hakman/ingress-nginx

API keys, passwords or tokens committed into the repo.

• Serious curl-auth-user Discovered a potential basic authorization token provided in a curl command, which could compromise the curl accessed resource.
  docs/examples/auth/basic/README.md:97
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious curl-auth-user Discovered a potential basic authorization token provided in a curl command, which could compromise the curl accessed resource.
  docs/examples/auth/external-auth/README.md:128
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
  rootfs/etc/nginx/lua/test/fixtures/example-com-cert.pem:18
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
  rootfs/etc/nginx/lua/test/fixtures/default-cert.pem:18
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious jwt-base64 Detected a Base64-encoded JSON Web Token, posing a risk of exposing encoded authentication and data exchange information.
  internal/ingress/controller/controller_test.go:1494
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious jwt Uncovered a JSON Web Token, which may lead to unauthorized access to web applications and sensitive user data.
  internal/ingress/controller/controller_test.go:1494
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  docs/examples/auth/basic/README.md:29
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  images/kube-webhook-certgen/rootfs/pkg/k8s/k8s_test.go:23
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.

via Gitleaks v8.21.2 · MIT

Packages you depend on that have known security holes (CVEs).

• Serious CVE-2026-33186 google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation
  go.mod
  A package you depend on has a known security hole (CVE-2026-33186). Fix: Update that package to its patched version.
• Worth fixing GHSA-6xv5-86q9-7xr8 SecureJoin: on windows, paths outside of the rootfs could be inadvertently produced
  go.mod
  A package you depend on has a known security hole (GHSA-6xv5-86q9-7xr8). Fix: Update that package to its patched version.
• Worth fixing CVE-2023-42821 The package `github.com/gomarkdown/markdown` is a Go library for parsi ...
  go.mod
  A package you depend on has a known security hole (CVE-2023-42821). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-40890 github.com/gomarkdown/markdown: github.com/gomarkdown/markdown: Denial of Service via malformed Markdown input
  go.mod
  A package you depend on has a known security hole (CVE-2026-40890). Fix: Update that package to its patched version.
• Worth fixing CVE-2024-44337 gomarkdown/markdown: infinite loop via the paragraph function of parser/block.go
  go.mod
  A package you depend on has a known security hole (CVE-2024-44337). Fix: Update that package to its patched version.
• Worth fixing CVE-2024-21626 runc: file descriptor leak
  go.mod
  A package you depend on has a known security hole (CVE-2024-21626). Fix: Update that package to its patched version.
• Worth fixing CVE-2025-31133 runc: container escape via 'masked path' abuse due to mount race conditions
  go.mod
  A package you depend on has a known security hole (CVE-2025-31133). Fix: Update that package to its patched version.
• Worth fixing CVE-2025-52565 runc: container escape with malicious config due to /dev/console mount and related races
  go.mod
  A package you depend on has a known security hole (CVE-2025-52565). Fix: Update that package to its patched version.
• Worth fixing CVE-2025-52881 runc: opencontainers/selinux: container escape and denial of service due to arbitrary write gadgets and procfs write redirects
  go.mod
  A package you depend on has a known security hole (CVE-2025-52881). Fix: Update that package to its patched version.
• Worth fixing CVE-2024-45310 runc: runc can be tricked into creating empty files/directories on host
  go.mod
  A package you depend on has a known security hole (CVE-2024-45310). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-41579 runc: runc: Host filesystem integrity compromised by malicious container images
  go.mod
  A package you depend on has a known security hole (CVE-2026-41579). Fix: Update that package to its patched version.
• Worth fixing CVE-2025-65637 github.com/sirupsen/logrus: github.com/sirupsen/logrus: Denial-of-Service due to large single-line payload
  go.mod
  A package you depend on has a known security hole (CVE-2025-65637). Fix: Update that package to its patched version.
• Worth fixing CVE-2024-45337 golang.org/x/crypto/ssh: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto
  go.mod
  A package you depend on has a known security hole (CVE-2024-45337). Fix: Update that package to its patched version.
• Worth fixing CVE-2025-22869 golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh
  go.mod
  A package you depend on has a known security hole (CVE-2025-22869). Fix: Update that package to its patched version.
• Worth fixing CVE-2025-47913 golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: SSH client panic due to unexpected SSH_AGENT_SUCCESS
  go.mod
  A package you depend on has a known security hole (CVE-2025-47913). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-39828 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions
  go.mod
  A package you depend on has a known security hole (CVE-2026-39828). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-39829 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters
  go.mod
  A package you depend on has a known security hole (CVE-2026-39829). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-39830 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses
  go.mod
  A package you depend on has a known security hole (CVE-2026-39830). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-39831 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security key bypass due to missing user presence check
  go.mod
  A package you depend on has a known security hole (CVE-2026-39831). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-39832 golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions
  go.mod
  A package you depend on has a known security hole (CVE-2026-39832). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-39835 golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate
  go.mod
  A package you depend on has a known security hole (CVE-2026-39835). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-42508 golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey
  go.mod
  A package you depend on has a known security hole (CVE-2026-42508). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-46595 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authorization bypass due to skipped source-address validation
  go.mod
  A package you depend on has a known security hole (CVE-2026-46595). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-46597 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs
  go.mod
  A package you depend on has a known security hole (CVE-2026-46597). Fix: Update that package to its patched version.
• Worth fixing CVE-2023-48795 ssh: Prefix truncation attack on Binary Packet Protocol (BPP)
  go.mod
  A package you depend on has a known security hole (CVE-2023-48795). Fix: Update that package to its patched version.

