wozniakjan/kubermatic

API keys, passwords or tokens committed into the repo.

• Serious kubernetes-secret-yaml Possible Kubernetes Secret detected, posing a risk of leaking credentials/tokens from your deployments
  charts/test/seed.example.yaml:16
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious kubernetes-secret-yaml Possible Kubernetes Secret detected, posing a risk of leaking credentials/tokens from your deployments
  hack/ci/testdata/seed.yaml:15
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
  pkg/controller/seed-controller-manager/etcdbackup/etcd_backup_controller_test.go:212
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious jwt Uncovered a JSON Web Token, which may lead to unauthorized access to web applications and sensitive user data.
  pkg/handler/test/helper.go:121
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious jwt Uncovered a JSON Web Token, which may lead to unauthorized access to web applications and sensitive user data.
  pkg/provider/kubernetes/user_test.go:60
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious jwt Uncovered a JSON Web Token, which may lead to unauthorized access to web applications and sensitive user data.
  pkg/provider/kubernetes/util_test.go:43
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  hack/ci/testdata/oauth_values.yaml:32
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  pkg/addon/testdata/cluster-kubernetes-aws.yaml:34
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  pkg/addon/testdata/cluster-kubernetes-do.yaml:28
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  pkg/handler/v1/provider/openstack_test.go:47
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  pkg/handler/test/helper.go:119
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  pkg/handler/test/helper.go:806
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  pkg/handler/v2/external_cluster/external_cluster_test.go:55
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  pkg/handler/v2/external_cluster/external_cluster_test.go:66
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  pkg/handler/v2/external_cluster/external_cluster_test.go:80
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  pkg/handler/v2/external_cluster/external_cluster_test.go:97
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  pkg/provider/kubernetes/external_cluster_test.go:36
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  pkg/resources/test/load_files_test.go:314
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.

via Gitleaks v8.21.2 · MIT

Packages you depend on that have known security holes (CVEs).

• Serious CVE-2022-1996 go-restful: Authorization Bypass Through User-Controlled Key
  go.mod
  A package you depend on has a known security hole (CVE-2022-1996). Fix: Update that package to its patched version.
• Serious CVE-2023-3128 grafana: account takeover possible when using Azure AD OAuth
  go.mod
  A package you depend on has a known security hole (CVE-2023-3128). Fix: Update that package to its patched version.
• Serious CVE-2019-20933 influxdb: authentication bypass because a JWT token may have an empty SharedSecret
  go.mod
  A package you depend on has a known security hole (CVE-2019-20933). Fix: Update that package to its patched version.
• Serious CVE-2020-26892 The JWT library in NATS nats-server before 2.1.9 has Incorrect Access ...
  go.mod
  A package you depend on has a known security hole (CVE-2020-26892). Fix: Update that package to its patched version.
• Serious CVE-2026-33186 google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation
  go.mod
  A package you depend on has a known security hole (CVE-2026-33186). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-41602 github.com/apache/thrift: Apache Thrift: Integer Overflow in TFramedTransport Go implementation
  go.mod
  A package you depend on has a known security hole (CVE-2026-41602). Fix: Update that package to its patched version.
• Worth fixing CVE-2022-23648 containerd: insecure handling of image volumes
  go.mod
  A package you depend on has a known security hole (CVE-2022-23648). Fix: Update that package to its patched version.
• Worth fixing CVE-2024-25621 github.com/containerd/containerd: containerd local privilege escalation
  go.mod
  A package you depend on has a known security hole (CVE-2024-25621). Fix: Update that package to its patched version.
• Worth fixing CVE-2020-15257 containerd: unrestricted access to abstract Unix domain socket can lead to privileges escalation
  go.mod
  A package you depend on has a known security hole (CVE-2020-15257). Fix: Update that package to its patched version.
• Worth fixing CVE-2021-21334 plugin: information leak between containers via environment variables
  go.mod
  A package you depend on has a known security hole (CVE-2021-21334). Fix: Update that package to its patched version.
• Worth fixing CVE-2021-32760 containerd: pulling and extracting crafted container image may result in Unix file permission changes
  go.mod
  A package you depend on has a known security hole (CVE-2021-32760). Fix: Update that package to its patched version.
• Worth fixing CVE-2021-41103 containerd: insufficiently restricted permissions on container root and plugin directories
  go.mod
  A package you depend on has a known security hole (CVE-2021-41103). Fix: Update that package to its patched version.
• Worth fixing CVE-2022-23471 containerd is an open source container runtime. A bug was found in con ...
  go.mod
  A package you depend on has a known security hole (CVE-2022-23471). Fix: Update that package to its patched version.
• Worth fixing CVE-2022-31030 containerd is an open source container runtime. A bug was found in the ...
  go.mod
  A package you depend on has a known security hole (CVE-2022-31030). Fix: Update that package to its patched version.
• Worth fixing CVE-2023-25153 containerd: OCI image importer memory exhaustion
  go.mod
  A package you depend on has a known security hole (CVE-2023-25153). Fix: Update that package to its patched version.
• Worth fixing CVE-2023-25173 containerd: Supplementary groups are not set up properly
  go.mod
  A package you depend on has a known security hole (CVE-2023-25173). Fix: Update that package to its patched version.
• Worth fixing CVE-2024-40635 containerd: containerd has an integer overflow in User ID handling
  go.mod
  A package you depend on has a known security hole (CVE-2024-40635). Fix: Update that package to its patched version.
• Worth fixing CVE-2025-64329 github.com/containerd/containerd: containerd: Memory exhaustion via CRI Attach implementation goroutine leaks
  go.mod
  A package you depend on has a known security hole (CVE-2025-64329). Fix: Update that package to its patched version.
• Worth fixing GHSA-7ww5-4wqc-m92c containerd allows RAPL to be accessible to a container
  go.mod
  A package you depend on has a known security hole (GHSA-7ww5-4wqc-m92c). Fix: Update that package to its patched version.
• Worth fixing CVE-2021-20206 containernetworking-cni: Arbitrary path injection via type field in CNI configuration
  go.mod
  A package you depend on has a known security hole (CVE-2021-20206). Fix: Update that package to its patched version.
• Worth fixing CVE-2022-1706 ignition: configs are accessible from unprivileged containers in VMs running on VMware products
  go.mod
  A package you depend on has a known security hole (CVE-2022-1706). Fix: Update that package to its patched version.
• Worth fixing CVE-2021-41092 docker: cli leaks private registry credentials to registry-1.docker.io
  go.mod
  A package you depend on has a known security hole (CVE-2021-41092). Fix: Update that package to its patched version.
• Worth fixing CVE-2023-2253 distribution/distribution: DoS from malicious API request
  go.mod
  A package you depend on has a known security hole (CVE-2023-2253). Fix: Update that package to its patched version.
• Worth fixing CVE-2018-12608 moby: cert signing bypass
  go.mod
  A package you depend on has a known security hole (CVE-2018-12608). Fix: Update that package to its patched version.
• Worth fixing CVE-2019-13509 docker: Docker Engine in debug mode may sometimes add secrets to the debug log leading to information disclosure
  go.mod
  A package you depend on has a known security hole (CVE-2019-13509). Fix: Update that package to its patched version.

