CVE-2026-108728Medium· 6.5▾ SunlitFlyte 2.0.1 through 2.0.51 contains a cleartext secret storage vulnerability that allows users with Pod read access to obtain secrets by reading init container environment variables. The embedded secret manager webhook writes base64-enco…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Flyte 2.0.1 through 2.0.51 contains a cleartext secret storage vulnerability that allows users with Pod read access to obtain secrets by reading init container environment variables. The embedded secret manager webhook writes base64-encoded FILE-mounted secret values into the SECRETS environment variable, letting principals without Secret store access decode them from the Pod spec.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-34214High· 7.7Trino is a distributed SQL query engine for big data analytics
CVE-2026-7163Medium· 6.1A vulnerability in the assisted-service REST API, an optional Assisted Installer (assisted-service) component in the Multicluster Engine (MCE), allows an authenticated user with minimal namespace-scoped privileges to obtain administrativ…
CVE-2026-107857Medium· 4.4Mindwtr is a free offline-first task management application for desktop and mobile
CVE-2026-62376High· 8.1Vikunja is an open-source self-hosted task management platform
CVE-2024-4540High· 7.5A flaw was found in Keycloak in OAuth 2.0 Pushed Authorization Requests (PAR)
CVE-2026-107807High· 8.8Nginx UI is a web user interface for the Nginx web server