SZB-b2ba1e09dd
EUVD-2026-114366 reports unsanitized kubeconfig parsing in osac-operator
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- OSAC project
- Product
- osac-operator
- First seen
Summary
The EUVD listing says that in OSAC operator revision 8220502, the console-proxy RemoteConfigResolver parses kubeconfig data from Kubernetes Secrets without sanitizing it. It assigns a CVSS v3.1 score of 8.6.
If you use OSAC project
Upgrade osac-operator to a version that includes the fix
Restrict who can create or modify Kubernetes Secrets used for kubeconfig data
Review console-proxy logs for unexpected configuration access
What the sources say 1
· Mastodon: “🚨 EUVD-2026-114366 📊 Score: 8.6/10 (CVSS v3.1) 📦 Product: osac-operator 🏢 Vendor: osac-project 📅 Updated: 2026-10-30 📝 OSAC operator is a Kubernetes operator. In the affected revision identified” Source