via Trivy v0.70.0 · Apache-2.0

Your dependencies cross-checked against the OSV vulnerability database.

• Serious GHSA-mpv3-g8m3-3fjc Grafana vulnerable to Authentication Bypass by Spoofing
  /workdirs/scan-d5719180-80b8-496e-b0d0-54987ab5cf38/go.mod
  A package you depend on has a known security hole (CVE-2023-3128). Fix: Update that package to its patched version.
• Serious GO-2024-3321 Misuse of connection.serverAuthenticate may cause authorization bypass in golang.org/x/crypto
  /workdirs/scan-d5719180-80b8-496e-b0d0-54987ab5cf38/go.mod
  A package you depend on has a known security hole (CVE-2024-45337). Fix: Update that package to its patched version.
• Serious GO-2026-5005 Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent
  /workdirs/scan-d5719180-80b8-496e-b0d0-54987ab5cf38/go.mod
  A package you depend on has a known security hole (CVE-2026-39833). Fix: Update that package to its patched version.
• Serious GO-2026-5006 Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent
  /workdirs/scan-d5719180-80b8-496e-b0d0-54987ab5cf38/go.mod
  A package you depend on has a known security hole (CVE-2026-39832). Fix: Update that package to its patched version.
• Serious GO-2026-5017 Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh
  /workdirs/scan-d5719180-80b8-496e-b0d0-54987ab5cf38/go.mod
  A package you depend on has a known security hole (CVE-2026-39830). Fix: Update that package to its patched version.
• Serious GO-2026-5019 Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh
  /workdirs/scan-d5719180-80b8-496e-b0d0-54987ab5cf38/go.mod
  A package you depend on has a known security hole (CVE-2026-39831). Fix: Update that package to its patched version.
• Serious GO-2026-5020 Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh
  /workdirs/scan-d5719180-80b8-496e-b0d0-54987ab5cf38/go.mod
  A package you depend on has a known security hole (CVE-2026-39834). Fix: Update that package to its patched version.
• Serious GO-2026-5021 Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts
  /workdirs/scan-d5719180-80b8-496e-b0d0-54987ab5cf38/go.mod
  A package you depend on has a known security hole (CVE-2026-42508). Fix: Update that package to its patched version.
• Serious GO-2026-5023 Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh
  /workdirs/scan-d5719180-80b8-496e-b0d0-54987ab5cf38/go.mod
  A package you depend on has a known security hole (CVE-2026-46595). Fix: Update that package to its patched version.
• Serious GO-2026-4762 Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc
  /workdirs/scan-d5719180-80b8-496e-b0d0-54987ab5cf38/go.mod
  A package you depend on has a known security hole (CVE-2026-33186). Fix: Update that package to its patched version.
• Serious GO-2022-0619 Authorization bypass in github.com/emicklei/go-restful, go-restful/v2 and go-restful/v3
  /workdirs/scan-d5719180-80b8-496e-b0d0-54987ab5cf38/go.sum
  A package you depend on has a known security hole (CVE-2022-1996). Fix: Update that package to its patched version.
• Worth fixing GHSA-hqxw-f8mx-cpmw distribution catalog API endpoint can lead to OOM via malicious user input
  /workdirs/scan-d5719180-80b8-496e-b0d0-54987ab5cf38/go.mod
  A package you depend on has a known security hole (CVE-2023-2253). Fix: Update that package to its patched version.
• Worth fixing GO-2021-0053 Panic due to improper input validation in github.com/gogo/protobuf
  /workdirs/scan-d5719180-80b8-496e-b0d0-54987ab5cf38/go.mod
  A package you depend on has a known security hole (CVE-2021-3121). Fix: Update that package to its patched version.
