---
id: GO-2026-6538
aliases:
  - GHSA-jhjp-4c2q-xmx4
title: >-
  k8saudit shipped rules do not detect privileged/sensitive settings on init or
  ephemeral containers in github.com/falcosecurity/plugins/pl…
summary: >-
  k8saudit shipped rules do not detect privileged/sensitive settings on init or
  ephemeral containers in github.com/falcosecurity/plugins/plugins/k8saudit
severity: none
vendor: falcosecurity
product: github.com/falcosecurity/plugins/plugins/k8saudit
ecosystem: go
affected:
  - github.com/falcosecurity/plugins/plugins/k8saudit < 0.18.0
  - github.com/falcosecurity/plugins/plugins/k8saudit-aks < 0.6.0
  - github.com/falcosecurity/plugins/plugins/k8saudit-eks < 0.12.0
  - github.com/falcosecurity/plugins/plugins/k8saudit-gke < 0.9.0
  - github.com/falcosecurity/plugins/plugins/k8saudit-ovh < 0.6.0
patched:
  - github.com/falcosecurity/plugins/plugins/k8saudit 0.18.0
  - github.com/falcosecurity/plugins/plugins/k8saudit-aks 0.6.0
  - github.com/falcosecurity/plugins/plugins/k8saudit-eks 0.12.0
  - github.com/falcosecurity/plugins/plugins/k8saudit-gke 0.9.0
  - github.com/falcosecurity/plugins/plugins/k8saudit-ovh 0.6.0
published: '2026-09-28'
updated: '2026-09-28'
sourceUpdated: '2026-09-28T17:00:17.504317723Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GO-2026-6538'
references:
  - url: >-
      https://github.com/falcosecurity/plugins/security/advisories/GHSA-jhjp-4c2q-xmx4
  - url: >-
      https://github.com/falcosecurity/plugins/commit/0adb9b3c7e2c8bad53f30d01c057e038b2afa5e1
  - url: 'https://github.com/falcosecurity/plugins/pull/1400'
  - url: >-
      https://github.com/falcosecurity/plugins/releases/tag/plugins/k8saudit-aks/v0.6.0
  - url: >-
      https://github.com/falcosecurity/plugins/releases/tag/plugins/k8saudit-eks/v0.12.0
  - url: >-
      https://github.com/falcosecurity/plugins/releases/tag/plugins/k8saudit-gke/v0.9.0
  - url: >-
      https://github.com/falcosecurity/plugins/releases/tag/plugins/k8saudit-ovh/v0.6.0
  - url: >-
      https://github.com/falcosecurity/plugins/releases/tag/plugins/k8saudit/v0.18.0
tags:
  - osv
  - go
ingestedAt: '2026-09-29T07:20:57.380Z'
---

## Overview

k8saudit shipped rules do not detect privileged/sensitive settings on init or ephemeral containers in github.com/falcosecurity/plugins/plugins/k8saudit

## Affected packages

- `github.com/falcosecurity/plugins/plugins/k8saudit < 0.18.0`
- `github.com/falcosecurity/plugins/plugins/k8saudit-aks < 0.6.0`
- `github.com/falcosecurity/plugins/plugins/k8saudit-eks < 0.12.0`
- `github.com/falcosecurity/plugins/plugins/k8saudit-gke < 0.9.0`
- `github.com/falcosecurity/plugins/plugins/k8saudit-ovh < 0.6.0`

## Remediation

Upgrade to a patched release:

- `github.com/falcosecurity/plugins/plugins/k8saudit 0.18.0`
- `github.com/falcosecurity/plugins/plugins/k8saudit-aks 0.6.0`
- `github.com/falcosecurity/plugins/plugins/k8saudit-eks 0.12.0`
- `github.com/falcosecurity/plugins/plugins/k8saudit-gke 0.9.0`
- `github.com/falcosecurity/plugins/plugins/k8saudit-ovh 0.6.0`