Do Son Critical External Secrets Operator flaw CVE-2026-22822 (CVSS 9.3) allows cross-namespace secret theft. Update to v1.2.0 now to secure your cluster.
HashiCorp Vault
A High-severity flaw (CVE-2025-13357, CVSS 7.4) in the Vault Terraform Provider allows unauthenticated access via LDAP null binds due to an insecure deny_null_bind default setting. Update to v5.5.0.
HashiCorp patched two flaws in Vault: CVE-2025-11621 allows AWS Auth Bypass via IAM role collision, and CVE-2025-12044 allows unauthenticated JSON DoS attack.
HashiCorp has issued a security advisory for a high-severity DoS flaw (CVE-2025-6203) in Vault. A malicious JSON payload could make a server unresponsive.
A critical flaw (CVE-2025-6000) in HashiCorp Vault allows privileged operators to achieve remote code execution on the host via misconfigured plugin directories.
Important security alert: Discover the CVE-2024-7594 flaw in HashiCorp Vault that could grant attackers unrestricted SSH access.
CVE-2024-2048 that could allow attackers to bypass authentication and gain unauthorized access to your organization's most valuable secrets