Our news and updates

In Argo Workflows versions prior to 3.6.12, and from 3.7.0 before 3.7.3 a high severity vulnerability CVE-2025-62157 was detected. This vulnerability allows an attacker with permissions to read pod logs in the Argo Workflows namespace to obtain plaintext credentials to the artifact repository, potentially leading to unauthorized access and data compromise. This occurs because the workflow-controller improperly exposes sensitive artifact repository credentials in plaintext within its pod logs. By inspecting these logs, an attacker can extract the exposed secrets. There are no known workarounds for this issue. To address this vulnerability, users must upgrade Argo Workflows to versions 3.6.12, 3.7.3, or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-62157.

In Budibase versions prior to 3.41.3 a high severity vulnerability CVE-2026-82240 was detected. This vulnerability allows an authenticated app-scoped builder to escalate their privileges and gain unauthorized builder access to unrelated applications within the same tenant. This occurs due to inadequate validation of app-scoped builder role assignments in the public user create and update API endpoints. By submitting a specially crafted request containing manipulated builder.apps fields to the user update API, an attacker can bypass intended access controls and improperly grant builder rights to other applications. To address this issue, users should upgrade Budibase to version 3.41.3 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-82240.

In Teradata provider component for Apache Airflow versions earlier than 3.7.0 a medium severity vulnerability CVE-2026-81862 was detected. This vulnerability allows an attacker to potentially expose sensitive cloud storage credentials. To address this issue, users should upgrade Teradata provider to version 3.7.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-81862.

In Google provider component for Apache Airflow versions prior to 22.6.0 a medium severity vulnerability CVE-2026-81914 was detected. This vulnerability allows an attacker to append arbitrary clauses to Google Drive search queries. To address this issue, users should upgrade Apache Airflow to version 22.6.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-81914.

In Ubuntu versions before 0.1.19ubuntu3 a medium severity vulnerability CVE-2026-102371 was detected. This vulnerability allows an unprivileged local user to read the Ubuntu Pro token from process command-line arguments. To address this issue, users should upgrade Ubuntu to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-102371.

In Apache Airflow versions earlier than 6.18.0 a medium severity vulnerability CVE-2026-81930 was detected. This vulnerability allows an attacker to control the request host by providing a specially crafted account or region value. To address this issue, users should upgrade Apache Airflow to version 6.18.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-81930.

In Teradata provider component for Apache Airflow versions prior to 3.7.0 a medium severity vulnerability CVE-2026-86843 was detected. This vulnerability allows a user to execute arbitrary SQL commands. To address this issue, users should upgrade the Teradata provider to version 3.7.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-86843.

In Keycloak affected versions a low severity vulnerability CVE-2026-101333 was detected. This vulnerability allows an unauthenticated attacker to cause excessive memory consumption, potentially leading to a denial of service. To address this issue, users should upgrade Keycloak to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-101333.

In Fleet component for Rancher versions before 0.12.19 a high severity vulnerability CVE-2026-93538 was detected. This vulnerability allows an attacker to apply unauthorized labels to a cluster object during registration. To address this issue, users should upgrade Fleet to version 0.12.19 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-93538.