7 New DevOps CVEs to Patch — Published Dates, Fixes, and Deadlines (Nov 6, 2026)

This morning's DevOps CVE watch turned up 7 new vulnerabilities worth patching. Every date below was checked live against the U.S. National Vulnerability Database (NVD) and CISA's Known Exploited Vulnerabilities (KEV) catalog on November 6, 2026.

One thing to know first: none of these seven has an official fix deadline. A hard "must fix by" date only exists when CISA adds a CVE to its KEV catalog, and none of these seven are on it. Each entry gives the NVD published date, the fix version, and a recommended fix window based on severity — that window is guidance, not a mandate.

1. Keycloak — CVE-2026-117691 — CRITICAL 9.1

SAML login signature bypass via percent-encoded parameter names — full account takeover of federated users, no authentication needed.

• Published: Nov 5, 2026, 9:17 AM ET
• Affected: Keycloak before 26.8.2 (SAML over HTTP-Redirect realms; OIDC-only realms not exposed)
• Fix: 26.8.2
• Recommended fix window: within 24–72 hours
• Sources: NVD · Keycloak 26.8.2 release notes

2. Kyverno — CVE-2026-122302 through CVE-2026-122323 — max CRITICAL 9.4

Twenty CVEs covering namespace-isolation bypasses, privilege escalation, and admission-webhook denial of service in namespaced policies. The worst ones (9.4) let a namespace tenant read or write other namespaces' Secrets or take over the cluster.

• Published: Nov 4, 2026, 10:17 PM ET
• Affected: Kyverno before 1.19.2
• Fix: 1.19.2 (same release that fixes the 9.9 CVE-2026-122310 reported Nov 5)
• Recommended fix window: within 24–72 hours
• Sources: NVD · Kyverno security advisory

3. Kubeflow Pipelines — CVE-2026-88980, CVE-2026-88981 — HIGH 8.6

Frontend artifact-download and pod-log paths accept attacker-controlled endpoints, enabling server-side request forgery.

• Published: Nov 5, 2026, 6:17 PM ET
• Affected: Kubeflow Pipelines before 2.18.0
• Fix: 2.18.0 (same release that fixes the 9.6 CVE-2026-77596 reported Nov 5)
• Recommended fix window: within 1 week
• Sources: NVD · Kubeflow security advisory

4. GPUStack — CVE-2026-103002 — HIGH 8.8

The cluster API proxy forwards a non-admin's requests without a resource-level authorization check, using a worker's Kubernetes ServiceAccount credentials.

• Published: Nov 4, 2026, 5:17 PM ET
• Affected: GPUStack 2.2.0–2.2.1
• Fix: 2.2.2
• Recommended fix window: within 1 week
• Sources: NVD

5. Grafana — CVE-2026-33379 — HIGH 8.5

Any role, including Viewer or a permissionless service account, can create, externally publish, and delete dashboard snapshots.

• Published: Nov 6, 2026, 5:16 AM ET
• Affected: Grafana OSS/Enterprise 12.4 only
• Fix: unconfirmed — Grafana has not published an advisory yet
• Recommended fix window: within 1 week once the fix lands
• Sources: NVD

6. undici (Node.js HTTP client) — CVE-2026-116592 — HIGH 7.4

A redirect through an untrusted origin can poison the shared cache or serve one user's private response to another.

• Published: Nov 6, 2026, 5:16 AM ET
• Affected: undici 7.30.1 and 8.12.2–8.12.3 (originless Agent + shared cache + redirect/cache interceptors)
• Fix: 7.30.2 / 8.12.4
• Recommended fix window: within 2 weeks
• Sources: NVD · undici security advisory

7. IntelliJ IDEA — CVE-2026-123293 — HIGH 7.8

Code execution in untrusted projects via the Terraform tool-path setting.

• Published: Nov 6, 2026, 6:17 AM ET
• Affected: IntelliJ IDEA before 2026.3 / 2026.2.4
• Fix: 2026.3 / 2026.2.4
• Recommended fix window: within 2 weeks
• Sources: NVD

What to patch first

Keycloak first — unauthenticated account takeover — then Kyverno if you run it. The only hard deadline in play right now is Brotli's: federal agencies must patch CVE-2026-111497 (Node2Shell) by November 10, 2026.