• Worth fixing GO-2024-2513 Grafana information disclosure in github.com/grafana/grafana
  /workdirs/scan-d5719180-80b8-496e-b0d0-54987ab5cf38/go.mod
  A package you depend on has a known security hole (CVE-2020-12458). Fix: Update that package to its patched version.
• Worth fixing GO-2024-2515 Grafana XSS via the OpenTSDB datasource in github.com/grafana/grafana
  /workdirs/scan-d5719180-80b8-496e-b0d0-54987ab5cf38/go.mod
  A package you depend on has a known security hole (CVE-2020-13430). Fix: Update that package to its patched version.
• Worth fixing GO-2024-2516 Grafana XSS via a column style in github.com/grafana/grafana
  /workdirs/scan-d5719180-80b8-496e-b0d0-54987ab5cf38/go.mod
  A package you depend on has a known security hole (CVE-2018-18624). Fix: Update that package to its patched version.
• Worth fixing GO-2024-2517 Grafana XSS in header column rename in github.com/grafana/grafana
  /workdirs/scan-d5719180-80b8-496e-b0d0-54987ab5cf38/go.mod
  A package you depend on has a known security hole (CVE-2020-12245). Fix: Update that package to its patched version.
• Worth fixing GO-2024-2519 Grafana world readable configuration files in github.com/grafana/grafana
  /workdirs/scan-d5719180-80b8-496e-b0d0-54987ab5cf38/go.mod
  A package you depend on has a known security hole (CVE-2020-12459). Fix: Update that package to its patched version.
• Worth fixing GO-2024-2520 Grafana XSS via a query alias for the ElasticSearch datasource in github.com/grafana/grafana
  /workdirs/scan-d5719180-80b8-496e-b0d0-54987ab5cf38/go.mod
  A package you depend on has a known security hole (CVE-2020-24303). Fix: Update that package to its patched version.
• Worth fixing GO-2024-2523 Grafana stored XSS in github.com/grafana/grafana
  /workdirs/scan-d5719180-80b8-496e-b0d0-54987ab5cf38/go.mod
  A package you depend on has a known security hole (CVE-2020-11110). Fix: Update that package to its patched version.
• Worth fixing GO-2024-2661 Arbitrary file read in github.com/grafana/grafana
  /workdirs/scan-d5719180-80b8-496e-b0d0-54987ab5cf38/go.mod
  A package you depend on has a known security hole (CVE-2019-19499). Fix: Update that package to its patched version.
• Worth fixing GO-2024-2844 Grafana User enumeration via forget password in github.com/grafana/grafana
  /workdirs/scan-d5719180-80b8-496e-b0d0-54987ab5cf38/go.mod
  A package you depend on has a known security hole (CVE-2022-39307). Fix: Update that package to its patched version.
• Worth fixing GO-2024-2847 Grafana Escalation from admin to server admin when auth proxy is used in github.com/grafana/grafana
  /workdirs/scan-d5719180-80b8-496e-b0d0-54987ab5cf38/go.mod
  A package you depend on has a known security hole (CVE-2022-35957). Fix: Update that package to its patched version.
• Worth fixing GO-2024-2848 Grafana when using email as a username can block other users from signing in in github.com/grafana/grafana
  /workdirs/scan-d5719180-80b8-496e-b0d0-54987ab5cf38/go.mod
  A package you depend on has a known security hole (CVE-2022-39229). Fix: Update that package to its patched version.
• Worth fixing GO-2024-2852 Grafana account takeover via OAuth vulnerability in github.com/grafana/grafana
  /workdirs/scan-d5719180-80b8-496e-b0d0-54987ab5cf38/go.mod
  A package you depend on has a known security hole (CVE-2022-31107). Fix: Update that package to its patched version.

via OSV-Scanner v1.9.2 · Apache-2.0

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Packages that look intentionally malicious: typosquats, sneaky install scripts.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via Guarddog v2.10.0 · Apache-2.0

error: go:timeout