14 New DevOps CVEs to Patch — Published Dates, Fixes, and Deadlines (Nov 9, 2026)

This evening's DevOps CVE watch turned up 14 new vulnerabilities worth patching, checked live against the U.S. National Vulnerability Database (NVD) and CISA's Known Exploited Vulnerabilities (KEV) catalog on November 9, 2026.

One thing to know first: only two of these fourteen carry an official fix deadline — the two CISA added to its KEV catalog, both due Thursday, November 12. For the rest there is no mandated deadline; each entry gives the NVD published date, the fix version, and a recommended fix window based on severity. That window is guidance, not a mandate.

KEV-listed — mandated fix by Thu Nov 12

1. GPUStack — CVE-2026-102895 — CRITICAL 9.8

Unauthenticated admin access: a remote request can spoof loopback via the X-GPUStack-Real-IP header, then create admin API keys, read worker/cloud secrets, and get RCE. Exploitation seen in the wild against 2.1.1.

• Published: Nov 4, 2026
• Affected: before 2.2.0
• Fix: 2.2.0
• Deadline: KEV-listed, due Nov 12, 2026
• Relevance: only if you run GPUStack
• Sources: NVD · GHSA · KEV catalog

2. OpenSSH ("sshole") — CVE-2026-123158 — HIGH 8.1

Password-auth bypass on sshd with musl libc without PAM: any 256–1024-char password succeeds for some account configs, including locked root on Alpine.

• Published: Nov 5, 2026
• Affected: before 10.6p2
• Fix: 10.6p2
• Deadline: KEV-listed, due Nov 12, 2026
• Relevance: Alpine/musl hosts only — glibc or PAM sshd not affected
• Sources: NVD · KEV catalog

No fix yet — mitigate now

3. Redpanda Connect — CVE-2026-123270 — CRITICAL 9.8

Streams-mode management API on :4195 has auth disabled by default; unauthenticated POST of a malicious pipeline gives RCE on the host.

• Published: Nov 9, 2026
• Affected: 4.39–4.110
• Fix: no fixed version confirmed yet
• Deadline: no mandated deadline; guidance: don't expose :4195 to untrusted networks, patch within 24–72h of a fix
• Relevance: only if you run Redpanda Connect streams mode
• Sources: NVD

4. python-jose — CVE-2026-120459 — CRITICAL 9.1

Zero-length HMAC secrets are accepted, so JWTs (HS256/384/512) can be forged when the verification key resolves to empty.

• Published: Nov 2, 2026
• Affected: through 3.5.0
• Fix: no fix released yet
• Deadline: no mandated deadline; guidance: reject empty/missing HMAC secrets at config load now
• Relevance: only if you use python-jose
• Sources: NVD

5. OpenShift — CVE-2026-82976 — HIGH 7.1

Bare-metal provisioning image server on :8084 has a browsable directory listing; an attacker on the provisioning network recovers per-host image UUIDs, and each image embeds the cluster pull secret (plus optional SSH key).

• Published: Nov 3, 2026
• Affected: bare-metal IPI installs
• Fix: fix version not yet published by Red Hat
• Deadline: no mandated deadline; guidance: restrict provisioning-network access to :8084, patch within 2 weeks of a fix
• Relevance: bare-metal IPI only
• Sources: NVD

Fix available — patch

6. SuperTokens — CVE-2026-123800 — CRITICAL 9.9

In multi-tenant licensed deployments, an attacker with one app's valid API key can modify another tenant's config.

• Published: Nov 9, 2026
• Affected: Core 6.0.0 up through the patch branches
• Fix: per branch, up to 12.3.1
• Deadline: no mandated deadline; guidance: within 24–72h
• Relevance: multi-tenant licensed deployments only
• Sources: NVD

7. CPython ssl — CVE-2026-19445 — CRITICAL 9.2

A remote TLS client can crash the server or call through a freed pointer when sni_callback swaps in a different SSLContext. Narrow condition: only servers creating an SSLContext per connection or replacing it while connections are open.