Sources: U.S. National Vulnerability Database (NVD), CISA Known Exploited Vulnerabilities catalog, and the vendors' own security advisories linked above. Published dates are NVD publication times, shown in U.S. Eastern Time. Recommended fix windows are severity-based guidance, not vendor or government mandates.

 

Brotli Vulnerability CVE-2026-111497 (Node2Shell): What It Is and What to Patch

Brotli Vulnerability CVE-2026-111497 (Node2Shell): What It Is and What to Patch

Published November 5, 2026. Details checked against the NVD record on November 5, 2026 (last modified November 4, 2026). Sources are linked at the end.

What Brotli is

Brotli is Google's compression format, the technology behind Content-Encoding: br in HTTP. Browsers, web servers, CDNs, and a large share of backend runtimes use it to make responses smaller. It is plumbing, not an application, and that is exactly why this vulnerability matters so much: one small library sits underneath a huge part of the internet.

The bug

CVE-2026-111497 is an out-of-bounds write in the Brotli decoder (c/dec/decode.c), affecting Brotli versions 1.0.3 through 1.2.0. When the decoder hits an invalid block switch, it treats it as "I need more input" instead of a permanent format error, so the streaming decoder keeps appending bytes into an 8-byte internal buffer, past its end. The root cause is an unchecked return value in block-switch processing (CWE-252).

A remote, unauthenticated attacker sending a crafted Brotli-compressed stream can corrupt decoder memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code.

Severity

• CVSS 4.0: 9.2 Critical (scored by Google)
• CVSS 3.1: 9.8 Critical (scored by NVD)
• CISA KEV: added to the Known Exploited Vulnerabilities catalog on October 27, 2026, with a November 10, 2026 remediation deadline for US federal agencies. Public proof-of-concept code exists.

Affected and fixed versions

• Google Brotli 1.0.3–1.2.0 affected; fixed in 1.0.10, 1.1.1, 1.2.1
• Node.js: below 22.23.4, 23.x below 24.22.1, 25.x below 26.12.1 affected; fixed in 22.23.4, 24.22.1, 26.12.1
• Python: brotli below 1.2.1 and brotlicffi below 1.2.1.0 affected; fixed in brotli 1.2.1 and brotlicffi 1.2.1.0
• .NET: fixed in 8.0.33, 9.0.22, 10.0.14
• Envoy: fixed in 1.40.0, 1.39.3, 1.38.6, 1.37.8, 1.36.12; Istio: 1.31.2, 1.30.6, 1.29.9; Bun: 1.4.4

Timeline

• October 21, 2026: public disclosure. Node.js published its security releases and Google released Brotli 1.2.1 the same day. The flaw was reported by OpenAI Codex Security.
• October 27, 2026: CISA added CVE-2026-111497 to the KEV catalog.
• November 10, 2026: federal remediation deadline.

Why everyone is scrambling

Three reasons. First, the blast radius: anything that decompresses attacker-influenced Brotli data is exposed, from Node.js and Python services to Envoy, Istio, and countless devices that embed the library. Second, Brotli is embedded, not installed: every product that bundles the decoder needs its own fix release and redeploy, and some vendors are still shipping theirs. Third, scanners missed the Python side at first: the CVE was filed against Google's C library, and the PyPI packages were not listed in any advisory database as of October 23, so pip-audit and Dependabot had nothing to match against. The GitHub advisory covering them (GHSA-9v8h-qqgm-4m35) came later.

One nuance: exploitation is reportedly unreliable in practice. Most lab attempts crash the worker process instead of yielding a shell. So the realistic risk for most teams is crashes and denial of service first, remote code execution second, but with CISA listing it as exploited, nobody gets to wait and see.

