ckotzbauer vulnerability-operator: Missing authentication exposes vulnerability reports

Summary

The vulnerability-operator serves its JSON vulnerability scan reports over its HTTP port (default 8080) through an unauthenticated file server on the /report/ endpoint, with directory listing enabled. Any client that can reach this port can list and download reports that disclose CVE IDs, affected package names and versions, and container image identifiers for all scanned workloads in the cluster. The attack requires network access to the port but no credentials or user interaction, and it does not allow code execution or changes.

Affected

• ckotzbauer vulnerability-operator versions before 0.28.16
• Lower bound of affected versions: Unknown.

Fixed in

• Upgrade to version 0.28.16 or later. The release notes reference 0.28.18 as a newer release; use the latest version.

Workaround

• Restrict network access to the operator's HTTP port (default 8080) with a NetworkPolicy so that only the monitoring stack or administrators can reach it.
• Do not expose the operator's Service or Ingress outside the cluster.
• Note: /metrics carries the same data and must also be protected at the network layer.

Exploitation

• No public exploit code known.
• No evidence of exploitation in the wild known.
• Not listed in CISA KEV (as of the research date, not verified against the primary source).

Our recommendation

• Upgrade vulnerability-operator to the latest version (at least 0.28.16).
• Set the report-auth-token (VULN_REPORT_AUTH_TOKEN) from a secret, and verify on a test instance that report.json is not reachable without credentials after the upgrade.
• Apply a NetworkPolicy that limits access to port 8080 and protect /metrics the same way.
• Check whether the operator's port is reachable from outside the cluster and close any such exposure immediately.
• Monitor access logs of the operator for unexpected requests to /report/ and /metrics.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• GitHub Security Advisory GHSA-6v6c-4cxg-cc93 github.com
• Fix commit b083ab01: restrict /report/ endpoint access github.com
• GitHub Release 0.28.16 github.com
• GitHub Release 0.28.18 github.com
• Vulnerability-operator README github.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 19:33.