnami Containers

LOW 33

In Bitnami Containers, all Laravel container versions prior to: 6.20.0-debian-10-r107 for Laravel 6, 7.30.1-debian-10-r108 for Laravel 7 and 8.5.11-debian-10-r0 for Laravel 8, the file /tmp/app/.env is generated at the t…

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.00645 Published 2021-03-03 No fix listed CWE-798