• Published: Sep 30, 2026 (surfaced Nov 9)
• Affected: CPython before the fixed releases
• Fix: 3.10.22 / 3.11.17 / 3.12.15 / 3.13.16 / 3.14.8
• Deadline: no mandated deadline; guidance: within 24–72h
• Sources: NVD

8. Apache Tomcat — CVE-2026-101296 — CRITICAL 9.1

JNDI realm with non-GSSAPI SASL auth skips a critical step, so an attacker authenticates without the correct password.

• Published: Oct 20, 2026 (surfaced Nov 9)
• Affected: 11.0.0-M1–11.0.26, 10.1.0–10.1.60, 9.0.0.M1–9.0.122
• Fix: 11.0.27 / 10.1.61 / 9.0.123
• Deadline: no mandated deadline; guidance: within 24–72h
• Relevance: JNDI-realm configs only — Spring Boot embeds Tomcat, so check yours
• Sources: NVD

9. fastapi-code-generator — CVE-2026-63469 — CRITICAL 9.3

An attacker-influenced OpenAPI response key injects a Python expression into generated code, executed with app/CI privileges.

• Published: Nov 3, 2026
• Affected: before 0.8.1
• Fix: 0.8.1
• Deadline: no mandated deadline; guidance: within 24–72h
• Relevance: sibling of CVE-2026-63471 from Nov 7; same 0.8.1 fix covers both
• Sources: NVD

10. AsyncSSH — CVE-2026-102643 — HIGH 8.8

Authenticated SFTP user escapes the chroot with a path starting with exactly two slashes.

• Published: Nov 9, 2026
• Affected: before 2.24.1
• Fix: 2.24.1
• Deadline: no mandated deadline; guidance: within 1 week
• Relevance: only if you run AsyncSSH SFTP servers
• Sources: NVD · GHSA

11. aiohttp — CVE-2026-123817 — HIGH 8.7

A malicious peer splitting WebSocket frames into tiny reads bypasses max_msg_size accounting and exhausts memory (DoS).

• Published: Nov 9, 2026
• Affected: before 3.14.4
• Fix: 3.14.4
• Deadline: no mandated deadline; guidance: within 1 week
• Relevance: only if you use aiohttp
• Sources: NVD · GHSA

12. Telepresence — CVE-2026-102340 — HIGH 8.5

Traffic Manager gRPC API accepts unauthenticated cluster-network callers; any pod can register intercepts and receive victim pod traffic.

• Published: Nov 4, 2026
• Affected: before 2.31.0
• Fix: 2.31.0
• Deadline: no mandated deadline; guidance: within 1 week
• Sources: NVD · GHSA

13. Telepresence — CVE-2026-102339 — HIGH 8.2

Traffic Manager tunnel endpoint trusts a caller-controlled session ID, letting an attacker attach a routed tunnel and gain the session's network routing.

• Published: Nov 4, 2026
• Affected: before 2.31.0
• Fix: 2.31.0
• Deadline: no mandated deadline; guidance: within 1 week
• Sources: NVD · GHSA

14. Angular SSR — CVE-2026-111752 — HIGH 8.2

Crafted requests with unconfigured auxiliary-outlet groups exhaust resources via repeated route evaluation (unauthenticated DoS).

• Published: Nov 3, 2026
• Affected: before 20.3.33 / 21.2.25 / 22.2.1
• Fix: 20.3.33 / 21.2.25 / 22.2.1
• Deadline: no mandated deadline; guidance: within 1 week
• Relevance: sibling of CVE-2026-111751 from Nov 7
• Sources: NVD

Reminder: Brotli CVE-2026-111497 was updated in NVD again this morning (scores unchanged, 9.2/9.8) — and its federal patch deadline is today, November 10, 2026.

Kubernetes, as a Circuit: 8 Zones, 32 Building Blocks, One Cluster (Shared from LinkedIn)

Kubernetes, as a Circuit: 8 Zones, 32 Building Blocks, One Cluster

An attributed summary of a LinkedIn post by Turf Dev (published November 8, 2026). The map and the framing are theirs; the notes below are my summary. See the original post for the full discussion.

