CVE-2026-64858

Name of the Vulnerable Software and Affected Versions vulnerability-operator versions prior to 0.28.16

Description An unauthenticated information disclosure issue exists where the operator exposes all vulnerability scan reports. The '/report/' HTTP endpoint utilizes a raw http.FileServer over the reports directory (default /reports) without authentication, authorization, or middleware. This allows any client with access to the operator's HTTP port (default 8080) to list and download JSON vulnerability reports, revealing affected package names, versions, and container image identifiers for all scanned workloads in the cluster.

Recommendations Update to version 0.28.16.