{"vulnerability": "CVE-2026-4117", "sightings": [{"uuid": "36e3abfc-50bf-4255-ba9c-5f2c8b382083", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-41177", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/81660", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #SSRF\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-41177-Squidex-CMS\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a TurkiOS\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a None\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-04-25 20:57:18\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-41177, a Blind SSRF vulnerability in Squidex CMS (prior to v7.23.0). Includes root cause analysis, reproduction steps, and impact assessment regarding Local File Interaction (LFI).\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-04-25T21:02:32.000000Z"}, {"uuid": "ce55c471-a750-4caf-bbcb-e50fad15d240", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-41179", "type": "confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-41179.yaml", "content": "", "creation_timestamp": "2026-04-23T05:42:47.000000Z"}, {"uuid": "a11e1640-a54b-4569-8839-9676ced13bf7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-41176", "type": "confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-41176.yaml", "content": "", "creation_timestamp": "2026-04-23T05:45:19.000000Z"}, {"uuid": "d28afefd-783e-453e-be33-87cf25735664", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-41176", "type": "seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3mk6vwtcoov2g", "content": "", "creation_timestamp": "2026-04-23T21:03:08.280440Z"}, {"uuid": "1259b3a4-a55d-4b59-bde4-0e1d51867d11", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-41179", "type": "seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3mk6vwtfckr2b", "content": "", "creation_timestamp": "2026-04-23T21:03:08.984649Z"}, {"uuid": "ba44e0ec-6181-4a0e-9264-25e2b1b09c1f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-4117", "type": "seen", "source": "https://bsky.app/profile/atomicedge.bsky.social/post/3mk76czqxax2s", "content": "", "creation_timestamp": "2026-04-23T23:33:06.772874Z"}, {"uuid": "005fa87c-627d-41e4-966c-ee77e42b239d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-41174", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mkanez5th22k", "content": "", "creation_timestamp": "2026-04-24T13:35:19.424459Z"}, {"uuid": "d09987aa-c172-40b0-9bf4-90920c2fdabd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-41176", "type": "seen", "source": "https://ccb.belgium.be/advisories/warning-two-critical-unauthenticated-code-execution-vulnerabilities-rclone-patch", "content": "", "creation_timestamp": "2026-04-24T07:49:34.000000Z"}, {"uuid": "eee7a052-6035-426f-b850-15e115315819", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-41179", "type": "seen", "source": "https://ccb.belgium.be/advisories/warning-two-critical-unauthenticated-code-execution-vulnerabilities-rclone-patch", "content": "", "creation_timestamp": "2026-04-24T07:49:34.000000Z"}, {"uuid": "284ab354-7e26-461a-b847-891327a30d48", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-41176", "type": "seen", "source": "https://www.acn.gov.it/portale/w/rclone-disponibili-poc-per-lo-sfruttamento-delle-cve-2026-41176-e-cve-2026-41179", "content": "", "creation_timestamp": "2026-04-27T10:08:24.000000Z"}, {"uuid": "fcbf104a-795c-4ffd-a190-7d0834732c61", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-41179", "type": "seen", "source": "https://www.acn.gov.it/portale/w/rclone-disponibili-poc-per-lo-sfruttamento-delle-cve-2026-41176-e-cve-2026-41179", "content": "", "creation_timestamp": "2026-04-27T10:08:24.000000Z"}, {"uuid": "66f42aa9-0bcd-4e50-89cc-775fe839771e