via Trivy v0.70.0 · Apache-2.0

Your dependencies cross-checked against the OSV vulnerability database.

• Serious GO-2024-3321 Misuse of connection.serverAuthenticate may cause authorization bypass in golang.org/x/crypto
  /workdirs/scan-c99f713e-d74f-42f5-9b2f-bed6e2fcc907/go.mod
  A package you depend on has a known security hole (CVE-2024-45337). Fix: Update that package to its patched version.
• Serious GO-2026-5005 Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent
  /workdirs/scan-c99f713e-d74f-42f5-9b2f-bed6e2fcc907/go.mod
  A package you depend on has a known security hole (CVE-2026-39833). Fix: Update that package to its patched version.
• Serious GO-2026-5006 Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent
  /workdirs/scan-c99f713e-d74f-42f5-9b2f-bed6e2fcc907/go.mod
  A package you depend on has a known security hole (CVE-2026-39832). Fix: Update that package to its patched version.
• Serious GO-2026-5017 Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh
  /workdirs/scan-c99f713e-d74f-42f5-9b2f-bed6e2fcc907/go.mod
  A package you depend on has a known security hole (CVE-2026-39830). Fix: Update that package to its patched version.
• Serious GO-2026-5019 Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh
  /workdirs/scan-c99f713e-d74f-42f5-9b2f-bed6e2fcc907/go.mod
  A package you depend on has a known security hole (CVE-2026-39831). Fix: Update that package to its patched version.
• Serious GO-2026-5020 Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh
  /workdirs/scan-c99f713e-d74f-42f5-9b2f-bed6e2fcc907/go.mod
  A package you depend on has a known security hole (CVE-2026-39834). Fix: Update that package to its patched version.
• Serious GO-2026-5021 Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts
  /workdirs/scan-c99f713e-d74f-42f5-9b2f-bed6e2fcc907/go.mod
  A package you depend on has a known security hole (CVE-2026-42508). Fix: Update that package to its patched version.
• Serious GO-2026-5023 Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh
  /workdirs/scan-c99f713e-d74f-42f5-9b2f-bed6e2fcc907/go.mod
  A package you depend on has a known security hole (CVE-2026-46595). Fix: Update that package to its patched version.
• Serious GO-2026-4762 Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc
  /workdirs/scan-c99f713e-d74f-42f5-9b2f-bed6e2fcc907/go.mod
  A package you depend on has a known security hole (CVE-2026-33186). Fix: Update that package to its patched version.
• Serious GO-2024-3321 Misuse of connection.serverAuthenticate may cause authorization bypass in golang.org/x/crypto
  /workdirs/scan-c99f713e-d74f-42f5-9b2f-bed6e2fcc907/magefiles/go.mod
  A package you depend on has a known security hole (CVE-2024-45337). Fix: Update that package to its patched version.
• Serious GO-2026-5005 Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent
  /workdirs/scan-c99f713e-d74f-42f5-9b2f-bed6e2fcc907/magefiles/go.mod
  A package you depend on has a known security hole (CVE-2026-39833). Fix: Update that package to its patched version.
• Serious GO-2026-5006 Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent
  /workdirs/scan-c99f713e-d74f-42f5-9b2f-bed6e2fcc907/magefiles/go.mod
  A package you depend on has a known security hole (CVE-2026-39832). Fix: Update that package to its patched version.
• Serious GO-2026-5017 Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh
  /workdirs/scan-c99f713e-d74f-42f5-9b2f-bed6e2fcc907/magefiles/go.mod
  A package you depend on has a known security hole (CVE-2026-39830). Fix: Update that package to its patched version.
• Serious GO-2026-5019 Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh
