{"api_version":"1","generated_at":"2026-11-12T23:54:13+00:00","cve":"CVE-2026-64858","urls":{"html":"https://cve.report/CVE-2026-64858","api":"https://cve.report/api/cve/CVE-2026-64858.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-64858","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-64858"},"summary":{"title":"vulnerability-operator: IDOR exposing vulnerability reports via unauthenticated Report Handler","description":"vulnerability-operator scans SBOMs and Images for vulnerabilities. Prior to version 0.28.16, an unauthenticated information-disclosure vulnerability exposes all vulnerability scan reports served by the operator. The /report/ HTTP endpoint mounts a raw http.FileServer over the reports directory (default /reports) with no authentication, authorization, or middleware. Any client that can reach the operator's HTTP port (default 8080) can list and download every JSON vulnerability report, disclosing CVE IDs, affected package names/versions, and container image identifiers for every workload scanned in the cluster. This issue has been patched in version 0.28.16.","state":"PUBLISHED","assigner":"GitHub_M","published_at":"2026-11-11 18:19:47","updated_at":"2026-11-12 22:18:51"},"problem_types":["CWE-306","CWE-548","CWE-306 CWE-306: Missing Authentication for Critical Functionality","CWE-548 CWE-548: Exposure of Information Through Directory Listing"],"metrics":[{"version":"3.1","source":"security-advisories@github.com","type":"Secondary","score":"5.3","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"5.3","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","data":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"}}],"references":[{"url":"https://github.com/ckotzbauer/vulnerability-operator/commit/b083ab0146e7fb301be6b5a4bc917b5e5fad6eae","name":"https://github.com/ckotzbauer/vulnerability-operator/commit/b083ab0146e7fb301be6b5a4bc917b5e5fad6eae","refsource":"security-advisories@github.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/ckotzbauer/vulnerability-operator/releases/tag/0.28.16","name":"https://github.com/ckotzbauer/vulnerability-operator/releases/tag/0.28.16","refsource":"security-advisories@github.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/ckotzbauer/vulnerability-operator/security/advisories/GHSA-6v6c-4cxg-cc93","name":"https://github.com/ckotzbauer/vulnerability-operator/security/advisories/GHSA-6v6c-4cxg-cc93","refsource":"security-advisories@github.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-64858","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64858","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"ckotzbauer","product":"vulnerability-operator","version":"affected < 0.28.16","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"product":"vulnerability-operator","vendor":"ckotzbauer","versions":[{"status":"affected","version":"< 0.28.16"}]}],"descriptions":[{"lang":"en","value":"vulnerability-operator scans SBOMs and Images for vulnerabilities. Prior to version 0.28.16, an unauthenticated information-disclosure vulnerability exposes all vulnerability scan reports served by the operator. The /report/ HTTP endpoint mounts a raw http.FileServer over the reports directory (default /reports) with no authentication, authorization, or middleware. Any client that can reach the operator's HTTP port (default 8080) can list and download every JSON vulnerability report, disclosing CVE IDs, affected package names/versions, and container image identifiers for every workload scanned in the cluster. This issue has been patched in version 0.28.16."}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-306","description":"CWE-306: Missing Authentication for Critical Functionality","lang":"en","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-548","description":"CWE-548: Exposure of Information Through Directory Listing","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-11-11T17:45:16.495Z","orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M"},"references":[{"name":"https://github.com/ckotzbauer/vulnerability-operator/security/advisories/GHSA-6v6c-4cxg-cc93","tags":["x_refsource_CONFIRM"],"url":"https://github.com/ckotzbauer/vulnerability-operator/security/advisories/GHSA-6v6c-4cxg-cc93"},{"name":"https://github.com/ckotzbauer/vulnerability-operator/commit/b083ab0146e7fb301be6b5a4bc917b5e5fad6eae","tags":["x_refsource_MISC"],"url":"https://github.com/ckotzbauer/vulnerability-operator/commit/b083ab0146e7fb301be6b5a4bc917b5e5fad6eae"},{"name":"https://github.com/ckotzbauer/vulnerability-operator/releases/tag/0.28.16","tags":["x_refsource_MISC"],"url":"https://github.com/ckotzbauer/vulnerability-operator/releases/tag/0.28.16"}],"source":{"advisory":"GHSA-6v6c-4cxg-cc93","discovery":"UNKNOWN"},"title":"vulnerability-operator: IDOR exposing vulnerability reports via unauthenticated Report Handler"}},"cveMetadata":{"assignerOrgId":"a0819718-46f1-4df5-94e2-005712e83aaa","assignerShortName":"GitHub_M","cveId":"CVE-2026-64858","datePublished":"2026-11-11T17:45:16.495Z","dateReserved":"2026-07-20T18:31:39.291Z","dateUpdated":"2026-11-11T17:45:16.495Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-11-11 18:19:47","lastModifiedDate":"2026-11-12 22:18:51","problem_types":["CWE-306","CWE-548","CWE-306 CWE-306: Missing Authentication for Critical Functionality","CWE-548 CWE-548: Exposure of Information Through Directory Listing"],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"64858","Ordinal":"1","Title":"vulnerability-operator: IDOR exposing vulnerability reports via ","CVE":"CVE-2026-64858","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"64858","Ordinal":"1","NoteData":"vulnerability-operator scans SBOMs and Images for vulnerabilities. Prior to version 0.28.16, an unauthenticated information-disclosure vulnerability exposes all vulnerability scan reports served by the operator. The /report/ HTTP endpoint mounts a raw http.FileServer over the reports directory (default /reports) with no authentication, authorization, or middleware. Any client that can reach the operator's HTTP port (default 8080) can list and download every JSON vulnerability report, disclosing CVE IDs, affected package names/versions, and container image identifiers for every workload scanned in the cluster. This issue has been patched in version 0.28.16.","Type":"Description","Title":"vulnerability-operator: IDOR exposing vulnerability reports via "}]}}}