Xen publishes XSA-530 on multiple XAPI RBAC issues
Version 2 makes five CVE-tracked XAPI role issues public; versions and fixes are not stated.
Stories per day · 30 days
2 RSS
Relatedaccess-control1airflow1apache1apache-answer1authorization1cve-2026-350291cve-2026-598231cve-2026-649451litellm1llm-gateway1permissions1rce1ssrf1xapi1xen1xsa-5301
16 stories, newest first · one card per story
Stories tagged #rbac
Apache Airflow Import Errors API leaks stack traces (CVE-2026-40913)
The Import Errors API exposes raw parse-failure stack traces to users with ImportError.can_read permission in Apache Airflow before 3.4.0.
CVE-2026-64945: Apache Answer: Incorrect permission mapping allows users with only the unpin permission to hide/show questions
Apache Answer through 2.0.2 lets unpin-only users hide or show questions.
When LLM Gateways Go Wrong: Findings from LiteLLM
Check Point found patched LiteLLM flaws enabling config takeover, file read, RCE, and key theft.
5
Keyorix: Open-source secrets management for teams that can’t use SaaS
Keyorix launched a free, open-source, self-hosted secrets manager for teams unable to use SaaS, with AES-256-GCM encryption and RBAC.
4
Guarding the gates: Assessing dangerous permissions granted to Kubernetes built-in principals
Datadog found over 3,500 dangerous RBAC grants to Kubernetes built-in principals across 65,000 clusters.
7
Updates on our pledge to make Cloudflare features accessible to everyone
Cloudflare opened Logpush, Transformers, and broader RBAC to non-Enterprise plans while expanding multi-account management.
13
Containing the Autonomous Operator: A Defense-in-Depth Framework and Reference Architecture for Securing AI Agents on Kubernetes
Framework secures LLM agents on Kubernetes assuming full prompt-injection compromise, mapping seven defense layers to EKS, AKS, and GKE controls.
New OperTraitors Tool Reveals Dangerous Privilege Escalation Paths in Kubernetes Operators
Palo Alto Networks released OperTraitor to flag Kubernetes operators granted excessive RBAC privileges.
1
OperTraitor Finds Kubernetes Operators With Cluster-Wide Secret Access and Admin Paths
OperTraitor finds Kubernetes operators with excessive RBAC, including IBM CVE-2026-6389 cluster-wide secret access.
1
OperTraitors: How Kubernetes Operators Betray Your Security Posture
Unit 42's OperTraitor flags overprivileged Kubernetes operators and found CVE-2026-6389 in IBM Turbonomic.
4
CVE-2026-92142: Apache Karaf: Authorization bypass in JMX MBean lifecycle operations
Apache Karaf before 4.4.12 has an authorization bypass in JMX MBean lifecycle operations.
[kubernetes] CVE-2026-2270: StatefulSet and ControllerRevision write permissions allow cross-namespace pod creation
A Kubernetes StatefulSet flaw lets namespace-scoped writers create a pod in another namespace.
The AI security question leaders should be asking instead
Gremlin security officer Frederic Bull argues AI has eroded the attacker-defender skill asymmetry while least-privilege controls remain essential for securing AI agents.
2
Give every teammate and agent the right level of access to your Workers
Cloudflare launches per-Worker granular access controls with four roles, enabling least-privilege access for teammates, AI agents, and CI/CD pipelines.
6
Empirical Evaluation of Task-Based Permission Scoping Architecture for AI Agents
Fine-tuned RoBERTa-large task permission classifier matches Claude Haiku 4.5 on access scoping for AI agents, cutting severity-weighted attack surface by 84.4%.