cloud PoCs
subscribe (RSS)Proof-of-concept research filed under the cloud category.
Entries
21
in cloud
CISA KEV
0
exploited in the wild
Ransomware
0
known campaign use
Unpatched
7
no vendor fix
Critical
9
43% of listed
Severity
Exploitation signals
Patch status
Date range
21 result(s)
- CVE-2026-64640 cloud HIGH 8.1
Apache Polaris — Cross-Tenant Credential Vending Before Location Validation in Iceberg REST Register (CVE-2026-64640)
CVE-2026-64640 is a confused-deputy vulnerability in Apache Polaris: the Iceberg REST register endpoints mint cloud storage credentials for a caller-supplied path and read that path server-side before checking it against the catalog's allowedLocations. A…
Patched 2026-08-09 - CVE-2025-54416 cloud CRITICAL 9.1
tj-actions/branch-names GitHub Actions Command Injection (CVE-2025-54416)
CVE-2025-54416 is a command injection vulnerability in tj-actions/branch-names, a popular GitHub Action used to extract branch/tag names into workflow outputs, affecting over 5,000 public repositories. The root cause is the action's internal use of eval…
Patched 2026-07-06 - CVE-2025-68926 cloud CRITICAL 9.8 EPSS 29%
RustFS Hardcoded gRPC Authentication Token Leading to Full Node Compromise (CVE-2025-68926)
RustFS's internal cluster/node gRPC service (nodeservice.NodeService) authenticates peer-to-peer RPC calls using a fixed, hardcoded bearer token — the literal string "rustfs rpc" — which is compiled into every RustFS build and cannot be rotated or configured…
Patched 2026-07-06 - CVE-2025-1974 cloud CRITICAL 9.8 EPSS 100%
IngressNightmare: Kubernetes ingress-nginx Admission Controller Shared-Library Injection RCE (CVE-2025-1974)
The ingress-nginx admission controller validates incoming Ingress objects by rendering a temporary NGINX configuration and running nginx -t against it — but the validation webhook itself has no authentication and accepts attacker-controlled configuration…
Unverified 2026-07-06 - CVE-2026-11417 cloud HIGH 3.1
Supply Chain Command Injection in AWS CDK's NodejsFunction — CVE-2026-11417
The AWS CDK NodejsFunction construct bundles Lambda handlers with esbuild during cdk synth, and prior to 2.245.0 it built the esbuild invocation by directly interpolating several user/construct-controlled properties (externalModules, loader, define, inject,…
Patched 2026-07-05 - CVE-2026-32604 cloud CRITICAL 10
Spinnaker Clouddriver — Git Clone Shell Injection RCE (CVE-2026-32604)
Spinnaker's Clouddriver service exposes an artifact-fetch endpoint (PUT /artifacts/fetch) that, when configured for HTTP-based git authentication, passes a user-supplied branch name unsanitized into a sh -c shell command. Because Clouddriver is the Spinnaker…
Patched 2026-07-05 - CVE-2026-44590 cloud CRITICAL 9.3
Sherlock CI `pull_request_target` Command Injection → GitHub Actions Secret Exfiltration (CVE-2026-44590)
The validatemodifiedtargets.yml GitHub Actions workflow in sherlock-project/sherlock uses the dangerous pullrequesttarget trigger and processes attacker-controlled pull request data (a JSON entry key) in a shell context without sanitization, resulting in…
Patched 2026-07-05 - CVE-2026-27607 cloud HIGH
RustFS — Presigned POST Policy Condition Bypass (CVE-2026-27607)
RustFS is an S3-compatible object storage server. This PoC demonstrates that RustFS fails to properly enforce the conditions embedded in S3 presigned POST policies. Presigned POST is normally used by applications to let clients upload directly to storage…
Patched 2026-07-05 - CVE-2026-32096 cloud CRITICAL 9.3
Plunk SSRF via Unvalidated AWS SNS SubscriptionConfirmation — CVE-2026-32096
Plunk's POST /webhooks/sns endpoint is meant to handle AWS SNS subscription confirmation callbacks, but it fetches the attacker-supplied SubscribeURL field directly via fetch() without ever verifying the AWS SNS message signature. Because the endpoint…
Patched 2026-07-05 - CVE-2026-34940 cloud HIGH 8.7
OS Command Injection in KubeAI via Model URL (CVE-2026-34940)
KubeAI constructs a Kubernetes startup probe shell script by interpolating Model CRD URL components (ref, modelParam) into a bash -c command via Go's fmt.Sprintf. Shell metacharacters in these fields are not sanitized, so any user holding only Model CRD…