Animated map: "Kubernetes, as a Circuit" by Turf Dev, embedded from the original LinkedIn post.

Kubernetes feels big when you start. Turf Dev's map cuts it down to one flow: you run kubectl apply, the API Server checks who you are and what you are allowed to do, the Control Plane decides, and a Worker Node runs it. Everything else in the map exists to make that flow reliable, secure, and observable.

The 8 zones

API Server checks — Authentication, Authorization (RBAC), Admission. This is the gate every request passes through before anything else happens.

1. Control Plane — API Server, etcd, Scheduler, Controller Manager. The brain: it stores the desired state, decides where work goes, and drives the cluster toward that state.

2. Worker Nodes — kubelet, kube-proxy, container runtime. The hands: they run the containers, report status back, and wire up the networking for each pod.

3. Workloads — Pod, Deployment, StatefulSet, Jobs & CronJobs. What you actually run, from a single pod to a scheduled batch job.

4. Config — ConfigMap, Secret, Namespaces, Resource Limits. How you separate environments and keep settings and credentials out of your container images.

5. Networking — Service, Ingress, NetworkPolicy, CoreDNS. How pods find each other, how traffic gets in, and how you fence it off.

6. Scale & Schedule — HPA, Cluster Autoscaler, Node Affinity, Taints & Tolerations. How the cluster grows, shrinks, and decides which node a pod lands on.

7. Security — RBAC, Pod Security, Security Context, Service Accounts. Who can do what, and what a pod is allowed to do once it is running.

8. Observability — Probes, Events, Metrics, Logs. How you know the cluster is healthy — and where to look first when it is not.

How to use the map

The beginner tip from the post is the right one: do not try to learn all 32 blocks at once. Start with Pod, Deployment, and Service, then add one zone at a time. A practical way to use the map after that: when something breaks, the zone tells you where to look. A pod that never starts is usually a scheduling problem (zone 6) or a config problem (zone 4); a service you cannot reach is usually networking (zone 5); a deploy that gets rejected is usually the API Server checks or RBAC (zones 7 and the gate at the top).

Source: Turf Dev on LinkedIn, "Kubernetes, as a Circuit: 8 zones, 32 building blocks, one cluster", November 8, 2026 — read the original post.

7 New DevOps CVEs to Patch — Published Dates, Fixes, and Deadlines (Nov 6, 2026)

This morning's DevOps CVE watch turned up 7 new vulnerabilities worth patching. Every date below was checked live against the U.S. National Vulnerability Database (NVD) and CISA's Known Exploited Vulnerabilities (KEV) catalog on November 6, 2026.

One thing to know first: none of these seven has an official fix deadline. A hard "must fix by" date only exists when CISA adds a CVE to its KEV catalog, and none of these seven are on it. Each entry gives the NVD published date, the fix version, and a recommended fix window based on severity — that window is guidance, not a mandate.

1. Keycloak — CVE-2026-117691 — CRITICAL 9.1

SAML login signature bypass via percent-encoded parameter names — full account takeover of federated users, no authentication needed.

• Published: Nov 5, 2026, 9:17 AM ET
• Affected: Keycloak before 26.8.2 (SAML over HTTP-Redirect realms; OIDC-only realms not exposed)
• Fix: 26.8.2
• Recommended fix window: within 24–72 hours
• Sources: NVD · Keycloak 26.8.2 release notes

2. Kyverno — CVE-2026-122302 through CVE-2026-122323 — max CRITICAL 9.4

Twenty CVEs covering namespace-isolation bypasses, privilege escalation, and admission-webhook denial of service in namespaced policies. The worst ones (9.4) let a namespace tenant read or write other namespaces' Secrets or take over the cluster.

