CVE-2026-64858— vulnerability-operator: IDOR exposing vulnerability reports via unauthenticated Report Handler

Quick assessment

Affected

ckotzbauer vulnerability-operator

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

vulnerability-operator 负责扫描软件物料清单（SBOM）和镜像中的漏洞。在 0.28.16 版本之前，存在一个未认证的信息泄露漏洞，导致该 Operator 提供的所有漏洞扫描报告均可被暴露。其 HTTP 端点直接在报告目录（默认为）上挂载了一个原始的，且未配置任何身份验证、授权或中间件。任何能够访问该 Operator HTTP 端口（默认为 8080）的客户端，均可列出并下载所有 JSON 格式的漏洞报告，从而泄露集群中所有已扫描工作负载的 CVE 编号、受影响的软件包名称/版本以及容

CVSS 5.3 · Medium Updated Nov 12, 2026

Possible ATT&CK Techniques 2 AI

T1040 · Network Sniffing T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

Vendor	Product	Version Range	Status
ckotzbauer	vulnerability-operator	`< 0.28.16`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

vulnerability-operator: IDOR exposing vulnerability reports via unauthenticated Report Handler

Source: CVE Program / CVE List V5

Vulnerability Description

vulnerability-operator scans SBOMs and Images for vulnerabilities. Prior to version 0.28.16, an unauthenticated information-disclosure vulnerability exposes all vulnerability scan reports served by the operator. The /report/ HTTP endpoint mounts a raw http.FileServer over the reports directory (default /reports) with no authentication, authorization, or middleware. Any client that can reach the operator's HTTP port (default 8080) can list and download every JSON vulnerability report, disclosing CVE IDs, affected package names/versions, and container image identifiers for every workload scanned in the cluster. This issue has been patched in version 0.28.16.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

关键功能的认证机制缺失

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
ckotzbauer	vulnerability-operator	< 0.28.16	-

II. Public POCs for CVE-2026-64858

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-64858

请登录查看更多情报信息。

Other References for CVE-2026-64858 (3)

https://github.com/ckotzbauer/vulnerability-operator/releases/tag/0.28.16 x_refsource_MISC
https://github.com/ckotzbauer/vulnerability-operator/security/advisories/GHSA-6v6c-4cxg-cc93 x_refsource_CONFIRM
https://github.com/ckotzbauer/vulnerability-operator/commit/b083ab0146e7fb301be6b5a4bc917b5e5fad6eae x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-64858

IV. Related Vulnerabilities

Same weakness: CWE-306