tag: Security-Patch · 10 items
- Platform/SRE — Plan: CVE-2026-95839 is not KEV-listed and no active exploitation is reported, but this patch hardens symlink handling, seccomp socket allowlisting, and image reference validation in the container runtime — all within the production-critical containerd path. Schedule an upgrade to 2.3.7 across node pools within your next maintenance window; containerd 2.3 EOL is 2028-04-30, so no forced-upgrade urgency.
- CI/CD — Skip
- Leader — Skip
- Signals: containerd 2.3 EOL 2028-04-30 · CVE-2026-95839 — CISA KEV: not listed, EPSS n/a, reported by 2 collected sources
- Platform/SRE — Plan: Upgrade Envoy 1.38.x to 1.38.7 this quarter: it fixes a non-KEV/EPSS-0.00 CVE in wasmtime, several worker-thread race conditions during RDS route-config updates, and a 1.38.0-introduced regression that underreported Prometheus native histogram quantiles. No hard deadline; 1.38 EOL is 2027-04-23.
- CI/CD — Skip
- Leader — Skip
- Signals: Envoy 1.38 EOL 2027-04-23 · CVE-2026-54786 — CISA KEV: not listed, EPSS 0.00
- Platform/SRE — Plan: Two GHSA-classified crash vulnerabilities in Envoy’s oauth2 and api_key_auth filters can be triggered by CONNECT requests; no KEV listing or active exploitation reported, but any team running these filters in production should schedule an upgrade to v1.37.8 this sprint. Envoy 1.37 EOL is 2027-01-13, so the branch is still supported.
- CI/CD — Skip
- Leader — Skip
- Signals: Envoy 1.37 EOL 2027-01-13
- Platform/SRE — Plan: Teams running Apigee hybrid on Kubernetes should schedule an upgrade to v1.15.8, which patches several security issues: JWT refresh token revocation, HTTP 103 Early Hints response desynchronization, JavaCallout policy, and SSRF in AI protection policies. No KEV listing or active exploitation reported, so no immediate emergency, but the Helm chart upgrade path is straightforward.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Plan: Self-hosted GitLab operators should schedule patching to 19.4.1, 19.3.3, or 19.2.7 this sprint; GitLab’s ‘Critical’ classification signals high-severity CVEs, but no KEV listing or active exploitation is confirmed in the signals, so Act threshold is not met.
- CI/CD — Plan: If GitLab is the CI/CD platform, queue an upgrade to the appropriate critical patch release (19.4.1/19.3.3/19.2.7) within the current sprint; no confirmed supply-chain compromise or exploitation evidence, but critical-severity vulnerabilities in the CI platform warrant prompt scheduling.
- Leader — Skip
- Platform/SRE — Plan: Grafana is a standard part of the observability stack platform teams own; 13.2.2 patches three CVEs (EPSS ≤ 0.01, none KEV-listed), so no emergency but schedule an upgrade of Grafana instances this sprint to stay current on security fixes.
- CI/CD — Skip
- Leader — Skip
- Signals: CVE-2026-15815 — CISA KEV: not listed, EPSS 0.01 · CVE-2026-76154 — CISA KEV: not listed, EPSS 0.00 · CVE-2026-79656 — CISA KEV: not listed, EPSS n/a
- Platform/SRE — Plan: Organizations self-hosting GitLab on their clusters should schedule an upgrade to 19.3.2, 19.2.6, or 19.1.8; the ‘Critical’ designation signals high-severity CVEs, but no KEV or active exploitation is confirmed in the signals, so this is a prompt-but-planned patch rather than an emergency.
- CI/CD — Plan: GitLab is a core CI/CD platform; a critical-labeled patch release warrants updating self-hosted instances promptly — plan the upgrade to the relevant supported minor (19.3.2 / 19.2.6 / 19.1.8) this sprint, but no confirmed exploitation anchor elevates this to Act.
- Leader — Skip
- Platform/SRE — Plan: Teams running Argo CD should schedule an upgrade to 3.4.8 this sprint: it patches three CVEs in UI JS dependencies (none KEV-listed, EPSS ≤ 0.01) and fixes an auto-sync regression that silently skips syncs when a newer commit arrives during an active sync. No hard deadline, but the sync bug is a silent correctness risk on busy clusters.
- CI/CD — Skip
- Leader — Skip
- Signals: Argo CD 3.4 supported · CVE-2026-14257 — CISA KEV: not listed, EPSS 0.00 · CVE-2026-49978 — CISA KEV: not listed, EPSS 0.00 · CVE-2026-59869 — CISA KEV: not listed, EPSS 0.01
- Platform/SRE — Plan: If running a self-managed GitLab instance, upgrade to the patched version in your release line; no public PoC or KEV listing is confirmed from the title alone, so this is urgent-but-scheduled rather than emergency.
- CI/CD — Act: GitLab CI users on self-managed instances should upgrade to 19.2.4, 19.1.6, 19.0.8, or 18.11.11 promptly — a critical patch to the CI/CD platform itself can directly break or compromise pipelines and should be treated as an outage-level priority.
- Leader — Skip
- Signals: major release (19.0)
- Platform/SRE — Plan: Platform engineers running OpenTofu should upgrade to 1.12.5 to address the ECH handshake privacy leak (server hostname de-anonymization via passive observation) and the implicit-move provider state bug; no KEV listing or active exploitation reported, so no hard deadline, but this should be included in the next IaC toolchain update cycle.
- CI/CD — Skip
- Leader — Skip