CVE-2026-64858: vulnerability-operator: IDOR exposing vulnerability reports via unauthenticated Report Handler
vulnerability-operator scans SBOMs and Images for vulnerabilities. Prior to version 0.28.16, an unauthenticated information-disclosure vulnerability exposes all vulnerability scan reports served by the operator. The /report/ HTTP endpoint mounts a raw http.FileServer over the reports directory (default /reports) with no authentication, authorization, or middleware. Any client that can reach the operator's HTTP port (default 8080) can list and download every JSON vulnerability report, disclosing CVE IDs, affected package names/versions, and container image identifiers for every workload scanned in the cluster. This issue has been patched in version 0.28.16.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
vulnerability-operatorto a version that resolves this vulnerability.Fixed in 0.28.16
Event History
Frequently Asked Questions
Who can access the exposed reports?
Any unauthenticated client that can reach the operator's HTTP port can list and download all reports. The default HTTP port is 8080, so exposure depends on whether that port is reachable from the client's network location.
Are default deployments affected?
Yes. Before version 0.28.16, the /report/ endpoint serves the reports directory without authentication or authorization. The default reports directory is /reports.
What information can be disclosed?
An attacker can retrieve JSON vulnerability reports for every workload scanned in the cluster. These reports can disclose CVE IDs, affected package names and versions, and container image identifiers.
What should be done if an immediate upgrade is not possible?
Restrict network access to the operator's HTTP port so untrusted clients cannot reach it. This limits access to the unauthenticated /report/ endpoint until version 0.28.16 can be deployed.
How can I determine whether reports may already be exposed?
Check whether the deployment runs a version earlier than 0.28.16 and whether its HTTP port, default 8080, is reachable by untrusted clients. If both conditions apply, the reports served from /report/ may have been accessible without authentication.