https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 15 Nov 2026 07:28:05 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-115539 <p>SwarmKit&#39;s Cluster-API proxy can overwrite a forwarded client&#39;s TLS identity with an intermediary manager&#39;s identity. WithMetadataForwardTLSInfo replaces outgoing metadata with a copy of the incoming metadata, discarding the redirect guard&#39;s changes when built with grpc-go 1.39 or later. During a short window after a leader change, two proxy hops through managers with inconsistent views of the leader can allow an attacker possessing a valid worker node TLS certificate and private key to obtain a manager node certificate for the attacker&#39;s own key, escalating privileges from worker to manager. Applications built with an affected SwarmKit version and grpc-go 1.39 or later are impacted.</p> <p>SwarmKit&#39;s Cluster-API proxy can overwrite a forwarded client&#39;s TLS identity with an intermediary manager&#39;s identity. WithMetadataForwardTLSInfo replaces outgoing metadata with a copy of the incoming metadata, discarding the redirect guard&#39;s changes when built with grpc-go 1.39 or later. During a short window after a leader change, two proxy hops through managers with inconsistent views of the leader can allow an attacker possessing a valid worker node TLS certificate and private key to obtain a manager node certificate for the attacker&#39;s own key, escalating privileges from worker to manager. Applications built with an affected SwarmKit version and grpc-go 1.39 or later are impacted.</p> https://db.gcve.eu/vuln/fkie_cve-2026-115539 https://db.gcve.eu/vuln/msrc_cve-2026-115539 msrc_CVE-2026-115539 https://db.gcve.eu/vuln/msrc_cve-2026-115539 https://db.gcve.eu/vuln/ubuntu-cve-2026-115539 <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: docker.io, Ubuntu:Pro:18.04:LTS: docker.io, Ubuntu:Pro:20.04:LTS: docker.io, Ubuntu:Pro:20.04:LTS: docker.io-app, Ubuntu:Pro:22.04:LTS: docker.io, Ubuntu:Pro:22.04:LTS: docker.io-app, Ubuntu:Pro:24.04:LTS: docker.io, Ubuntu:Pro:24.04:LTS: docker.io-app, Ubuntu:26.10: docker.io, Ubuntu:26.10: docker.io-app and 2 more</p> <p>SwarmKit&#39;s Cluster-API proxy can overwrite a forwarded client&#39;s TLS identity with an intermediary manager&#39;s identity. WithMetadataForwardTLSInfo replaces outgoing metadata with a copy of the incoming metadata, discarding the redirect guard&#39;s changes when built with grpc-go 1.39 or later. During a short window after a leader change, two proxy hops through managers with inconsistent views of the leader can allow an attacker possessing a valid worker node TLS certificate and private key to obtain a manager node certificate for the attacker&#39;s own key, escalating privileges from worker to manager. Applications built with an affected SwarmKit version and grpc-go 1.39 or later are impacted.</p> <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: docker.io, Ubuntu:Pro:18.04:LTS: docker.io, Ubuntu:Pro:20.04:LTS: docker.io, Ubuntu:Pro:20.04:LTS: docker.io-app, Ubuntu:Pro:22.04:LTS: docker.io, Ubuntu:Pro:22.04:LTS: docker.io-app, Ubuntu:Pro:24.04:LTS: docker.io, Ubuntu:Pro:24.04:LTS: docker.io-app, Ubuntu:26.10: docker.io, Ubuntu:26.10: docker.io-app and 2 more</p> <p>SwarmKit&#39;s Cluster-API proxy can overwrite a forwarded client&#39;s TLS identity with an intermediary manager&#39;s identity. WithMetadataForwardTLSInfo replaces outgoing metadata with a copy of the incoming metadata, discarding the redirect guard&#39;s changes when built with grpc-go 1.39 or later. During a short window after a leader change, two proxy hops through managers with inconsistent views of the leader can allow an attacker possessing a valid worker node TLS certificate and private key to obtain a manager node certificate for the attacker&#39;s own key, escalating privileges from worker to manager. Applications built with an affected SwarmKit version and grpc-go 1.39 or later are impacted.</p> https://db.gcve.eu/vuln/ubuntu-cve-2026-115539