redhat/devworkspace/devworkspace-operator-bundle vulnerabilities

Latest redhat/devworkspace/devworkspace-operator-bundle CVEs

Newest publication first

1. CVE-2026-119566 Prometheus through 3.15.1 Credential Leak via remote_write Cross-Host Redirects

   Published 2026-10-30

   Medium·CVSS 6.3 EPSS 0.20%

   Prometheus through 3.15.1 contains a credential leak vulnerability that allows attackers to capture Azure AD or Google IAM bearer tokens by redirecting remote_write requests to another host. Attackers controlling the remote-write endpoint or a redirecting server can return a 3xx...

2. CVE-2026-84445 gRPC-Go: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers in the xDS servers

   Published 2026-09-14

   High·CVSS 8.7 EPSS 0.64%

   gRPC-Go is the Go language implementation of gRPC. Prior to 1.82.2 and 1.83.2, servers created with xds.NewGRPCServer() allow internal/transport/http2_server.go to accept an RPC containing neither the :authority header nor the Host header, while RouteAndProcess in internal/xds/se...

3. CVE-2026-71557 go-git: Malicious reference names may modify files outside the reference storage

   Published 2026-08-07

   Medium·CVSS 6.3 EPSS 0.41%

   go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, reference names are not sanitized before being used to construct on-disk paths under the reference storage directory, so a maliciously crafted reference name (for example con...

4. CVE-2026-71556 go-git: Worktree operations may follow symlinks

   Published 2026-08-07

   High·CVSS 7.1 EPSS 0.36%

   go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, worktree operations (including checkout, status, and add) resolve symbolic links inside the working tree without confining resolution to the worktree boundary, so a malicious...

5. CVE-2026-45287 OpenTelemetry-Go's Schema ParseFile leaks file descriptors on each parse

   Published 2026-06-04

   Low·CVSS 2.1 EPSS 0.17%

   OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.0.17, go.opentelemetry.io/otel/schema/v1.0 and go.opentelemetry.io/otel/schema/v1.1 leaks one file descriptor on each successful ParseFile call. ParseFile opens the schema file and passes it to Parse w...

6. CVE-2026-44740 go-billy: Lack of depth and cycle detection in symlink resolution may lead to infinite loops and resource exhaustion

   Published 2026-06-01

   Medium·CVSS 6.5 EPSS 0.39%

   Billy is an interface filesystem abstraction for Go. Prior to versions 5.9.0 and 6.0.0-alpha.1, multiple components may improperly handle crafted or malformed input, resulting in panics, infinite loops, uncontrolled recursion, or excessive resource consumption. These issues arise...

7. CVE-2026-39833 Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent

   Published 2026-05-22

   Critical·CVSS 9.1 EPSS 0.47%

   The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without any confirmation prompt, with no indication to the caller that the constraint was not in effect. NewKeyring() now returns a...

8. CVE-2026-41506 go-git Credential leak via cross-host redirect in smart HTTP transport

   Published 2026-05-08

   High·CVSS 7.4 EPSS 0.26%

   go-git is an extensible git implementation library written in pure Go. Prior to versions 5.18.0 and 6.0.0-alpha.2, go-git may leak HTTP authentication credentials when following redirects during smart-HTTP clone and fetch operations. This issue has been patched in versions 5.18.0...

9. CVE-2026-33762 go-git: Missing validation decoding Index v4 files leads to panic

   Published 2026-03-31

   Low·CVSS 2.8 EPSS 0.18%

   go-git is an extensible git implementation library written in pure Go. Prior to version 5.17.1, go-git’s index decoder for format version 4 fails to validate the path name prefix length before applying it to the previously decoded path name. A maliciously crafted index file can t...

10. CVE-2026-34165 go-git: Maliciously crafted idx file can cause asymmetric memory consumption

    Published 2026-03-31

    Medium·CVSS 5.0 EPSS 0.15%

    go-git is an extensible git implementation library written in pure Go. From version 5.0.0 to before version 5.17.1, a vulnerability has been identified in which a maliciously crafted .idx file can cause asymmetric memory consumption, potentially exhausting available memory and re...

11. CVE-2026-33186 gRPC-Go has an authorization bypass via missing leading slash in :path

    Published 2026-03-20

    Critical·CVSS 9.1 EPSS 1.6%

    gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 :path pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests where the :path omitted...

12. CVE-2026-25934 go-git improperly verifies data integrity values for .idx and .pack files

    Published 2026-02-09

    Medium·CVSS 4.3 EPSS 0.16%

    go-git is a highly extensible git implementation library written in pure Go. Prior to 5.16.5, a vulnerability was discovered in go-git whereby data integrity values for .pack and .idx files were not properly verified. This resulted in go-git potentially consuming corrupted files,...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.