What to check in your stack

• Node.js services and anything behind Envoy or Istio first.
• Python services using brotli or brotlicffi: these are easy to miss, since scanners did not flag them initially. Check installed versions directly.
• Any service that accepts request bodies with a Content-Encoding: br header, or that fetches and decompresses Brotli-encoded responses from external servers.
• If patching cannot happen immediately, a WAF can block crafted Brotli-compressed request bodies on the inbound side, but it cannot protect applications that fetch and decompress Brotli responses from elsewhere. Those must be patched.

Sources

• NVD: CVE-2026-111497
• Node.js October 2026 security releases
• CISA Known Exploited Vulnerabilities catalog
• GitHub Advisory GHSA-9v8h-qqgm-4m35
• Google Brotli 1.2.1 release
• broccoli2shell.com

Kubernetes Errors, Translated into Plain English (Shared from LinkedIn)

Kubernetes errors can look cryptic at first glance, but in most cases they are badly named rather than truly hard to understand. Once you learn what an error is actually saying, half the debugging is already done.

For example, OOMKilled means a pod used more memory than it was given, Pending means no node has room for the workload, and a pod stuck in Terminating often means a finalizer is waiting on something that will never happen. Deepak Agrawal has gathered 25 of the ugliest Kubernetes errors into one chart, translated into plain English, so it can be saved before an on-call shift.

Image: Deepak Agrawal, via the original LinkedIn post.

Source: Deepak Agrawal's LinkedIn post

Kubernetes Probes: Startup, Liveness, Readiness Explained (Shared from LinkedIn)

Found this clear explainer on LinkedIn from DevOps Universe, and it's worth keeping handy: Kubernetes has three probes, and they each answer a different question.

Image: DevOps Universe, via the original LinkedIn post.

Startup probe — Has the app finished starting? It gives slow-starting apps time to boot, and liveness and readiness stay paused until it passes. If it never passes, Kubernetes restarts the container.

Liveness probe — Is the app still alive? It catches a stuck or deadlocked app, and on failure Kubernetes restarts the container.

Readiness probe — Is the pod ready to serve traffic? On failure the pod is removed from the Service so it stops receiving traffic, but it is not restarted.

Common mistakes the post calls out: using a liveness probe to check the database (one DB blip then restarts every pod), running slow apps with no startup probe (liveness kills them before they finish booting), and running with no readiness probe (users hit pods that aren't ready yet).

As the author puts it: "Startup protects the boot. Liveness protects against hangs. Readiness protects your users."

Read the original post on LinkedIn here: https://www.linkedin.com/posts/kubernetes-devops-k8s-share-7519379164957892609-O71O/

Credit: DevOps Universe on LinkedIn. This blog post is a summary with attribution, not a republication of the original.

Daily DevOps & Cloud Briefing — November 2, 2026

Daily DevOps & Cloud Briefing — Monday, November 2, 2026

A quiet weekend for new launches, so this covers the last 3–4 days, led by earnings, a critical GitLab flaw, and agentic platform moves.

1. DevOps architecture

• Anthropic built Scion, a new source-control system for agent-scale code — handling 30,000+ merges on peak days and 25M daily CI checkouts, reportedly cutting source-control CPU/memory ~200× and recovering 25% of CI CPU. Source: https://medium.com/@platform-alchemist/anthropic-reinvents-source-control-software-engineering-would-like-a-word-a8667d248e8c
• GitLab made Orbit generally available (Oct 15, Premium/Ultimate on GitLab.com) — a shared lifecycle graph for agents, claiming up to 45× fewer retries and 4.5× fewer tokens. Source: https://forkast.news/gitlab-orbit-shared-lifecycle-graph/
• HashiCorp (IBM) pushed Terraform toward governed, agentic operations — Terraform policy GA, plus Developer Portal, MCP, and Infragraph previews. Source: https://www.hashicorp.com/en/blog/terraform-advances-infrastructure-lifecycle-management-for-the-agentic-era
• GitLab CVE-2026-97229 (CVSS 10.0) — flagged in yesterday's briefing too, and worth repeating because its federal patch deadline was Nov 1, so any unpatched self-managed instance is now overdue. Source: https://tech-insider.org/gitlab-cve-2026-97229-cvss-10-cisa-kev-ruby-patch-2026/

