https://poc.intelseclab.com/pocs/cloud/Latest proof-of-concept entries.Hugoen-usSun, 09 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/cloud/2026-08-09_cve-2026-64640-apache-polaris-cross-tenant-credential-vending/Sun, 09 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/cloud/2026-08-09_cve-2026-64640-apache-polaris-cross-tenant-credential-vending/High severity (CVSS 8.1) — cloud · CVE-2026-64640. Status: Patched. Affects: Apache Polaris (Apache Iceberg REST catalog), registerTable and registerView endpoints. Tags: apache-polaris, iceberg, apache-iceberg, credential-vending, confused-deputy, authorization-bypass, cross-tenant, s3, storage, allowed-locations, CWE-441, CWE-639, CWE-918, ssrf, server-side-read, information-disclosure, register-table, register-view.cloudHighapache-polarisicebergapache-icebergcredential-vendingconfused-deputyauthorization-bypasscross-tenants3storageallowed-locationsCWE-441CWE-639CWE-918ssrfserver-side-readinformation-disclosureregister-tableregister-viewhttps://poc.intelseclab.com/pocs/cloud/2026-07-06_cve-2025-54416-tj-actions-branch-names-command-injection/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/cloud/2026-07-06_cve-2025-54416-tj-actions-branch-names-command-injection/Critical severity (CVSS 9.1) — cloud · CVE-2025-54416. Status: PoC. Affects: tj-actions/branch-names GitHub Action. Tags: github-actions, ci-cd, command-injection, supply-chain, tj-actions, branch-names, secrets-exfiltration, shell-injection.cloudCriticalgithub-actionsci-cdcommand-injectionsupply-chaintj-actionsbranch-namessecrets-exfiltrationshell-injectionhttps://poc.intelseclab.com/pocs/cloud/2026-07-06_cve-2025-68926-rustfs-grpc-token-bypass/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/cloud/2026-07-06_cve-2025-68926-rustfs-grpc-token-bypass/Critical severity (CVSS 9.8) — cloud · CVE-2025-68926. Status: Weaponized. Affects: RustFS (Rust-based S3-compatible distributed object storage) — internal node-to-node gRPC service. Tags: rustfs, grpc, hardcoded-credentials, authentication-bypass, object-storage, s3-compatible, information-disclosure, credential-theft, data-destruction, cwe-798, cwe-306.cloudCriticalrustfsgrpchardcoded-credentialsauthentication-bypassobject-storages3-compatibleinformation-disclosurecredential-theftdata-destructioncwe-798cwe-306https://poc.intelseclab.com/pocs/cloud/2026-07-06_cve-2025-1974-ingressnightmare-nginx-admission-rce/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/cloud/2026-07-06_cve-2025-1974-ingressnightmare-nginx-admission-rce/Critical severity (CVSS 9.8) — cloud · CVE-2025-1974. Status: Weaponized. Affects: Kubernetes ingress-nginx admission controller. Tags: kubernetes, ingress-nginx, ingressnightmare, admission-controller, nginx, ssl-engine, shared-library-injection, cluster-secrets, docker, python, c, cwe-94.cloudCriticalkubernetesingress-nginxingressnightmareadmission-controllernginxssl-engineshared-library-injectioncluster-secretsdockerpythonccwe-94https://poc.intelseclab.com/pocs/cloud/2026-07-05_cve-2026-11417-aws-cdk-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/cloud/2026-07-05_cve-2026-11417-aws-cdk-rce/High severity (CVSS 3.1) — cloud · CVE-2026-11417. Status: PoC. Affects: aws-cdk-lib (npm package), NodejsFunction L2 construct. Tags: aws, cdk, supply-chain, command-injection, esbuild, nodejs, ci-cd, rce.cloudHighawscdksupply-chaincommand-injectionesbuildnodejsci-cdrcehttps://poc.intelseclab.com/pocs/cloud/2026-07-05_cve-2026-32604-spinnaker-git-clone-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/cloud/2026-07-05_cve-2026-32604-spinnaker-git-clone-rce/Critical severity (CVSS 10) — cloud · CVE-2026-32604 (CWE-78). Status: PoC. Affects: Spinnaker (Clouddriver service) — continuous delivery / multi-cloud orchestration platform. Tags: spinnaker, clouddriver, command-injection, rce, cd-pipeline, cloud-credentials, shell-injection, docker-lab.cloudCriticalspinnakerclouddrivercommand-injectionrcecd-pipelinecloud-credentialsshell-injectiondocker-labhttps://poc.intelseclab.com/pocs/cloud/2026-07-05_cve-2026-44590-sherlock-pull-request-target-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/cloud/2026-07-05_cve-2026-44590-sherlock-pull-request-target-rce/Critical