  /workdirs/scan-c99f713e-d74f-42f5-9b2f-bed6e2fcc907/magefiles/go.mod
  A package you depend on has a known security hole (CVE-2026-39831). Fix: Update that package to its patched version.
• Serious GO-2026-5020 Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh
  /workdirs/scan-c99f713e-d74f-42f5-9b2f-bed6e2fcc907/magefiles/go.mod
  A package you depend on has a known security hole (CVE-2026-39834). Fix: Update that package to its patched version.
• Serious GO-2026-5021 Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts
  /workdirs/scan-c99f713e-d74f-42f5-9b2f-bed6e2fcc907/magefiles/go.mod
  A package you depend on has a known security hole (CVE-2026-42508). Fix: Update that package to its patched version.
• Serious GO-2026-5023 Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh
  /workdirs/scan-c99f713e-d74f-42f5-9b2f-bed6e2fcc907/magefiles/go.mod
  A package you depend on has a known security hole (CVE-2026-46595). Fix: Update that package to its patched version.
• Worth fixing GO-2023-2074 Parser out-of-bounds read caused by a malformed markdown input in github.com/gomarkdown/markdown
  /workdirs/scan-c99f713e-d74f-42f5-9b2f-bed6e2fcc907/go.mod
  A package you depend on has a known security hole (CVE-2023-42821). Fix: Update that package to its patched version.
• Worth fixing GO-2024-3205 Infinite loop in github.com/gomarkdown/markdown
  /workdirs/scan-c99f713e-d74f-42f5-9b2f-bed6e2fcc907/go.mod
  A package you depend on has a known security hole (CVE-2024-44337). Fix: Update that package to its patched version.
• Worth fixing GO-2026-5208 Go Markdown has an out-of-bounds read in SmartypantsRenderer in github.com/gomarkdown/markdown
  /workdirs/scan-c99f713e-d74f-42f5-9b2f-bed6e2fcc907/go.mod
  A package you depend on has a known security hole (CVE-2026-40890). Fix: Update that package to its patched version.
• Worth fixing GO-2024-2491 Container breakout through process.cwd trickery and leaked fds in github.com/opencontainers/runc
  /workdirs/scan-c99f713e-d74f-42f5-9b2f-bed6e2fcc907/go.mod
  A package you depend on has a known security hole (CVE-2024-21626). Fix: Update that package to its patched version.
• Worth fixing GO-2024-3110 Can be confused to create empty files/directories on the host in github.com/opencontainers/runc
  /workdirs/scan-c99f713e-d74f-42f5-9b2f-bed6e2fcc907/go.mod
  A package you depend on has a known security hole (CVE-2024-45310). Fix: Update that package to its patched version.
• Worth fixing GO-2025-4096 Container escape via "masked path" abuse due to mount race conditions in github.com/opencontainers/runc
  /workdirs/scan-c99f713e-d74f-42f5-9b2f-bed6e2fcc907/go.mod
  A package you depend on has a known security hole (CVE-2025-31133). Fix: Update that package to its patched version.
• Worth fixing GO-2025-4097 Container escape with malicious config due to /dev/console mount and related races in github.com/opencontainers/runc
  /workdirs/scan-c99f713e-d74f-42f5-9b2f-bed6e2fcc907/go.mod
  A package you depend on has a known security hole (CVE-2025-52565). Fix: Update that package to its patched version.
• Worth fixing GO-2025-4098 Container escape and DDoS due to arbitrary write gadgets and procfs write redirects in github.com/opencontainers/runc
  /workdirs/scan-c99f713e-d74f-42f5-9b2f-bed6e2fcc907/go.mod
  A package you depend on has a known security hole (CVE-2025-52881). Fix: Update that package to its patched version.

via OSV-Scanner v1.9.2 · Apache-2.0

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Packages that look intentionally malicious: typosquats, sneaky install scripts.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via Guarddog v2.10.0 · Apache-2.0

error: go:timeout