2. Cloud

• Q3 scoreboard: AWS $46B (+39.3%), Azure $33.2B (+48%), Google Cloud $30.7B (+103%). Source: https://tech-insider.org/au/google-cloud-103-percent-azure-aws-q3-2026-australia/
• Amazon kept ~$220B 2026 capex, "meaningfully more" in 2027; AWS at a $184B run rate. Source: https://www.webpronews.com/aws-39-percent-growth-amazon-q3-2026-earnings-capex/
• GPT-6 now on all three clouds; GPT-6.1 Terra GA on Bedrock Oct 26. Source: https://www.stockreport.com/2026/10/22/gpt-6-lands-on-google-cloud-the-cloud-giants-are-the-story/

3. Enterprise technology planning

• ~$1.14T combined AWS+Google backlog — but backlog is not revenue. Source: https://www.kucoin.com/blog/goldman-sachs-divided-on-ai-boom
• GPU FinOps is the top concern: ~$85K/mo AI spend with average GPU utilization at just 5%. Source: https://squareops.com/blog/ai-workload-cloud-cost-management/
• Nov 7–19 deprecation cluster to plan around: OpenSearch, .NET 8/9, Lambda .NET 8, Azure Functions PowerShell, Azure OpenAI o1/o3. Source: https://dev.to/yuryatrashkevich/49-cloud-and-ai-deadlines-before-the-end-of-2026-with-what-to-do-for-each-17mj

LinkedIn DevOps Resources — October 28, 2026

LinkedIn DevOps resources — Wednesday, October 28

Thin day for fresh LinkedIn posts — only one falls inside the last 72 hours, so the rest are dated honestly rather than padded.

Tools & resources

• Emmanuel Oluyemi — 18 free games to learn DevOps, cloud, security, hacking, and AI (Oct 25). Play instead of reading: Linux via SSH puzzle levels, bash/Vim challenges, Git rebase visualized live, and more. Post: https://www.linkedin.com/posts/emmanuel-oluyemi-43588a217_%F0%9D%97%97%F0%9D%97%BC%F0%9D%97%BB%F0%9D%98%81-%F0%9D%97%B9%F0%9D%97%AE%F0%9D%97%BF%F0%9D%97%BB-%F0%9D%97%9F%F0%9D%97%B6%F0%9D%98%82%F0%9D%98%85-%F0%9D%97%B3%F0%9D%97%BF%F0%9D%97%BC%F0%9D%97%BA-activity-7519963455676743680-S5SV
• Mohammad Maaz — GitHub Actions approval-gate CD mini project (Oct 22). Python/Flask/Docker app with a production-grade workflow: environment-scoped secrets, required reviewers on prod, and rolling/blue-green/canary strategies documented. Post: https://www.linkedin.com/posts/mohammad-maaz-805880402_githubactions-kubernetes-docker-activity-7518902805303025664-qbI2

Study materials

• Thennarasu Natesan — RHEL commands cheat sheet for DevOps engineers (Oct 23). Eight categories in one sheet: system info, package management, services, users, files/permissions, disk, networking/firewall, SELinux/processes. Post: https://www.linkedin.com/posts/thennarasu-natesan-8a1a33276_rhel-redhatlinux-linux-activity-7519403683332177920-v6my
• Trupti Kolekar — CI/CD pipeline explained in 5 minutes (Oct 23). Clean explainer with a tool map across the lifecycle: GitHub/GitLab, Gradle/Bazel, Jest/Playwright, Jenkins/Buildkite, Argo CD, Prometheus/Datadog. Post: https://www.linkedin.com/posts/truptikolekar_%F0%9D%90%82%F0%9D%90%88%F0%9D%90%82%F0%9D%90%83-%F0%9D%90%8F%F0%9D%90%A2%F0%9D%90%A9%F0%9D%90%A5%F0%9D%90%A8%F0%9D%90%A9%F0%9D%90%A5%F0%9D%90%9E-%F0%9D%90%84%F0%9D%90%A5%F0%9D%90%A9%F0%9D%90%A5%F0%9D%90%9A%F0%9D%90%A2%F0%9D%90%A7-activity-7519359515574829056-Ladb

