{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-64858", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-07-20T18:31:39.291Z", "datePublished": "2026-11-11T17:45:16.495Z", "dateUpdated": "2026-11-13T17:21:25.031Z"}, "containers": {"cna": {"title": "vulnerability-operator: IDOR exposing vulnerability reports via unauthenticated Report Handler", "problemTypes": [{"descriptions": [{"cweId": "CWE-306", "lang": "en", "description": "CWE-306: Missing Authentication for Critical Functionality", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-548", "lang": "en", "description": "CWE-548: Exposure of Information Through Directory Listing", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/ckotzbauer/vulnerability-operator/security/advisories/GHSA-6v6c-4cxg-cc93", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/ckotzbauer/vulnerability-operator/security/advisories/GHSA-6v6c-4cxg-cc93"}, {"name": "https://github.com/ckotzbauer/vulnerability-operator/commit/b083ab0146e7fb301be6b5a4bc917b5e5fad6eae", "tags": ["x_refsource_MISC"], "url": "https://github.com/ckotzbauer/vulnerability-operator/commit/b083ab0146e7fb301be6b5a4bc917b5e5fad6eae"}, {"name": "https://github.com/ckotzbauer/vulnerability-operator/releases/tag/0.28.16", "tags": ["x_refsource_MISC"], "url": "https://github.com/ckotzbauer/vulnerability-operator/releases/tag/0.28.16"}], "affected": [{"vendor": "ckotzbauer", "product": "vulnerability-operator", "versions": [{"version": "< 0.28.16", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-11-11T17:45:16.495Z"}, "descriptions": [{"lang": "en", "value": "vulnerability-operator scans SBOMs and Images for vulnerabilities. Prior to version 0.28.16, an unauthenticated information-disclosure vulnerability exposes all vulnerability scan reports served by the operator. The /report/ HTTP endpoint mounts a raw http.FileServer over the reports directory (default /reports) with no authentication, authorization, or middleware. Any client that can reach the operator's HTTP port (default 8080) can list and download every JSON vulnerability report, disclosing CVE IDs, affected package names/versions, and container image identifiers for every workload scanned in the cluster. This issue has been patched in version 0.28.16."}], "source": {"advisory": "GHSA-6v6c-4cxg-cc93", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/ckotzbauer/vulnerability-operator/security/advisories/GHSA-6v6c-4cxg-cc93", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-13T17:20:49.501533Z", "id": "CVE-2026-64858", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-13T17:21:25.031Z"}}]}}

{}

{"affected": [{"affectedData": [{"product": "vulnerability-operator", "vendor": "ckotzbauer", "versions": [{"status": "affected", "version": "< 0.28.16"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "vulnerability-operator scans SBOMs and Images for vulnerabilities. Prior to version 0.28.16, an unauthenticated information-disclosure vulnerability exposes all vulnerability scan reports served by the operator. The /report/ HTTP endpoint mounts a raw http.FileServer over the reports directory (default /reports) with no authentication, authorization, or middleware. Any client that can reach the operator's HTTP port (default 8080) can list and download every JSON vulnerability report, disclosing CVE IDs, affected package names/versions, and container image identifiers for every workload scanned in the cluster. This issue has been patched in version 0.28.16."}], "id": "CVE-2026-64858", "lastModified": "2026-11-13T18:17:48.730", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-64858", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-13T17:20:49.501533Z", "version": "2.0.3"}}]}, "published": "2026-11-11T18:19:47.770", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/ckotzbauer/vulnerability-operator/commit/b083ab0146e7fb301be6b5a4bc917b5e5fad6eae"}, {"source": "security-advisories@github.com", "url": "https://github.com/ckotzbauer/vulnerability-operator/releases/tag/0.28.16"}, {"source": "security-advisories@github.com", "url": "https://github.com/ckotzbauer/vulnerability-operator/security/advisories/GHSA-6v6c-4cxg-cc93"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/ckotzbauer/vulnerability-operator/security/advisories/GHSA-6v6c-4cxg-cc93"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-306"}, {"lang": "en", "value": "CWE-548"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}