Loading story…
HashiCorp disclosed CVE-2026-8715, a critical flaw in Vault Secrets Operator that allows arbitrary file reads and credential exfiltration through the AppRole secretIDPath configuration. The vulnerability affects versions 1.3.0 through 1.4.1 and can be exploited by a tenant with limited Kubernetes RBAC permissions to read files from the operator pod filesystem and send their contents to a tenant-controlled endpoint.
The issue could expose sensitive credentials and create a path to privilege escalation inside a Kubernetes cluster. HashiCorp addressed the flaw in Vault Secrets Operator 1.5.0, and the Canadian Centre for Cyber Security issued advisory AV26-817, referencing HashiCorp bulletin HCSEC-2026-28 and urging administrators to review the advisory and apply the available update.
See real exploitation activity before you spend the cycle.
3 events from the most recent confirmed update back to the earliest known activity.
The Canadian Centre for Cyber Security published advisory AV26-817 about the HashiCorp Vault Secrets Operator vulnerability and urged users and administrators to review the linked advisories and apply updates. The notice references HashiCorp advisory HCSEC-2026-28 and states the product is affected as of August 13, 2026.
HashiCorp disclosed a critical arbitrary file read and credential exfiltration vulnerability in Vault Secrets Operator's AppRole secretIDPath configuration, affecting versions 1.3.0 through 1.4.1 / versions prior to 1.5.0. The issue allows a tenant with limited Kubernetes RBAC permissions to read files from the operator pod filesystem and send their contents to a tenant-controlled endpoint.
The vulnerability was fixed in Vault Secrets Operator version 1.5.0, with guidance to upgrade to 1.5.0 or later and remove unnecessary RBAC permissions. This remediation addresses the arbitrary file read and credential exposure issue tracked as CVE-2026-8715.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
3 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcecyber.gc.ca
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
HashiCorp disclosed two security issues in Vault affecting availability and access controls. One advisory, `HCSEC-2026-05`, warns that Vault's KVv2 engine is vulnerable to a policy bypass involving metadata and secret deletion operations, creating a denial-of-service condition and allowing actions that should have been restricted by policy. A second advisory, `HCSEC-2026-08`, says Vault is also vulnerable to denial of service through unauthenticated root token generation and rekey operations. Together, the disclosures indicate that both authenticated policy enforcement paths and unauthenticated operational workflows in Vault can be abused to disrupt service, underscoring the need for organizations running Vault to review affected deployments and apply vendor guidance promptly.
Jun 29, 2026
Two newly disclosed Kubernetes vulnerabilities show how limited access can escalate into broad secret theft and potential full-cluster compromise. **CVE-2026-39961** affects the Aiven Operator and enables cross-namespace secret exfiltration through a confused deputy condition, breaking multi-tenancy and namespace isolation. An attacker starting from a constrained developer role could access high-value service account tokens, particularly in `kube-system`, and potentially obtain `cluster-admin` privileges. From there, they could deploy malicious DaemonSets, alter node settings, read cluster-wide data, and pivot into cloud environments through permissive IAM integrations such as AWS IAM Roles for Service Accounts.
Jun 29, 2026
Red Hat disclosed **`CVE-2026-73269`**, a critical privilege-escalation flaw in the `cluster-curator-controller` component used by **OpenShift Multicluster Engine for Kubernetes**. The bug allows a tenant with only namespace-level access to create a crafted `ClusterCurator` resource whose `metadata.name` differs from `metadata.namespace`, triggering the controller to create a cluster-scoped `ClusterRoleBinding` and, in some cases, a `RoleBinding` in an arbitrary namespace. Those bindings can attach the tenant’s namespace-local `cluster-installer` service account to the powerful curator role, effectively breaking namespace isolation. Successful exploitation can elevate a local tenant to **cluster-wide privileges**, including access to and manipulation of secrets, management of cluster actions, and deletion of hosted clusters or node pools. The issue carries a **CVSS 3.1 score of 9.9** and affects `multicluster-engine/cluster-curator-controller-rhel9`. Red Hat advised organizations to apply vendor fixes and reduce exposure by restricting creation of `ClusterCurator` resources through RBAC, enforcing matching `metadata.name` and `metadata.namespace` with an admission controller, and reviewing permissions that allow creation of cluster-scoped resources.
Aug 13, 2026