{"vulnerability": "CVE-2025-1767", "sightings": [{"uuid": "08b6c766-58c0-4197-9eb1-b56c56e8d78c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-1767", "type": "seen", "source": "https://bsky.app/profile/chrisshort.net/post/3lkewby7iur2x", "content": "", "creation_timestamp": "2025-03-15T00:59:08.408406Z"}, {"uuid": "d578492b-96bb-4c17-b876-1dd70dc466f3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-1767", "type": "seen", "source": "https://hachyderm.io/users/ChrisShort/statuses/114163734880254545", "content": "", "creation_timestamp": "2025-03-15T00:59:10.003412Z"}, {"uuid": "4367df07-abe6-49d9-90e7-4e8238e0da20", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-1767", "type": "seen", "source": "https://bsky.app/profile/zigmax.bsky.social/post/3lkezuwaid22k", "content": "", "creation_timestamp": "2025-03-15T02:03:24.745187Z"}, {"uuid": "72d2f956-564b-4ddd-a173-0b9142301fa1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-1767", "type": "seen", "source": "https://bsky.app/profile/kubesploit.io/post/3lseorevbdx23", "content": "", "creation_timestamp": "2025-06-24T18:06:08.117807Z"}, {"uuid": "0e7d5d39-748f-4c85-8e66-90efc5cead06", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-1767", "type": "seen", "source": "https://bsky.app/profile/bluesky.awakari.com/post/3lseouztsbn2n", "content": "", "creation_timestamp": "2025-06-24T18:08:10.203964Z"}, {"uuid": "ce1a685a-7885-453d-9f48-cb1221236a82", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-1767", "type": "seen", "source": "https://bsky.app/profile/kubesploit.io/post/3luq4zs76xt2h", "content": "", "creation_timestamp": "2025-07-24T18:11:04.454217Z"}, {"uuid": "2c20880d-74f7-43ed-8297-53198f6e0183", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-1767", "type": "seen", "source": "https://bsky.app/profile/bluesky.awakari.com/post/3luq5bhbmgh25", "content": "", "creation_timestamp": "2025-07-24T18:15:19.674478Z"}, {"uuid": "3d8fd290-c7dd-4edb-a9b9-9132072c8db5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-1767", "type": "seen", "source": "https://t.me/cvedetector/20243", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2025-1767 - Kubernetes GitRepo Volume Git Repository Cloning Remote Code Execution\", \n  \"Content\": \"CVE ID : CVE-2025-1767 \nPublished : March 13, 2025, 5:15 p.m. | 43\u00a0minutes ago \nDescription : This CVE only affects Kubernetes clusters that utilize the in-tree gitRepo volume to clone git repositories from other pods within the same node. Since the in-tree gitRepo volume feature has been deprecated and will not receive security updates upstream, any cluster still using this feature remains vulnerable. \nSeverity: 6.5 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"13 Mar 2025\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2025-03-13T19:48:21.000000Z"}, {"uuid": "109b6cc3-c553-40f9-b5d9-5ff87ba1630f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-1767", "type": "published-proof-of-concept", "source": "https://t.me/tech_b0lt_Genona/5107", "content": "\u0412 \u043f\u043e\u0441\u0442\u0435 \u043f\u043e\u043a\u0430\u0437\u0430\u043d \u043f\u0440\u0438\u043c\u0435\u0440 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438, \u043e\u043d \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u043f\u0440\u043e\u0441\u0442.\n\nThere\u2019s a new Kubernetes security vulnerability that\u2019s just been disclosed and I thought it was worth taking a look at it, as there\u2019s a couple of interesting aspects to it. CVE-2025-1767 exists in the gitRepo volume type and can allow users who can create pods with gitRepo volumes to get access to any other git repository on the node where the pod is deployed.\n. . .\nPatching & Mitigation\n\nThe patching situation for this vulnerability is interesting. The CVE description says that a patch will not be provided as gitRepo volumes are deprecated, which is true. However, this volume type is enabled by Kubernetes by default and there is no flag or switch that would allow a cluster operator to disable it.