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-41175", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mkjkhrl3ec2p", "content": "", "creation_timestamp": "2026-04-28T02:37:08.325844Z"}, {"uuid": "b02b48e1-6480-404b-ba1d-a51c9db3435e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-41176", "type": "seen", "source": "Telegram/Y5Qz_cKDCmo7jQNGBLdJ87dzQSi2eRz7Wqhm7Qv2MeY_FXM", "content": "", "creation_timestamp": "2026-04-24T15:21:22.000000Z"}, {"uuid": "4937677b-805e-4139-87c0-62fa1e419a57", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-41179", "type": "seen", "source": "Telegram/Y5Qz_cKDCmo7jQNGBLdJ87dzQSi2eRz7Wqhm7Qv2MeY_FXM", "content": "", "creation_timestamp": "2026-04-24T15:21:22.000000Z"}, {"uuid": "71a3dada-c1c3-4416-afd6-799e199f7933", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-41177", "type": "published-proof-of-concept", "source": "Telegram/LSdGKxP2miqFlHNpxxgJAVXofgySUEN1UvPjtEQ3z8Pk2CQ", "content": "", "creation_timestamp": "2026-04-25T23:00:15.000000Z"}, {"uuid": "941d0a84-15e2-42af-b497-6350dcfdf8cd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-41177", "type": "published-proof-of-concept", "source": "Telegram/kld9yLBbS6fzFNytGTSDXwsTRi8Qoep-LDw8M-oA9J472Qs", "content": "", "creation_timestamp": "2026-04-26T03:00:05.000000Z"}, {"uuid": "8cd10608-aa57-4de9-ad9c-3bb7658daf3a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-41170", "type": "seen", "source": "Telegram/bXcnMEVg4MqmghIUy-Ivhp7SDQD9oC-u5oUbMXpQMRT1SlU", "content": "", "creation_timestamp": "2026-04-22T23:20:48.000000Z"}, {"uuid": "8b0ac245-d120-4063-b90b-2882aed66c03", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-41171", "type": "seen", "source": "Telegram/bXcnMEVg4MqmghIUy-Ivhp7SDQD9oC-u5oUbMXpQMRT1SlU", "content": "", "creation_timestamp": "2026-04-22T23:20:48.000000Z"}, {"uuid": "0c4af094-6027-472e-ab63-6df219b74dcf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-41172", "type": "seen", "source": "Telegram/bXcnMEVg4MqmghIUy-Ivhp7SDQD9oC-u5oUbMXpQMRT1SlU", "content": "", "creation_timestamp": "2026-04-22T23:20:48.000000Z"}, {"uuid": "ec6bdadb-d8d6-4504-a7c8-50f560a73232", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-41175", "type": "seen", "source": "Telegram/oyZMMan-s6Tiqp0E7GyRtqQJ5Rv8-WlZqCZQGxoSrT1vjc4", "content": "", "creation_timestamp": "2026-04-22T23:21:08.000000Z"}, {"uuid": "50563070-2059-4cb4-a463-133ad23d3a94", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-41174", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mkqragm5z42k", "content": "CVE-2026-41174 - Traefik Kubernetes CRD allows unauthorized cross-namespace middleware binding\nCVE ID : CVE-2026-41174\n \n Published : April 30, 2026, 9:16 p.m. | 1\u00a0hour, 2\u00a0minutes ago\n \n Description : Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.4...", "creation_timestamp": "2026-04-30T23:26:56.201861Z"}, {"uuid": "b1e8b5f0-20f0-49b8-9db5-0e2f9d77c6f0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-41179", "type": "published-proof-of-concept", "source": "https://api.github.com/repos/rclone/rclone/security-advisories/GHSA-jfwf-28xr-xw6q", "content": "", "creation_timestamp": "2026-04-19T12:17:45.000000Z"}, {"uuid": "3d86e313-c219-4a49-ab27-e4fa263650cf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-41179", "type": "published-proof-of-concept", "source": "https://github.com/rclone/rclone/security/advisories/GHSA-jfwf-28xr-xw6q", "content": "", "creation_timestamp": "2026-04-19T12:17:45.000000Z"}, {"uuid": "0158f1ae-8539-4c96-947c-af6cad9d80b0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-41178", "type": "published-proof-of-concept", "source": "https://github.com/advisories/GHSA-5wrp-cwcj-q835", "content": "", "creation_timestamp": "2026-05-28T17:04:19.000000Z"}, {"uuid": "155e3abb-24dc-