severity (CVSS 9.3) — cloud · CVE-2026-44590. Status: PoC. Affects: sherlock-project/sherlock (GitHub Actions workflow validate_modified_targets.yml). Tags: github-actions, pull_request_target, command-injection, ci-cd, supply-chain, token-exfiltration, sherlock.cloudCriticalgithub-actionspull_request_targetcommand-injectionci-cdsupply-chaintoken-exfiltrationsherlockhttps://poc.intelseclab.com/pocs/cloud/2026-07-05_cve-2026-27607-rustfs-presigned-post-bypass/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/cloud/2026-07-05_cve-2026-27607-rustfs-presigned-post-bypass/High severity — cloud · CVE-2026-27607 (GHSA-w5fh-f8xh-5x3p). Status: PoC. Affects: RustFS (S3-compatible object storage server). Tags: rustfs, s3, object-storage, presigned-url, policy-bypass, aws-sdk, cloud-storage.cloudHighrustfss3object-storagepresigned-urlpolicy-bypassaws-sdkcloud-storagehttps://poc.intelseclab.com/pocs/cloud/2026-07-05_cve-2026-32096-plunk-sns-ssrf/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/cloud/2026-07-05_cve-2026-32096-plunk-sns-ssrf/Critical severity (CVSS 9.3) — cloud · CVE-2026-32096. Status: PoC. Affects: Plunk (useplunk/plunk) email/webhook API. Tags: ssrf, aws-sns, imds, cloud-metadata, plunk, cwe-918, unauthenticated.cloudCriticalssrfaws-snsimdscloud-metadataplunkcwe-918unauthenticatedhttps://poc.intelseclab.com/pocs/cloud/2026-07-05_cve-2026-34940-kubeai-ollama-command-injection/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/cloud/2026-07-05_cve-2026-34940-kubeai-ollama-command-injection/High severity (CVSS 8.7) — cloud · CVE-2026-34940. Status: PoC. Affects: KubeAI (github.com/kubeai-project/kubeai). Tags: kubernetes, kubeai, command-injection, ollama, crd, kubectl, model-serving, cwe-78.cloudHighkuberneteskubeaicommand-injectionollamacrdkubectlmodel-servingcwe-78https://poc.intelseclab.com/pocs/cloud/2026-07-05_cve-2026-41900-openlearnx-container-volume-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/cloud/2026-07-05_cve-2026-41900-openlearnx-container-volume-rce/High severity (CVSS 8.6) — cloud · CVE-2026-41900 (GHSA-8h25-q488-4hxw). Status: PoC. Affects: OpenLearnX code-execution/compiler service (Flask backend). Tags: docker, container-escape, rce, unauthenticated, code-execution-sandbox, info-disclosure, volume-mount, root.cloudHighdockercontainer-escaperceunauthenticatedcode-execution-sandboxinfo-disclosurevolume-mountroothttps://poc.intelseclab.com/pocs/cloud/2026-07-05_cve-2026-46680-k8s-runasnonroot-uid-overflow/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/cloud/2026-07-05_cve-2026-46680-k8s-runasnonroot-uid-overflow/High severity — cloud · CVE-2026-46680. Status: PoC. Affects: Kubernetes (kubelet / container runtime UID handling). Tags: kubernetes, container-escape, runasnonroot, uid-overflow, security-context-bypass, privilege-escalation.cloudHighkubernetescontainer-escaperunasnonrootuid-overflowsecurity-context-bypassprivilege-escalationhttps://poc.intelseclab.com/pocs/cloud/2026-07-05_cve-2026-4660-go-getter-terraform-pathspec-injection/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/cloud/2026-07-05_cve-2026-4660-go-getter-terraform-pathspec-injection/High severity (CVSS 7.5) — cloud · CVE-2026-4660 / HCSEC-2026-04. Status: PoC. Affects: hashicorp/go-getter (used by Terraform, Nomad, Packer, Waypoint). Tags: terraform, go-getter, git, pathspec-injection, arbitrary-file-read, ci-cd, supply-chain, iac.cloudHighterraformgo-gettergitpathspec-injectionarbitrary-file-readci-cdsupply-chainiachttps://poc.intelseclab.com/pocs/cloud/2026-07-05_cve-2026-40564-flink-k8s-operator-ssrf/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/cloud/2026-07-05_cve-2026-40564-flink-k8s-operator-ssrf/High severity — cloud · CVE-2026-40564. Status: PoC. Affects: Apache flink-kubernetes-operator. Tags: ssrf, kubernetes, flink, operator, kubernetes-operator, jarURI, cloud-metadata, crd.cloudHighssrfkubernetesflinkoperatorkubernetes-operatorjarURIcloud-metadatacrdhttps://poc.intelseclab.com/pocs/cloud/2026-07-05_cve-2026-7791-aws-workspaces-skylight-lpe/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/cloud/2026-07-05_cve-2026-7791-aws-workspaces-skylight-lpe/High severity — cloud · CVE-2026-7791. Status: PoC. Affects: Amazon WorkSpaces — Skylight Workspace Config Service. Tags: aws, amazon-workspaces, skylight, toctou, privilege-escalation, arbitrary-file-write, windows, directory-junction.cloudHighawsamazon-workspacesskylighttoctouprivilege-escalationarbitrary-file-writewindowsdirectory-junctionhttps://poc.intelseclab.com/pocs/cloud/2026-07-03_nextcloud-federated-share-bearer-token-leak/Fri, 03 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/cloud/2026-07-03_nextcloud-federated-share-bearer-token-leak/High severity — cloud · None assigned as of 2026-07-03. Status: PoC. Affects: Nextcloud Server — federated file sharing, OCM token exchange, WebDAV bearer authentication. Tags: nextcloud, federated-sharing, ocm, bearer-token, webdav, token-scope, authorization-bypass, oauth-like-flow.cloudHighnextcloudfederated-sharingocmbearer-tokenwebdavtoken-scopeauthorization-bypassoauth-like-flowhttps://poc.intelseclab.com/pocs/cloud/2026-07-03_gitea-act-runner-container-options-escape/Fri, 03 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/cloud/2026-07-03_gitea-act-runner-container-options-escape/High severity — cloud · None assigned as of 2026-07-03. Status: PoC. Affects: Gitea Actions act_runner (Docker-backed). Tags: gitea, act-runner, ci-cd, docker, container-escape, host-namespace, privilege-escalation, capabilities.cloudHighgiteaact-runnerci-cddockercontainer-escapehost-namespaceprivilege-escalationcapabilitieshttps://poc.intelseclab.com/pocs/cloud/2026-07-03_floci-apigateway-vtl-rce/Fri, 03 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/cloud/2026-07-03_floci-apigateway-vtl-rce/Critical severity — cloud · None assigned as of 2026-07-03. Status: Weaponized. Affects: Floci (AWS-compatible local cloud emulator). Tags: floci, api-gateway, velocity-template-language, rce, iam-bypass, sigv4, java-reflection, localstack-alternative.cloudCriticalflociapi-gatewayvelocity-template-languagerceiam-bypasssigv4java-reflectionlocalstack-alternativehttps://poc.intelseclab.com/pocs/cloud/2026-07-03_docker-cp-copyout-destination-escape/Fri, 03 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/cloud/2026-07-03_docker-cp-copyout-destination-escape/Medium severity — cloud · None assigned as of 2026-07-03. Status: PoC. Affects: Docker Engine / CLI. Tags: docker, container-escape, toctou, symlink-race, docker-cp, path-traversal, archive-extraction, host-file-write.cloudMediumdockercontainer-escapetoctousymlink-racedocker-cppath-traversalarchive-extractionhost-file-writehttps://poc.intelseclab.com/pocs/cloud/2026-05-17_ingressnightmare-k8s-ingress-nginx-rce/Sun, 17 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/cloud/2026-05-17_ingressnightmare-k8s-ingress-nginx-rce/Critical severity (CVSS 9.8) — cloud · CVE-2025-1974 (primary); also CVE-2025-1097, CVE-2025-1098, CVE-2025-24514. Status: Weaponized. Affects: Kubernetes Ingress-NGINX Controller (ingress-nginx). Tags: RCE, Kubernetes, ingress-nginx, admission-controller, unauthenticated, nginx-config-injection, cluster-takeover, k8s, shared-object, reverse-shell.cloudCriticalRCEKubernetesingress-nginxadmission-controllerunauthenticatednginx-config-injectioncluster-takeoverk8sshared-objectreverse-shellhttps://poc.intelseclab.com/pocs/cloud/2026-05-17_azure-networking-privilege-escalation/Sun, 17 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/cloud/2026-05-17_azure-networking-privilege-escalation/Critical severity (CVSS 10) — cloud · CVE-2025-54914. Status: Researched. Affects: Microsoft Azure Networking service (GetRouteTable API). Tags: privilege-escalation, Azure, cloud, lateral-movement, API, routing, networking, no-user-interaction.cloudCriticalprivilege-escalationAzurecloudlateral-movementAPIroutingnetworkingno-user-interaction