• Published: Nov 4, 2026, 10:17 PM ET
• Affected: Kyverno before 1.19.2
• Fix: 1.19.2 (same release that fixes the 9.9 CVE-2026-122310 reported Nov 5)
• Recommended fix window: within 24–72 hours
• Sources: NVD · Kyverno security advisory

3. Kubeflow Pipelines — CVE-2026-88980, CVE-2026-88981 — HIGH 8.6

Frontend artifact-download and pod-log paths accept attacker-controlled endpoints, enabling server-side request forgery.

• Published: Nov 5, 2026, 6:17 PM ET
• Affected: Kubeflow Pipelines before 2.18.0
• Fix: 2.18.0 (same release that fixes the 9.6 CVE-2026-77596 reported Nov 5)
• Recommended fix window: within 1 week
• Sources: NVD · Kubeflow security advisory

4. GPUStack — CVE-2026-103002 — HIGH 8.8

The cluster API proxy forwards a non-admin's requests without a resource-level authorization check, using a worker's Kubernetes ServiceAccount credentials.

• Published: Nov 4, 2026, 5:17 PM ET
• Affected: GPUStack 2.2.0–2.2.1
• Fix: 2.2.2
• Recommended fix window: within 1 week
• Sources: NVD

5. Grafana — CVE-2026-33379 — HIGH 8.5

Any role, including Viewer or a permissionless service account, can create, externally publish, and delete dashboard snapshots.

• Published: Nov 6, 2026, 5:16 AM ET
• Affected: Grafana OSS/Enterprise 12.4 only
• Fix: unconfirmed — Grafana has not published an advisory yet
• Recommended fix window: within 1 week once the fix lands
• Sources: NVD

6. undici (Node.js HTTP client) — CVE-2026-116592 — HIGH 7.4

A redirect through an untrusted origin can poison the shared cache or serve one user's private response to another.

• Published: Nov 6, 2026, 5:16 AM ET
• Affected: undici 7.30.1 and 8.12.2–8.12.3 (originless Agent + shared cache + redirect/cache interceptors)
• Fix: 7.30.2 / 8.12.4
• Recommended fix window: within 2 weeks
• Sources: NVD · undici security advisory

7. IntelliJ IDEA — CVE-2026-123293 — HIGH 7.8

Code execution in untrusted projects via the Terraform tool-path setting.

• Published: Nov 6, 2026, 6:17 AM ET
• Affected: IntelliJ IDEA before 2026.3 / 2026.2.4
• Fix: 2026.3 / 2026.2.4
• Recommended fix window: within 2 weeks
• Sources: NVD

What to patch first

Keycloak first — unauthenticated account takeover — then Kyverno if you run it. The only hard deadline in play right now is Brotli's: federal agencies must patch CVE-2026-111497 (Node2Shell) by November 10, 2026.

Sources: U.S. National Vulnerability Database (NVD), CISA Known Exploited Vulnerabilities catalog, and the vendors' own security advisories linked above. Published dates are NVD publication times, shown in U.S. Eastern Time. Recommended fix windows are severity-based guidance, not vendor or government mandates.

 

Brotli Vulnerability CVE-2026-111497 (Node2Shell): What It Is and What to Patch

Brotli Vulnerability CVE-2026-111497 (Node2Shell): What It Is and What to Patch

Published November 5, 2026. Details checked against the NVD record on November 5, 2026 (last modified November 4, 2026). Sources are linked at the end.

What Brotli is

Brotli is Google's compression format, the technology behind Content-Encoding: br in HTTP. Browsers, web servers, CDNs, and a large share of backend runtimes use it to make responses smaller. It is plumbing, not an application, and that is exactly why this vulnerability matters so much: one small library sits underneath a huge part of the internet.

The bug

CVE-2026-111497 is an out-of-bounds write in the Brotli decoder (c/dec/decode.c), affecting Brotli versions 1.0.3 through 1.2.0. When the decoder hits an invalid block switch, it treats it as "I need more input" instead of a permanent format error, so the streaming decoder keeps appending bytes into an 8-byte internal buffer, past its end. The root cause is an unchecked return value in block-switch processing (CWE-252).

A remote, unauthenticated attacker sending a crafted Brotli-compressed stream can corrupt decoder memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code.