4036-b242-232a60d08361", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-41176", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-06-03)", "content": "", "creation_timestamp": "2026-06-03T00:00:00.000000Z"}, {"uuid": "6a6d80c4-024a-4655-bf54-11b89528d5a6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-41176", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-06-04)", "content": "", "creation_timestamp": "2026-06-04T00:00:00.000000Z"}, {"uuid": "5764ea21-d5b4-4b8d-9a6d-47333927dd35", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-41178", "type": "seen", "source": "https://gist.github.com/cwayne18/5a965b20d5d77b66faec2e6e18802a48", "content": "cwayne@geeko ~ % vexscan --image docker.io/rancher/helm-controller:v0.17.7 --all --vexhub https://github.com/rancher/vexhub --severity CRITICAL,HIGH,MEDIUM,LOW,UNKNOWN --llm --llm-command \"gh copilot\" --mine-advisories --triage --details\nLLM overlay: asking command gh\nExtracting docker.io/rancher/helm-controller:v0.17.7 (linux/amd64)...\nScanning for Go binaries...\nFound 1 Go binaries.\nResolving advisories for 73 components (73 OSV queries)...\nFound 16 OS packages to check (Alpine:v3.24).\nResolving advisories for 10 components (14 OSV queries)...\nBuilding the shared-library closure...\n  18 ELF objects\n  8 of 18 reachable from 6 roots\nVEX hub https://github.com/rancher/vexhub: 1090 products indexed\nVEX hub https://github.com/rancher/vexhub: 2 finding(s) already covered by a published statement\nTriaging 5 findings against EPSS and CISA KEV (5 CVE ids)\nvexscan report (image) for docker.io/rancher/helm-controller:v0.17.7\n\n  golang   Go                         73 components     5 findings\n  os       Alpine:v3.24               16 components     0 findings\n  affected by severity: 3 unknown\n  3 affected: 1 fixable, 2 with no fix yet\n  already vexed: 1 by Rancher Security team\n  priority: none in CISA's known-exploited catalog, 0 at or above the 90th EPSS percentile, 3 scored\n  priority data: EPSS 2026-08-05, KEV catalog 2026.08.05\n\nAFFECTED (3) - vulnerable code is present and can be loaded\nSEVERITY  ADVISORY      PACKAGE            VERSION  FIXED IN  EPSS   BASIS\nUNKNOWN   GO-2025-3521  k8s.io/kubernetes  v1.35.1  no fix    41.1%\nUNKNOWN   GO-2026-5970  golang.org/x/text  v0.37.0  0.39.0    36.6%\nUNKNOWN   GO-2025-3547  k8s.io/kubernetes  v1.35.1  no fix    22.3%\n\n[LINKED]               k8s.io/kubernetes@v1.35.1\n  cve:      GO-2025-3521\n  from:     golang\n  epss:     41.1% percentile (epss 0.00516) for CVE-2025-1767\n  purl:     pkg:golang/k8s.io%2Fkubernetes@v1.35.1\n  binary:   /usr/bin/helm-controller (stripped)\n  packages: k8s.io/kubernetes (module)\n  detail:   linked\n  llm:      exploitable=unlikely confidence=medium\n            helm-controller merely vendors k8s.io/kubernetes as a library dependency and static analysis shows only linkage, not call-graph reachability; such binaries typically use small subsets (client/apimachinery types) rather than the vulnerable server-side code paths, and GO-2025-3521 class kube vulnerabilities generally require running as an apiserver/kubelet component to be triggered by attacker input.\n\n[LINKED]               golang.org/x/text@v0.37.0\n  cve:      GO-2026-5970\n  from:     golang\n  fixed in: 0.39.0\n  epss:     36.6% percentile (epss 0.00446) for CVE-2026-56852\n  purl:     pkg:golang/golang.org%2Fx%2Ftext@v0.37.0\n  binary:   /usr/bin/helm-controller (stripped)\n  packages: golang.org/x/text/unicode/norm (package)\n  detail:   linked\n  llm:      exploitable=unlikely confidence=medium\n            golang.org/x/text/unicode/norm is a transitive dependency typically pulled in for string normalization; helm-controller is a Kubernetes reconciliation controller unlikely to run Unicode normalization on attacker-controlled input paths, and static linkage alone doesn't establish reachability from network-facing code.