Cloud & Orchestration
AWS Reports Remediated Athena Cross-Account Metadata Exposure
Amazon Web Services published 2026-128-AWS security fixes. Inventory scope, apply supported updates, validate operations, and retain evidence.
AWS Fixes Code Injection and SSRF in Bedrock AgentCore Starter Toolkit
Amazon Web Services published 2026-127-AWS security fixes. Inventory scope, apply supported updates, validate operations, and retain evidence.
AWS EFS CSI Driver 3.5.0 Fixes Mount Option Injection
Amazon Web Services (AWS) issued 2026-120-AWS. Match affected deployments, apply supported fixes, validate operations, and retain evidence.
Google Cloud Patches Three Application Integration Vulnerabilities
Google has patched Application Integration authorization, deserialization and Email Task confused-deputy issues and states no customer action is required. Confirm service applicability and retain the bulletins; do not invent a local package or service-recreation task.
containerd Updates Bound OCI Image Graph Processing
A crafted OCI image index can exhaust containerd resources during image pull, before a container starts. Update affected runtimes through the host or cluster's supported channel and limit untrusted image sources while arranging rollout.
Traefik Security Update Addresses 1 Vulnerability
Traefik BasicAuth timing can reveal whether usernames exist in affected 3.6 and 3.7 releases. Upgrade through a supported path containing 3.7.13; the flaw does not disclose passwords or bypass authentication.
Gardener Security Update Addresses 1 Vulnerability
Gardener project administrators can bypass membership permission checks when changing groups, potentially exposing project secrets. Apply the branch-specific fix and review existing grants; patching alone does not revoke unauthorized memberships or exposed credentials.
Cloudreve Security Update Addresses 3 Vulnerabilities
Cloudreve 4.18.0 addresses upload quota races, read-only admin-token overreach and conditional remote-download SSRF. Update servers, review permissions and monitor storage headroom; the SSRF report does not prove credential theft from a real cloud deployment.
KubeEdge Security Update Addresses 4 Vulnerabilities
KubeEdge fixes job-handler command injection, unsafe installer extraction and authenticated CloudHub memory exhaustion. Inventory cloud, edge and keadm components separately, restrict privileged job access, and stage compatible updates rather than treating all paths as unauthenticated.
Fabio Security Update Addresses 1 Vulnerability
Fabio 1.6.6-1.7.1 can strip configured client-IP, TLS or request-ID headers before backend delivery. Update to 1.7.2 and review controls relying on those headers; impact depends on downstream behavior, not a universal authentication bypass.