Security advisories
Real bugs our static reads found in open-source code, confirmed, fixed and published by the projects' own maintainers.
A static read is a model reading a codebase against what the project says it does, under a plan written before any source is opened. Every finding is checked line by line before it goes anywhere, then reported privately to the maintainers. This page lists only the findings the maintainers have since published as GitHub security advisories, with the severity they set and the version that fixes it. Newest first.
-
Kyverno: a policy's permission check asked about the controller, not the author
When a policy with a generate rule was added, Kyverno checked whether its own controller could create the target resource, not whether the person writing the policy could. The shipped Helm chart gives policy-writing rights to the standard admin role, so an admin could have Kyverno create resources their own permissions don't allow.
-
Radar: any website could take over the connected Kubernetes cluster
In its default local mode, Radar's API changed the user's cluster with the user's own credentials but did not check where a request came from. Any page open in the user's browser could send it one, and a single visit was enough to give an attacker cluster-admin.
-
Archestra: the built-in chat skipped two of its own tool-blocking policies
The platform's own chat applied only the "require approval" policy to direct tool calls. The "always block" and "block when the context is sensitive" policies, enforced on every other path, were not applied there.
-
OpenPanel: webhook templates ran inside the worker with no isolation
Webhook templates ran as JavaScript inside the worker process, with no isolate and no limits. A validator was the only barrier, so a template it wrongly passed would run with the worker's credentials and network access, and one that never returned could stall it.
-
Bernstein: five trust checks missing on one more path each
Each was a check the code made elsewhere: workflow commands from a repository ran before the workspace trust gate, a task claim took its role from the request instead of the token, receipts verified against their own embedded key, and two file paths could escape their folders. The maintainers verified and fixed all five.
-
OwnPay: payment callbacks accepted without real verification
An earlier advisory's fix made the Alipay module verify payment callbacks, but dozens of sibling gateway modules still accepted them without a real signature check, and many accepted simulated payment IDs whenever the gateway was not in live mode.
-
Cosmian KMS: keys marked non-extractable could be exported
The server stored the KMIP Extractable and NeverExtractable attributes but never checked them, so a key flagged non-extractable was exported like any other. A per-process cache also let a revoked key stay usable on other nodes for up to 15 minutes.
-
Karate: a third route around the mock server's code-evaluation guard
The mock server passed path parameters from incoming requests into code evaluation without marking them as untrusted, getting past the guard added after two earlier advisories.
-
ToolHive: an OAuth client secret saved in cleartext
A pre-registered OAuth client secret could end up in plain text in the local run-state file: the resolved secret was written back to disk instead of its secret-manager reference.
-
binkterm-php: a message could drive the reader's terminal
Message bodies containing raw terminal escape codes were shown to Telnet and SSH readers without being stripped, so a posted message could control what a reader's terminal displayed.
GitHub shows these credited to Trenyx. Findings are reported by Saurabh Bhatt (SK), trenyx.io. Older reads, including ones that found nothing, are in the archive.