\n\nIn practice, if you don\u2019t use gitRepo volumes, you can mitigate this in a couple of ways. If you don\u2019t need git on your nodes you can just remove it there (assuming un-managed Kubernetes of course), and you can also block the use of these volumes using Validating Admission Policy or similar admission controllers.\nCVE-2025-1767 - Another gitrepo issue\nhttps://raesene.github.io/blog/2025/03/14/cve-2025-1767-another-gitrepo-issue/\n\n\u041f\u0440\u0435\u0434\u044b\u0434\u0443\u0449\u0438\u0439 \u043f\u043e\u0441\u0442 \u0438\u0437 \u044d\u0442\u043e\u0439 \u0441\u0435\u0440\u0438\u0438\nFun With GitRepo Volumes\nhttps://raesene.github.io/blog/2024/07/10/Fun-With-GitRepo-Volumes/\n\n\u0421\u043f\u0430\u0441\u0438\u0431\u043e \u043f\u043e\u0434\u043f\u0438\u0441\u0447\u0438\u043a\u0443 \u0437\u0430 \u0441\u0441\u044b\u043b\u043a\u0443", "creation_timestamp": "2025-03-15T16:15:16.000000Z"}, {"uuid": "fdbea82f-8a36-4a2e-9dc8-9dc49b70f59a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-1767", "type": "seen", "source": "https://t.me/proxy_bar/2545", "content": "CVE-2025-1767 Kubernetes \n*\nVulnerability and Exploitation", "creation_timestamp": "2025-03-14T17:53:27.000000Z"}, {"uuid": "eed7d5ce-47b7-4bfe-9540-220582edcc63", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-1767", "type": "seen", "source": "https://gist.github.com/cwayne18/5a965b20d5d77b66faec2e6e18802a48", "content": "cwayne@geeko ~ % vexscan --image docker.io/rancher/helm-controller:v0.17.7 --all --vexhub https://github.com/rancher/vexhub --severity CRITICAL,HIGH,MEDIUM,LOW,UNKNOWN --llm --llm-command \"gh copilot\" --mine-advisories --triage --details\nLLM overlay: asking command gh\nExtracting docker.io/rancher/helm-controller:v0.17.7 (linux/amd64)...\nScanning for Go binaries...\nFound 1 Go binaries.\nResolving advisories for 73 components (73 OSV queries)...\nFound 16 OS packages to check (Alpine:v3.24).\nResolving advisories for 10 components (14 OSV queries)...\nBuilding the shared-library closure...\n  18 ELF objects\n  8 of 18 reachable from 6 roots\nVEX hub https://github.com/rancher/vexhub: 1090 products indexed\nVEX hub https://github.com/rancher/vexhub: 2 finding(s) already covered by a published statement\nTriaging 5 findings against EPSS and CISA KEV (5 CVE ids)\nvexscan report (image) for docker.io/rancher/helm-controller:v0.17.7\n\n  golang   Go                         73 components     5 findings\n  os       Alpine:v3.24               16 components     0 findings\n  affected by severity: 3 unknown\n  3 affected: 1 fixable, 2 with no fix yet\n  already vexed: 1 by Rancher Security team\n  priority: none in CISA's known-exploited catalog, 0 at or above the 90th EPSS percentile, 3 scored\n  priority data: EPSS 2026-08-05, KEV catalog 2026.08.05\n\nAFFECTED (3) - vulnerable code is present and can be loaded\nSEVERITY  ADVISORY      PACKAGE            VERSION  FIXED IN  EPSS   BASIS\nUNKNOWN   GO-2025-3521  k8s.io/kubernetes  v1.35.1  no fix    41.1%\nUNKNOWN   GO-2026-5970  golang.org/x/text  v0.37.0  0.39.0    36.6%\nUNKNOWN   GO-2025-3547  k8s.io/kubernetes  v1.35.1  no fix    22.3%\n\n[LINKED]               k8s.io/kubernetes@v1.35.1\n  cve:      GO-2025-3521\n  from:     golang\n  epss:     41.1% percentile (epss 0.00516) for CVE-2025-1767\n  purl:     pkg:golang/k8s.io%2Fkubernetes@v1.35.1\n  binary:   /usr/bin/helm-controller (stripped)\n  packages: k8s.io/kubernetes (module)\n  detail:   linked\n  llm:      exploitable=unlikely confidence=medium\n            helm-controller merely vendors k8s.io/kubernetes as a library dependency and static analysis shows only linkage, not call-graph reachability; such binaries typically use small subsets (client/apimachinery types) rather than the vulnerable server-side code paths, and GO-2025-3521 class kube vulnerabilities generally require running as an apiserver/kubelet component to be triggered by attacker input.