vulnerability-operator < 0.28.16 - Unauthenticated Report Directory Listing

mediumseverity

5.3CVSS score

0.5%likelihood of exploitation, next 30 days

40%of all CVEs are less likely

Readycheck to confirm it

vulnerability-operator < 0.28.16 contains an information disclosure caused by unauthenticated access to /report/ HTTP endpoint exposing vulnerability scan reports, letting unauthenticated attackers access sensitive vulnerability data, exploit requires network access to operator HTTP port.

Impact

Unauthenticated attackers can access detailed vulnerability scan reports, exposing sensitive CVE IDs, package versions, and container image identifiers.

Fix

Upgrade to version 0.28.16 or later.

How to confirm it

Send: GET /report/
Positive when: status_code == 200 and contains(content_type, "text/html") and contains(body, "<pre>") and !contains_any(body, "<html", "<body", "<head", "<title", "<script", "image/") and contains_any(body, "report…

Run it with nuclei: nuclei -id CVE-2026-64858 -u <target>

The full check

id: CVE-2026-64858

info:
  name: vulnerability-operator < 0.28.16 - Unauthenticated Report Directory Listing
  author: maulanawirawan
  severity: medium
  description: |
    vulnerability-operator < 0.28.16 contains an information disclosure caused by unauthenticated access to /report/ HTTP endpoint exposing vulnerability scan reports, letting unauthenticated attackers access sensitive vulnerability data, exploit requires network access to operator HTTP port.
  impact: |
    Unauthenticated attackers can access detailed vulnerability scan reports, exposing sensitive CVE IDs, package versions, and container image identifiers.
  remediation: |
    Upgrade to version 0.28.16 or later.
  reference:
    - https://github.com/ckotzbauer/vulnerability-operator/security/advisories/GHSA-6v6c-4cxg-cc93
    - https://github.com/ckotzbauer/vulnerability-operator/commit/b083ab0146e7fb301be6b5a4bc917b5e5fad6eae
    - https://nvd.nist.gov/vuln/detail/CVE-2026-64858
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2026-64858
    epss-score: 0.00453
    epss-percentile: 0.39843
    cwe-id: CWE-548
  metadata:
    verified: true
    max-request: 1
    vendor: ckotzbauer
    product: vulnerability-operator
  tags: cve,cve2026,ckotzbauer,vulnerability-operator,exposure,listing,unauth

http:
  - raw:
      - |
        GET /report/ HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "text/html")'
          - 'contains(body, "<pre>")'
          - '!contains_any(body, "<html", "<body", "<head", "<title", "<script", "image/")'
          - 'contains_any(body, "report.json", "audited.json")'
        condition: and

    extractors:
      - type: regex
        part: body
        group: 1
        regex:
          - '<a href="([^"]+\.json)"'

References

Use this check only on systems you are authorised to test. Where the data comes from