Severity

• CVSS 4.0: 9.2 Critical (scored by Google)
• CVSS 3.1: 9.8 Critical (scored by NVD)
• CISA KEV: added to the Known Exploited Vulnerabilities catalog on October 27, 2026, with a November 10, 2026 remediation deadline for US federal agencies. Public proof-of-concept code exists.

Affected and fixed versions

• Google Brotli 1.0.3–1.2.0 affected; fixed in 1.0.10, 1.1.1, 1.2.1
• Node.js: below 22.23.4, 23.x below 24.22.1, 25.x below 26.12.1 affected; fixed in 22.23.4, 24.22.1, 26.12.1
• Python: brotli below 1.2.1 and brotlicffi below 1.2.1.0 affected; fixed in brotli 1.2.1 and brotlicffi 1.2.1.0
• .NET: fixed in 8.0.33, 9.0.22, 10.0.14
• Envoy: fixed in 1.40.0, 1.39.3, 1.38.6, 1.37.8, 1.36.12; Istio: 1.31.2, 1.30.6, 1.29.9; Bun: 1.4.4

Timeline

• October 21, 2026: public disclosure. Node.js published its security releases and Google released Brotli 1.2.1 the same day. The flaw was reported by OpenAI Codex Security.
• October 27, 2026: CISA added CVE-2026-111497 to the KEV catalog.
• November 10, 2026: federal remediation deadline.

Why everyone is scrambling

Three reasons. First, the blast radius: anything that decompresses attacker-influenced Brotli data is exposed, from Node.js and Python services to Envoy, Istio, and countless devices that embed the library. Second, Brotli is embedded, not installed: every product that bundles the decoder needs its own fix release and redeploy, and some vendors are still shipping theirs. Third, scanners missed the Python side at first: the CVE was filed against Google's C library, and the PyPI packages were not listed in any advisory database as of October 23, so pip-audit and Dependabot had nothing to match against. The GitHub advisory covering them (GHSA-9v8h-qqgm-4m35) came later.

One nuance: exploitation is reportedly unreliable in practice. Most lab attempts crash the worker process instead of yielding a shell. So the realistic risk for most teams is crashes and denial of service first, remote code execution second, but with CISA listing it as exploited, nobody gets to wait and see.

What to check in your stack

• Node.js services and anything behind Envoy or Istio first.
• Python services using brotli or brotlicffi: these are easy to miss, since scanners did not flag them initially. Check installed versions directly.
• Any service that accepts request bodies with a Content-Encoding: br header, or that fetches and decompresses Brotli-encoded responses from external servers.
• If patching cannot happen immediately, a WAF can block crafted Brotli-compressed request bodies on the inbound side, but it cannot protect applications that fetch and decompress Brotli responses from elsewhere. Those must be patched.

Sources

• NVD: CVE-2026-111497
• Node.js October 2026 security releases
• CISA Known Exploited Vulnerabilities catalog
• GitHub Advisory GHSA-9v8h-qqgm-4m35
• Google Brotli 1.2.1 release
• broccoli2shell.com

Kubernetes Errors, Translated into Plain English (Shared from LinkedIn)

Kubernetes errors can look cryptic at first glance, but in most cases they are badly named rather than truly hard to understand. Once you learn what an error is actually saying, half the debugging is already done.

For example, OOMKilled means a pod used more memory than it was given, Pending means no node has room for the workload, and a pod stuck in Terminating often means a finalizer is waiting on something that will never happen. Deepak Agrawal has gathered 25 of the ugliest Kubernetes errors into one chart, translated into plain English, so it can be saved before an on-call shift.

Image: Deepak Agrawal, via the original LinkedIn post.

Source: Deepak Agrawal's LinkedIn post

Kubernetes Probes: Startup, Liveness, Readiness Explained (Shared from LinkedIn)

Found this clear explainer on LinkedIn from DevOps Universe, and it's worth keeping handy: Kubernetes has three probes, and they each answer a different question.

