7 New DevOps CVEs to Patch — Published Dates, Fixes, and Deadlines (Nov 6, 2026)

This morning's DevOps CVE watch turned up 7 new vulnerabilities worth patching. Every date below was checked live against the U.S. National Vulnerability Database (NVD) and CISA's Known Exploited Vulnerabilities (KEV) catalog on November 6, 2026.

One thing to know first: none of these seven has an official fix deadline. A hard "must fix by" date only exists when CISA adds a CVE to its KEV catalog, and none of these seven are on it. Each entry gives the NVD published date, the fix version, and a recommended fix window based on severity — that window is guidance, not a mandate.

1. Keycloak — CVE-2026-117691 — CRITICAL 9.1

SAML login signature bypass via percent-encoded parameter names — full account takeover of federated users, no authentication needed.

• Published: Nov 5, 2026, 9:17 AM ET
• Affected: Keycloak before 26.8.2 (SAML over HTTP-Redirect realms; OIDC-only realms not exposed)
• Fix: 26.8.2
• Recommended fix window: within 24–72 hours
• Sources: NVD · Keycloak 26.8.2 release notes

2. Kyverno — CVE-2026-122302 through CVE-2026-122323 — max CRITICAL 9.4

Twenty CVEs covering namespace-isolation bypasses, privilege escalation, and admission-webhook denial of service in namespaced policies. The worst ones (9.4) let a namespace tenant read or write other namespaces' Secrets or take over the cluster.

• Published: Nov 4, 2026, 10:17 PM ET
• Affected: Kyverno before 1.19.2
• Fix: 1.19.2 (same release that fixes the 9.9 CVE-2026-122310 reported Nov 5)
• Recommended fix window: within 24–72 hours
• Sources: NVD · Kyverno security advisory

3. Kubeflow Pipelines — CVE-2026-88980, CVE-2026-88981 — HIGH 8.6

Frontend artifact-download and pod-log paths accept attacker-controlled endpoints, enabling server-side request forgery.

• Published: Nov 5, 2026, 6:17 PM ET
• Affected: Kubeflow Pipelines before 2.18.0
• Fix: 2.18.0 (same release that fixes the 9.6 CVE-2026-77596 reported Nov 5)
• Recommended fix window: within 1 week
• Sources: NVD · Kubeflow security advisory

4. GPUStack — CVE-2026-103002 — HIGH 8.8

The cluster API proxy forwards a non-admin's requests without a resource-level authorization check, using a worker's Kubernetes ServiceAccount credentials.

• Published: Nov 4, 2026, 5:17 PM ET
• Affected: GPUStack 2.2.0–2.2.1
• Fix: 2.2.2
• Recommended fix window: within 1 week
• Sources: NVD

5. Grafana — CVE-2026-33379 — HIGH 8.5

Any role, including Viewer or a permissionless service account, can create, externally publish, and delete dashboard snapshots.

• Published: Nov 6, 2026, 5:16 AM ET
• Affected: Grafana OSS/Enterprise 12.4 only
• Fix: unconfirmed — Grafana has not published an advisory yet
• Recommended fix window: within 1 week once the fix lands
• Sources: NVD

6. undici (Node.js HTTP client) — CVE-2026-116592 — HIGH 7.4

A redirect through an untrusted origin can poison the shared cache or serve one user's private response to another.

• Published: Nov 6, 2026, 5:16 AM ET
• Affected: undici 7.30.1 and 8.12.2–8.12.3 (originless Agent + shared cache + redirect/cache interceptors)
• Fix: 7.30.2 / 8.12.4
• Recommended fix window: within 2 weeks
• Sources: NVD · undici security advisory

7. IntelliJ IDEA — CVE-2026-123293 — HIGH 7.8

Code execution in untrusted projects via the Terraform tool-path setting.

• Published: Nov 6, 2026, 6:17 AM ET
• Affected: IntelliJ IDEA before 2026.3 / 2026.2.4
• Fix: 2026.3 / 2026.2.4
• Recommended fix window: within 2 weeks
• Sources: NVD

What to patch first

Keycloak first — unauthenticated account takeover — then Kyverno if you run it. The only hard deadline in play right now is Brotli's: federal agencies must patch CVE-2026-111497 (Node2Shell) by November 10, 2026.

Sources: U.S. National Vulnerability Database (NVD), CISA Known Exploited Vulnerabilities catalog, and the vendors' own security advisories linked above. Published dates are NVD publication times, shown in U.S. Eastern Time. Recommended fix windows are severity-based guidance, not vendor or government mandates.