\n\n[LINKED]               k8s.io/kubernetes@v1.35.1\n  cve:      GO-2025-3547\n  from:     golang\n  epss:     22.3% percentile (epss 0.00301) for CVE-2024-7598\n  purl:     pkg:golang/k8s.io%2Fkubernetes@v1.35.1\n  binary:   /usr/bin/helm-controller (stripped)\n  packages: k8s.io/kubernetes (module)\n  detail:   linked\n  llm:      exploitable=unlikely confidence=low\n            k8s.io/kubernetes is a large module often pulled in only for API types/client libraries rather than actual server logic, and static analysis shows only linkage (not reachability) in a helm-controller binary, which typically doesn't run the vulnerable kube-apiserver/kubelet code paths; without confirmed call-path reachability or attacker-controlled input to the vulnerable function, real-world exploitability is low.\n\n\nALREADY VEXED (1) - a published statement answers these; vexscan's own verdict is unchanged\nSEVERITY  ADVISORY      PACKAGE           VERSION  FIXED IN  EPSS   VEX STATUS    JUSTIFICATION\nUNKNOWN   GO-2026-5942  golang.org/x/net  v0.55.0  0.56.0    26.4%  not_affected  vulnerable_code_not_present\n\n[LINKED]               golang.org/x/net@v0.55.0\n  cve:      GO-2026-5942\n  from:     golang\n  fixed in: 0.56.0\n  epss:     26.4% percentile (epss 0.00339) for CVE-2026-46600\n  purl:     pkg:golang/golang.org%2Fx%2Fnet@v0.55.0\n  binary:   /usr/bin/helm-controller (stripped)\n  packages: golang.org/x/net/dns/dnsmessage (package)\n  detail:   linked\n  evidence: [vendor-vex] Rancher Security team published not_affected for pkg:golang/github.com/k3s-io/helm-controller (vulnerable_code_not_present);\nstatement names pkg:golang/golang.org/x/net@v0.47.0; component is pkg:golang/golang.org%2Fx%2Fnet@v0.55.0\n  vendor:   Rancher Security team says not_affected (vulnerable_code_not_present)\n            Govulncheck determined that the vulnerable code isn't called\n            product pkg:golang/github.com/k3s-io/helm-controller, published 2026-07-22T03:28:02Z\n            matched loosely: statement names pkg:golang/golang.org/x/net@v0.47.0; component is pkg:golang/golang.org%2Fx%2Fnet@v0.55.0\n  llm:      exploitable=unlikely confidence=medium\n            helm-controller links golang.org/x/net/dns/dnsmessage transitively (e.g. via net/http or Kubernetes client libraries) but does not itself\nperform custom DNS message parsing of attacker-controlled data; typical Go DNS resolution paths rarely trigger the vulnerable code path with untrusted\n input.\n\n\nRULED OUT (1) - the vulnerable code is not present or cannot run\nSEVERITY  ADVISORY      PACKAGE                   VERSION  FIXED IN  EPSS   BASIS\nUNKNOWN   GO-2026-5158  go.opentelemetry.io/otel  v1.41.0  1.44.0    14.7%  pclntab\n\n[NOT PRESENT]          go.opentelemetry.io/otel@v1.41.0\n  cve:      GO-2026-5158\n  from:     golang\n  fixed in: 1.44.0\n  epss:     14.7% percentile (epss 0.00237) for CVE-2026-41178\n  purl:     pkg:golang/go.opentelemetry.io%2Fotel@v1.41.0\n  binary:   /usr/bin/helm-controller (stripped)\n  packages: go.opentelemetry.io/otel/baggage, go.opentelemetry.io/otel/propagation (package)\n  vex:      vulnerable_code_not_present [pclntab]\n  evidence: [vendor-vex] Rancher Security team published not_affected for pkg:golang/github.com/k3s-io/helm-controller (vulnerable_code_not_present);\nstatement names pkg:golang/go.opentelemetry.io/otel@v1.41.0; component is pkg:golang/go.opentelemetry.io%2Fotel@v1.41.0\n  vendor:   Rancher Security team says not_affected (vulnerable_code_not_present)\n            Govulncheck determined that the vulnerable code isn't called\n            product