Image: DevOps Universe, via the original LinkedIn post.

Startup probe — Has the app finished starting? It gives slow-starting apps time to boot, and liveness and readiness stay paused until it passes. If it never passes, Kubernetes restarts the container.

Liveness probe — Is the app still alive? It catches a stuck or deadlocked app, and on failure Kubernetes restarts the container.

Readiness probe — Is the pod ready to serve traffic? On failure the pod is removed from the Service so it stops receiving traffic, but it is not restarted.

Common mistakes the post calls out: using a liveness probe to check the database (one DB blip then restarts every pod), running slow apps with no startup probe (liveness kills them before they finish booting), and running with no readiness probe (users hit pods that aren't ready yet).

As the author puts it: "Startup protects the boot. Liveness protects against hangs. Readiness protects your users."

Read the original post on LinkedIn here: https://www.linkedin.com/posts/kubernetes-devops-k8s-share-7519379164957892609-O71O/

Credit: DevOps Universe on LinkedIn. This blog post is a summary with attribution, not a republication of the original.

Daily DevOps & Cloud Briefing — November 2, 2026

Daily DevOps & Cloud Briefing — Monday, November 2, 2026

A quiet weekend for new launches, so this covers the last 3–4 days, led by earnings, a critical GitLab flaw, and agentic platform moves.

1. DevOps architecture

• Anthropic built Scion, a new source-control system for agent-scale code — handling 30,000+ merges on peak days and 25M daily CI checkouts, reportedly cutting source-control CPU/memory ~200× and recovering 25% of CI CPU. Source: https://medium.com/@platform-alchemist/anthropic-reinvents-source-control-software-engineering-would-like-a-word-a8667d248e8c
• GitLab made Orbit generally available (Oct 15, Premium/Ultimate on GitLab.com) — a shared lifecycle graph for agents, claiming up to 45× fewer retries and 4.5× fewer tokens. Source: https://forkast.news/gitlab-orbit-shared-lifecycle-graph/
• HashiCorp (IBM) pushed Terraform toward governed, agentic operations — Terraform policy GA, plus Developer Portal, MCP, and Infragraph previews. Source: https://www.hashicorp.com/en/blog/terraform-advances-infrastructure-lifecycle-management-for-the-agentic-era
• GitLab CVE-2026-97229 (CVSS 10.0) — flagged in yesterday's briefing too, and worth repeating because its federal patch deadline was Nov 1, so any unpatched self-managed instance is now overdue. Source: https://tech-insider.org/gitlab-cve-2026-97229-cvss-10-cisa-kev-ruby-patch-2026/

2. Cloud

• Q3 scoreboard: AWS $46B (+39.3%), Azure $33.2B (+48%), Google Cloud $30.7B (+103%). Source: https://tech-insider.org/au/google-cloud-103-percent-azure-aws-q3-2026-australia/
• Amazon kept ~$220B 2026 capex, "meaningfully more" in 2027; AWS at a $184B run rate. Source: https://www.webpronews.com/aws-39-percent-growth-amazon-q3-2026-earnings-capex/
• GPT-6 now on all three clouds; GPT-6.1 Terra GA on Bedrock Oct 26. Source: https://www.stockreport.com/2026/10/22/gpt-6-lands-on-google-cloud-the-cloud-giants-are-the-story/

3. Enterprise technology planning

• ~$1.14T combined AWS+Google backlog — but backlog is not revenue. Source: https://www.kucoin.com/blog/goldman-sachs-divided-on-ai-boom
• GPU FinOps is the top concern: ~$85K/mo AI spend with average GPU utilization at just 5%. Source: https://squareops.com/blog/ai-workload-cloud-cost-management/
• Nov 7–19 deprecation cluster to plan around: OpenSearch, .NET 8/9, Lambda .NET 8, Azure Functions PowerShell, Azure OpenAI o1/o3. Source: https://dev.to/yuryatrashkevich/49-cloud-and-ai-deadlines-before-the-end-of-2026-with-what-to-do-for-each-17mj