Patched 2026-07-05 - CVE-2026-41900 cloud HIGH 8.6
OpenLearnX Unauthenticated RCE via Container Volume Mount (CVE-2026-41900)
OpenLearnX's /api/compiler/execute endpoint runs untrusted user-submitted code inside a sibling Docker container, but the blueprint carries no authentication decorator, so any unauthenticated request can trigger it. The pre-patch executeincontainer() function…
Patched 2026-07-05 - CVE-2026-46680 cloud HIGH
Kubernetes `runAsNonRoot` Bypass via UID Integer Overflow (CVE-2026-46680)
Kubernetes' securityContext.runAsNonRoot: true admission check is meant to prevent Pods from running as UID 0 (root). This PoC demonstrates that a crafted container image with a numeric UID value that overflows the integer type used internally by the…
Patched 2026-07-05 - CVE-2026-4660 / HCSEC-2026-04 cloud HIGH 7.5
HashiCorp go-getter Git Pathspec Arbitrary File Read (CVE-2026-4660)
go-getter resolves Terraform/Nomad/Packer/Waypoint module sources with ref query parameters passed straight through to git checkout. An attacker can publish a module whose ref is set to a git option such as --pathspec-from-file=/path/to/file instead of a real…
Patched 2026-07-05 - CVE-2026-40564 cloud HIGH
Apache Flink Kubernetes Operator SSRF via jarURI (CVE-2026-40564)
The Apache Flink Kubernetes Operator reconciles FlinkSessionJob (and FlinkDeployment) custom resources by fetching the JAR referenced in spec.job.jarURI from inside its own pod, without validating the URI's scheme, host, or resolved IP address. Any user…
Patched 2026-07-05 - CVE-2026-7791 cloud HIGH
Amazon WorkSpaces Skylight Workspace Config Service Local Privilege Escalation (CVE-2026-7791)
The Skylight Workspace Config Service on Amazon WorkSpaces runs as SYSTEM and performs scheduled log rotation under C:\ProgramData\Amazon. Permissive ACLs on this directory, a ROTATE directory junction, absence of file-type checks, and a ~1-10 ms TOCTOU…
Unverified 2026-07-05 - None assigned as of 2026-07-03 cloud HIGH
Nextcloud Federated Share OCM Bearer Token Scope Escalation to Sender WebDAV Access
When a Nextcloud user creates a normal federated file share, the sender instance generates a permanent authentication token that is also stored as the federated share's secret; that token is created without an explicit narrow scope, so it defaults to full…
Unverified 2026-07-03 - None assigned as of 2026-07-03 cloud HIGH
Gitea act_runner container.options Host Namespace Escape
Gitea's actrunner allows workflow YAML to append Docker options via jobs.<job>.container.options. When the runner configuration disables privileged mode, actrunner forces Privileged back to false and sanitizes bind mounts, but it preserves every other Docker…
Unverified 2026-07-03 - None assigned as of 2026-07-03 cloud CRITICAL
Floci API Gateway VTL RCE + IAM Scope Bypass
Floci evaluates user-controlled API Gateway integration response templates with an unrestricted Apache Velocity engine that exposes $util, allowing template code to reach java.lang.ProcessBuilder via reflection and execute arbitrary OS commands in the Floci…
Unverified 2026-07-03 - None assigned as of 2026-07-03 cloud MEDIUM
Docker cp Copy-Out Destination Escape via Symlink Race
docker cp copy-out operations are vulnerable to a time-of-check/time-of-use race: the daemon walks the container's source path with filepath.WalkDir and builds a tar stream, but if a container process changes a directory entry (e.g., swaps it for a symlink)…
Unverified 2026-07-03 - CVE-2025-1974 cloud CRITICAL 9.8 EPSS 100%
IngressNightmare - Kubernetes Ingress-NGINX Unauthenticated RCE
IngressNightmare is a chain of critical vulnerabilities (CVE-2025-1097, CVE-2025-1098, CVE-2025-24514, CVE-2025-1974) in the Kubernetes Ingress-NGINX admission controller. Discovered by Wiz Research, the vulnerabilities allow an unauthenticated attacker…
Unverified 2026-05-17 - CVE-2025-54914 cloud CRITICAL 10
Azure Networking Privilege Escalation via Missing Privilege Check
CVE-2025-54914 is a critical privilege escalation vulnerability (CVSS 10.0) in Microsoft Azure Networking. Discovered by Mark Mallia and disclosed on September 4, 2025, the flaw arises from a missing authorization check in the GetRouteTable API code path. A…
Patched 2026-05-17