pkg:golang/github.com/k3s-io/helm-controller, published 2026-07-25T03:31:58Z\n            matched loosely: statement names pkg:golang/go.opentelemetry.io/otel@v1.41.0; component is pkg:golang/go.opentelemetry.io%2Fotel@v1.41.0\n\n\n  golang   Go                         73 components     5 findings\n  os       Alpine:v3.24               16 components     0 findings\n  affected by severity: 3 unknown\n  3 affected: 1 fixable, 2 with no fix yet\n  already vexed: 1 by Rancher Security team\n  priority: none in CISA's known-exploited catalog, 0 at or above the 90th EPSS percentile, 3 scored\n  priority data: EPSS 2026-08-05, KEV catalog 2026.08.05\n  5 findings in 3 section(s): AFFECTED (3), ALREADY VEXED (1), RULED OUT (1)", "creation_timestamp": "2026-08-05T22:37:18.396564Z"}, {"uuid": "d47452e3-ed3e-4d1f-9f3b-3e1117b7893c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-41178", "type": "seen", "source": "https://gist.github.com/cwayne18/5a965b20d5d77b66faec2e6e18802a48", "content": "cwayne@geeko ~ % vexscan --image docker.io/rancher/helm-controller:v0.17.7 --all --vexhub https://github.com/rancher/vexhub --severity CRITICAL,HIGH,MEDIUM,LOW,UNKNOWN --llm --llm-command \"gh copilot\" --mine-advisories --triage --details\nLLM overlay: asking command gh\nExtracting docker.io/rancher/helm-controller:v0.17.7 (linux/amd64)...\nScanning for Go binaries...\nFound 1 Go binaries.\nResolving advisories for 73 components (73 OSV queries)...\nFound 16 OS packages to check (Alpine:v3.24).\nResolving advisories for 10 components (14 OSV queries)...\nBuilding the shared-library closure...\n  18 ELF objects\n  8 of 18 reachable from 6 roots\nVEX hub https://github.com/rancher/vexhub: 1090 products indexed\nVEX hub https://github.com/rancher/vexhub: 2 finding(s) already covered by a published statement\nTriaging 5 findings against EPSS and CISA KEV (5 CVE ids)\nvexscan report (image) for docker.io/rancher/helm-controller:v0.17.7\n\n  golang   Go                         73 components     5 findings\n  os       Alpine:v3.24               16 components     0 findings\n  affected by severity: 3 unknown\n  3 affected: 1 fixable, 2 with no fix yet\n  already vexed: 1 by Rancher Security team\n  priority: none in CISA's known-exploited catalog, 0 at or above the 90th EPSS percentile, 3 scored\n  priority data: EPSS 2026-08-05, KEV catalog 2026.08.05\n\nAFFECTED (3) - vulnerable code is present and can be loaded\nSEVERITY  ADVISORY      PACKAGE            VERSION  FIXED IN  EPSS   BASIS\nUNKNOWN   GO-2025-3521  k8s.io/kubernetes  v1.35.1  no fix    41.1%\nUNKNOWN   GO-2026-5970  golang.org/x/text  v0.37.0  0.39.0    36.6%\nUNKNOWN   GO-2025-3547  k8s.io/kubernetes  v1.35.1  no fix    22.3%\n\n[LINKED]               k8s.io/kubernetes@v1.35.1\n  cve:      GO-2025-3521\n  from:     golang\n  epss:     41.1% percentile (epss 0.00516) for CVE-2025-1767\n  purl:     pkg:golang/k8s.io%2Fkubernetes@v1.35.1\n  binary:   /usr/bin/helm-controller (stripped)\n  packages: k8s.io/kubernetes (module)\n  detail:   linked\n  llm:      exploitable=unlikely confidence=medium\n            helm-controller merely vendors k8s.io/kubernetes as a library dependency and static analysis shows only linkage, not call-graph reachability; such binaries typically use small subsets (client/apimachinery types) rather than the vulnerable server-side code paths, and GO-2025-3521 class kube vulnerabilities generally require running as an apiserver/kubelet component to be triggered by attacker input.