Daily DevOps & Cloud Briefing — October 28, 2026

Daily DevOps & Cloud Briefing — Wed, Oct 28, 2026

1. DevOps architecture

• Kubernetes 1.34 reached end of life Oct 27 — upgrade to 1.35+ now. The next hop refuses kubelet on cgroup v1 by default and is the last release supporting containerd 1.x, so plan one-minor-version-at-a-time upgrades. Source: https://dev.to/devstories_fca96eb46af114/kubernetes-in-2026-what-it-is-how-it-works-and-a-production-baseline-you-can-apply-today-28o9
• npm "Miasma" worm escalates supply-chain risk (reported Oct 28). JFrog researchers found it compromised 42 GitHub repos across 11 users since July, hiding 12.9–13.7 MB payloads to evade scanning, hooking dev tools and AI coding assistants (Claude, Gemini, Cursor, VS Code) to steal credentials, alter CI configs, and — if a token is revoked — wipe home-directory data. Audit npm/GitHub tokens and CI hooks. Source: https://www.thaicert.or.th/en/2026/10/28/npm-worm-hides-oversized-payload-to-evade-detection-and-compromise-github-accounts/

2. Cloud

• AWS ECS now supports GPU sharing via NVIDIA MPS (Oct 28). Multiple ECS tasks can run concurrently on one GPU, with per-container GPU memory and optional compute-share caps, on ECS Managed Instances and EC2 — a direct lever for inference and multi-model serving costs, with no code changes. Source: https://aws-news.com/article/2026-10-28-amazon-ecs-now-supports-gpu-sharing-with-nvidia-multi-process-service-mps
• Oracle plans FedRAMP Class D (formerly High) certification for its multicloud AI databases (announced Oct 27, Oracle AI World). It would let regulated workloads run on Exadata infrastructure via Oracle AI Database@AWS, @Azure, and @Google Cloud, inside AWS GovCloud, Azure Government, and Google Cloud Assured Workloads. Source: https://www.morningstar.com/news/pr-newswire/20261027sf81794/oracle-plans-to-expand-multicloud-ai-database-services-to-us-government-and-public-sector-workloads
• AWS Launch Wizard for SAP (Oct 27). The tool automates provisioning for SAP deployments from scale-out and connectivity requirements, cutting manual setup for ERP migrations to AWS. Source: https://wisevoter.com/world/us/2026/10/27/aws-launches-wizard-tool-sap
• Oct 27 provider roundup: Azure Blob storage accounts rise to 1,000 per region per subscription (GA, up from 250); Microsoft Foundry brings Claude model spend into Azure Cost Management (GA); SageMaker MLflow Apps add MLflow 3.16 tracing. The Foundry change matters most for FinOps: Claude charges no longer hide under generic SaaS spend. Source: https://cloud.365fanatic.com/roadmap/

3. Enterprise technology planning

• Big Tech earnings land today and tomorrow — the AI-spend test. Alphabet and Microsoft report after the close today (Oct 28); Amazon follows Oct 29. Watch Azure against its ~45% growth guide, Google Cloud against high expectations, and AWS growth plus capex guidance, against a reported ~$1.7T combined backlog and up to ~$600B planned 2026 spend. Source: https://tech-insider.org/big-tech-earnings-ai-boom-test-1-7-trillion-backlog-600-billion-spend-2026/
• HIVE's BUZZ Alpha Cloud signs a ~$129M, 9% fixed-rate loan (Oct 27) to buy NVIDIA GB200 systems for a sovereign AI deal serving Cohere via Bell Canada. It underscores how GPU capacity is now financed as contracted, project-level infrastructure — a useful benchmark when weighing owned vs. cloud GPU commitments. Source: https://www.unite.ai/buzz-hpc-lands-129m-fixed-rate-credit-facility-for-cohere-gpu-cluster/