\n\n[LINKED]               golang.org/x/text@v0.37.0\n  cve:      GO-2026-5970\n  from:     golang\n  fixed in: 0.39.0\n  epss:     36.6% percentile (epss 0.00446) for CVE-2026-56852\n  purl:     pkg:golang/golang.org%2Fx%2Ftext@v0.37.0\n  binary:   /usr/bin/helm-controller (stripped)\n  packages: golang.org/x/text/unicode/norm (package)\n  detail:   linked\n  llm:      exploitable=unlikely confidence=medium\n            golang.org/x/text/unicode/norm is a transitive dependency typically pulled in for string normalization; helm-controller is a Kubernetes reconciliation controller unlikely to run Unicode normalization on attacker-controlled input paths, and static linkage alone doesn't establish reachability from network-facing code.\n\n[LINKED]               k8s.io/kubernetes@v1.35.1\n  cve:      GO-2025-3547\n  from:     golang\n  epss:     22.3% percentile (epss 0.00301) for CVE-2024-7598\n  purl:     pkg:golang/k8s.io%2Fkubernetes@v1.35.1\n  binary:   /usr/bin/helm-controller (stripped)\n  packages: k8s.io/kubernetes (module)\n  detail:   linked\n  llm:      exploitable=unlikely confidence=low\n            k8s.io/kubernetes is a large module often pulled in only for API types/client libraries rather than actual server logic, and static analysis shows only linkage (not reachability) in a helm-controller binary, which typically doesn't run the vulnerable kube-apiserver/kubelet code paths; without confirmed call-path reachability or attacker-controlled input to the vulnerable function, real-world exploitability is low.\n\n\nALREADY VEXED (1) - a published statement answers these; vexscan's own verdict is unchanged\nSEVERITY  ADVISORY      PACKAGE           VERSION  FIXED IN  EPSS   VEX STATUS    JUSTIFICATION\nUNKNOWN   GO-2026-5942  golang.org/x/net  v0.55.0  0.56.0    26.4%  not_affected  vulnerable_code_not_present\n\n[LINKED]               golang.org/x/net@v0.55.0\n  cve:      GO-2026-5942\n  from:     golang\n  fixed in: 0.56.0\n  epss:     26.4% percentile (epss 0.00339) for CVE-2026-46600\n  purl:     pkg:golang/golang.org%2Fx%2Fnet@v0.55.0\n  binary:   /usr/bin/helm-controller (stripped)\n  packages: golang.org/x/net/dns/dnsmessage (package)\n  detail:   linked\n  evidence: [vendor-vex] Rancher Security team published not_affected for pkg:golang/github.com/k3s-io/helm-controller (vulnerable_code_not_present);\nstatement names pkg:golang/golang.org/x/net@v0.47.0; component is pkg:golang/golang.org%2Fx%2Fnet@v0.55.0\n  vendor:   Rancher Security team says not_affected (vulnerable_code_not_present)\n            Govulncheck determined that the vulnerable code isn't called\n            product pkg:golang/github.com/k3s-io/helm-controller, published 2026-07-22T03:28:02Z\n            matched loosely: statement names pkg:golang/golang.org/x/net@v0.47.0; component is pkg:golang/golang.org%2Fx%2Fnet@v0.55.0\n  llm:      exploitable=unlikely confidence=medium\n            helm-controller links golang.org/x/net/dns/dnsmessage transitively (e.g. via net/http or Kubernetes client libraries) but does not itself\nperform custom DNS message parsing of attacker-controlled data; typical Go DNS resolution paths rarely trigger the vulnerable code path with untrusted\n input.\n\n\nRULED OUT (1) - the vulnerable code is not present or cannot run\nSEVERITY  ADVISORY      PACKAGE                   VERSION  FIXED IN  EPSS   BASIS\nUNKNOWN   GO-2026-5158  go.opentelemetry.io/otel  v1.41.0  1.44.0    14.7%  pclntab\n\n[NOT PRESENT]          go.opentelemetry.io/otel@v1.41.0\n  cve:      GO-2026-5158\n  from:     golang\n  fixed in: 1.44.0\n  epss:     14.7% percentile (epss 0.00237) for CVE-2026-41178\n  purl:     pkg:golang/go.opentelemetry.io%2Fotel@v1.41.0\n  binary:   /usr/bin/helm-controller (stripped)\n  packages: go.opentelemetry.io/otel/baggage, go.opentelemetry.io/otel/propagation (package)\n  vex:      vulnerable_code_not_present [pclntab]\n  evidence: [vendor-vex] Rancher Security team published not_affected for pkg:golang/github.com/k3s-io/helm-controller (vulnerable_code_not_present);\nstatement names pkg:golang/go.opentelemetry.io/otel@v1.41.0; component is pkg:golang/go.opentelemetry.io%2Fotel@v1.41.0\n  vendor:   Rancher Security team says not_affected (vulnerable_code_not_present)\n            Govulncheck determined that the vulnerable code isn't called\n            product pkg:golang/github.com/k3s-io/helm-controller, published 2026-07-25T03:31:58Z\n            matched loosely: statement names pkg:golang/go.opentelemetry.io/otel@v1.41.0; component is pkg:golang/go.opentelemetry.io%2Fotel@v1.41.0\n\n\n  golang   Go                         73 components     5 findings\n  os       Alpine:v3.24               16 components     0 findings\n  affected by severity: 3 unknown\n  3 affected: 1 fixable, 2 with no fix yet\n  already vexed: 1 by Rancher Security team\n  priority: none in CISA's known-exploited catalog, 0 at or above the 90th EPSS percentile, 3 scored\n  priority data: EPSS 2026-08-05, KEV catalog 2026.08.05\n  5 findings in 3 section(s): AFFECTED (3), ALREADY VEXED (1), RULED OUT (1)", "creation_timestamp": "2026-08-06T00:00:17.944674Z"}, {"uuid": "79cebba2-1bbe-4f1e-8c94-65cc9d7deb4f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-41176", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-06-13)", "content": "", "creation_timestamp": "2026-06-13T00:00:00.000000Z"}, {"uuid": "167bc5ef-d726-45b2-b942-25ce9d2787df", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-41176", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/9ceb5d54-e8d1-41b4-b4e0-a14d2149f4cb", "content": "", "creation_timestamp": "2026-06-19T12:45:11.011443Z"}, {"uuid": "3b4c3795-961b-43f9-9aa8-f4d9deb03f1d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-41175", "type": "seen", "source": "https://bsky.app/profile/euvd-bot.bsky.social/post/3monznlbtm72y", "content": "\ud83d\udea8 EUVD-2026-38057\n\ud83d\udcca 7.4/10\n\ud83c\udfe2 statamic\n\n\ud83d\udcdd Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.23 and 6.20.0, the fix for CVE-2026-41175 was incomplete. It address...\n\n\ud83d\udd17 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-38057\n\n#cybersecurity #infosec #cve #euvd", "creation_timestamp": "2026-06-19T19:00:14.488191Z"}, {"uuid": "e2a0f36d-513f-4163-a742-546908129291", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-41175", "type": "seen", "source": "https://bsky.app/profile/hugovalters.bsky.social/post/3mosjwafv3w2c", "content": "CVE-2026-49287 - Supply chain risk in Statamic. Unaddressed incomplete fix from CVE-2026-41175. Sort param manipulation could delete content/assets. CVSS 7.4. No patch; review templates immediately. #CVE #Statamic #infosec\n\nhttps://www.valtersit.com/cve/CVE-2026-49287/", "creation_timestamp": "2026-06-21T14:02:04.061482Z"}, {"uuid": "82c47ac8-a8d6-439b-b055-dd981f435ce0", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-41176", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/9564adb4-13e0-4337-99fd-cedc89d283d7", "content": "", "creation_timestamp": "2026-06-23T14:03:02.134891Z"}, {"uuid": "9b1db1d0-a6c7-4ca7-ad95-05ef96cd1551", "vulnerability_lookup_origin": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2026-41176", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/2c111d36-9f60-4dbf-863b-2308f9998f4d", "content": "", "creation_timestamp": "2026-06-30T09:23:53.748382Z"}, {"uuid": "2d8b4101-150c-40cf-aa42-6856184cbe3e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-41179", "type": "seen", "source": "https://t.me/GithubRedTeam/90974", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-41179\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a pssec-io\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-28 11:59:03\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPOC for CVE-2026-41179\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-13T22:00:18.010322Z"}, {"uuid": "67186a3c-54b8-451c-a733-141a45feeb7f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-41179", "type": "seen", "source": "https://t.me/GithubRedTeam/90974", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-41179\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a pssec-io\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-28 11:59:03\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPOC for CVE-2026-41179\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-14T00:00:34.352168Z"}, {"uuid": "43f6bfc3-f1b1-4eba-9c5a-a936ec8fb977", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-41179", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/90974", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-41179\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a pssec-io\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-28 11:59:03\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPOC for CVE-2026-41179\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-15T00:00:22.529676Z"}, {"uuid": "fe493b4b-057c-4879-9b3e-514df3f85db9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-41179", "type": "seen", "source": "Telegram/3-f3T699faM2V8GAx3PaWwSzZJ-9InBgGoYDARGL4I5_EwQ", "content": "", "creation_timestamp": "2026-07-16T19:00:28.558049Z"}, {"uuid": "5b19b16e-2e6b-4b24-b801-7f0a4a554f52", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-41179", "type": "seen", "source": "Telegram/3-f3T699faM2V8GAx3PaWwSzZJ-9InBgGoYDARGL4I5_EwQ", "content": "", "creation_timestamp": "2026-07-17T00:00:45.996267Z"}, {"uuid": "b0cd122a-3ea4-4385-86b9-cd8ce7890d56", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-41179", "type": "published-proof-of-concept", "source": "Telegram/3-f3T699faM2V8GAx3PaWwSzZJ-9InBgGoYDARGL4I5_EwQ", "content": "", "creation_timestamp": "2026-07-18T02:00:06.398912Z"}, {"uuid": "9caf48c8-de63-4867-9ef0-c24ae6b2ce9f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-41179", "type": "published-proof-of-concept", "source": "Telegram/3-f3T699faM2V8GAx3PaWwSzZJ-9InBgGoYDARGL4I5_EwQ", "content": "", "creation_timestamp": "2026-07-19T00:00:41.061754Z"}, {"uuid": "53ce4447-817e-45a4-bd54-a518d560b6b8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-41179", "type": "seen", "source": "https://t.me/GithubRedTeam/95321", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-41179\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a s-vx\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-27 04:18:26\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nRCE in rclone\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-27T06:00:04.806659Z"}, {"uuid": "c1b7fb89-406e-4976-bc06-ae64c8668d6c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-41179", "type": "seen", "source": "Telegram/kn38l-BAxVCicUp4xe_VlmwdfqsYeVojoIvsltdH6OF8az4", "content": "", "creation_timestamp": "2026-07-27T10:00:04.484027Z"}, {"uuid": "fbbd5124-271a-487c-911e-aaaeed77147e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-41179", "type": "published-proof-of-concept", "source": "Telegram/kn38l-BAxVCicUp4xe_VlmwdfqsYeVojoIvsltdH6OF8az4", "content": "", "creation_timestamp": "2026-07-28T00:00:37.935528Z"}, {"uuid": "c5aafc14-2624-485a-b161-2dcb668f4226", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-41179", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/95321", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-41179\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a s-vx\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-27 04:18:26\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nRCE in rclone\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-28T00:00:44.431168Z"}]}