\n\n[LINKED]               golang.org/x/text@v0.37.0\n  cve:      GO-2026-5970\n  from:     golang\n  fixed in: 0.39.0\n  epss:     36.6% percentile (epss 0.00446) for CVE-2026-56852\n  purl:     pkg:golang/golang.org%2Fx%2Ftext@v0.37.0\n  binary:   /usr/bin/helm-controller (stripped)\n  packages: golang.org/x/text/unicode/norm (package)\n  detail:   linked\n  llm:      exploitable=unlikely confidence=medium\n            golang.org/x/text/unicode/norm is a transitive dependency typically pulled in for string normalization; helm-controller is a Kubernetes reconciliation controller unlikely to run Unicode normalization on attacker-controlled input paths, and static linkage alone doesn't establish reachability from network-facing code.\n\n[LINKED]               k8s.io/kubernetes@v1.35.1\n  cve:      GO-2025-3547\n  from:     golang\n  epss:     22.3% percentile (epss 0.00301) for CVE-2024-7598\n  purl:     pkg:golang/k8s.io%2Fkubernetes@v1.35.1\n  binary:   /usr/bin/helm-controller (stripped)\n  packages: k8s.io/kubernetes (module)\n  detail:   linked\n  llm:      exploitable=unlikely confidence=low\n            k8s.io/kubernetes is a large module often pulled in only for API types/client libraries rather than actual server logic, and static analysis shows only linkage (not reachability) in a helm-controller binary, which typically doesn't run the vulnerable kube-apiserver/kubelet code paths; without confirmed call-path reachability or attacker-controlled input to the vulnerable function, real-world exploitability is low.\n\n\nALREADY VEXED (1) - a published statement answers these; vexscan's own verdict is unchanged\nSEVERITY  ADVISORY      PACKAGE           VERSION  FIXED IN  EPSS   VEX STATUS    JUSTIFICATION\nUNKNOWN   GO-2026-5942  golang.org/x/net  v0.55.0  0.56.0    26.4%  not_affected  vulnerable_code_not_present\n\n[LINKED]               golang.org/x/net@v0.55.0\n  cve:      GO-2026-5942\n  from:     golang\n  fixed in: 0.56.0\n  epss:     26.4% percentile (epss 0.00339) for CVE-2026-46600\n  purl:     pkg:golang/golang.org%2Fx%2Fnet@v0.55.0\n  binary:   /usr/bin/helm-controller (stripped)\n  packages: golang.org/x/net/dns/dnsmessage (package)\n  detail:   linked\n  evidence: [vendor-vex] Rancher Security team published not_affected for pkg:golang/github.com/k3s-io/helm-controller (vulnerable_code_not_present);\nstatement names pkg:golang/golang.org/x/net@v0.47.0; component is pkg:golang/golang.org%2Fx%2Fnet@v0.55.0\n  vendor:   Rancher Security team says not_affected (vulnerable_code_not_present)\n            Govulncheck determined that the vulnerable code isn't called\n            product pkg:golang/github.com/k3s-io/helm-controller, published 2026-07-22T03:28:02Z\n            matched loosely: statement names pkg:golang/golang.org/x/net@v0.47.0; component is pkg:golang/golang.org%2Fx%2Fnet@v0.55.0\n  llm:      exploitable=unlikely confidence=medium\n            helm-controller links golang.org/x/net/dns/dnsmessage transitively (e.g. via net/http or Kubernetes client libraries) but does not itself\nperform custom DNS message parsing of attacker-controlled data; typical Go DNS resolution paths rarely trigger the vulnerable code path with untrusted\n input.\n\n\nRULED OUT (1) - the vulnerable code is not present or cannot run\nSEVERITY  ADVISORY      PACKAGE                   VERSION  FIXED IN  EPSS   BASIS\nUNKNOWN   GO-2026-5158  go.opentelemetry.io/otel  v1.41.0  1.44.0    14.7%  pclntab\n\n[NOT PRESENT]          go.opentelemetry.io/otel@v1.41.0\n  cve:      GO-2026-5158\n  from:     golang\n  fixed in: 1.44.0\n  epss:     14.7% percentile (epss 0.00237) for CVE-2026-41178\n  purl:     pkg:golang/go.opentelemetry.io%2Fotel@v1.41.0\n  binary:   /usr/bin/helm-controller (stripped)\n  packages: go.opentelemetry.io/otel/baggage, go.opentelemetry.io/otel/propagation (package)\n  vex:      vulnerable_code_not_present [pclntab]\n  evidence: [vendor-vex] Rancher Security team published not_affected for pkg:golang/github.com/k3s-io/helm-controller (vulnerable_code_not_present);\nstatement names pkg:golang/go.opentelemetry.io/otel@v1.41.0; component is pkg:golang/go.opentelemetry.io%2Fotel@v1.41.0\n  vendor:   Rancher Security team says not_affected (vulnerable_code_not_present)\n            Govulncheck determined that the vulnerable code isn't called\n            product pkg:golang/github.com/k3s-io/helm-controller, published 2026-07-25T03:31:58Z\n            matched loosely: statement names pkg:golang/go.opentelemetry.io/otel@v1.41.0; component is pkg:golang/go.opentelemetry.io%2Fotel@v1.41.0\n\n\n  golang   Go                         73 components     5 findings\n  os       Alpine:v3.24               16 components     0 findings\n  affected by severity: 3 unknown\n  3 affected: 1 fixable, 2 with no fix yet\n  already vexed: 1 by Rancher Security team\n  priority: none in CISA's known-exploited catalog, 0 at or above the 90th EPSS percentile, 3 scored\n  priority data: EPSS 2026-08-05, KEV catalog 2026.08.05\n  5 findings in 3 section(s): AFFECTED (3), ALREADY VEXED (1), RULED OUT (1)", "creation_timestamp": "2026-08-05T22:37:18.569272Z"}, {"uuid": "2b2f3cea-2fc2-4c1b-993b-e0ef84cf9573", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-1767", "type": "seen", "source": "https://gist.github.com/cwayne18/5a965b20d5d77b66faec2e6e18802a48", "content": "cwayne@geeko ~ % vexscan --image docker.io/rancher/helm-controller:v0.17.7 --all --vexhub https://github.com/rancher/vexhub --severity CRITICAL,HIGH,MEDIUM,LOW,UNKNOWN --llm --llm-command \"gh copilot\" --mine-advisories --triage --details\nLLM overlay: asking command gh\nExtracting docker.io/rancher/helm-controller:v0.17.7 (linux/amd64)...\nScanning for Go binaries...\nFound 1 Go binaries.\nResolving advisories for 73 components (73 OSV queries)...\nFound 16 OS packages to check (Alpine:v3.24).\nResolving advisories for 10 components (14 OSV queries)...\nBuilding the shared-library closure...\n  18 ELF objects\n  8 of 18 reachable from 6 roots\nVEX hub https://github.com/rancher/vexhub: 1090 products indexed\nVEX hub https://github.com/rancher/vexhub: 2 finding(s) already covered by a published statement\nTriaging 5 findings against EPSS and CISA KEV (5 CVE ids)\nvexscan report (image) for docker.io/rancher/helm-controller:v0.17.7\n\n  golang   Go                         73 components     5 findings\n  os       Alpine:v3.24               16 components     0 findings\n  affected by severity: 3 unknown\n  3 affected: 1 fixable, 2 with no fix yet\n  already vexed: 1 by Rancher Security team\n  priority: none in CISA's known-exploited catalog, 0 at or above the 90th EPSS percentile, 3 scored\n  priority data: EPSS 2026-08-05, KEV catalog 2026.08.05\n\nAFFECTED (3) - vulnerable code is present and can be loaded\nSEVERITY  ADVISORY      PACKAGE            VERSION  FIXED IN  EPSS   BASIS\nUNKNOWN   GO-2025-3521  k8s.io/kubernetes  v1.35.1  no fix    41.1%\nUNKNOWN   GO-2026-5970  golang.org/x/text  v0.37.0  0.39.0    36.6%\nUNKNOWN   GO-2025-3547  k8s.io/kubernetes  v1.35.1  no fix    22.3%\n\n[LINKED]               k8s.io/kubernetes@v1.35.1\n  cve:      GO-2025-3521\n  from:     golang\n  epss:     41.1% percentile (epss 0.00516) for CVE-2025-1767\n  purl:     pkg:golang/k8s.io%2Fkubernetes@v1.35.1\n  binary:   /usr/bin/helm-controller (stripped)\n  packages: k8s.io/kubernetes (module)\n  detail:   linked\n  llm:      exploitable=unlikely confidence=medium\n            helm-controller merely vendors k8s.io/kubernetes as a library dependency and static analysis shows only linkage, not call-graph reachability; such binaries typically use small subsets (client/apimachinery types) rather than the vulnerable server-side code paths, and GO-2025-3521 class kube vulnerabilities generally require running as an apiserver/kubelet component to be triggered by attacker input.\n\n[LINKED]               golang.org/x/text@v0.37.0\n  cve:      GO-2026-5970\n  from:     golang\n  fixed in: 0.39.0\n  epss:     36.6% percentile (epss 0.00446) for CVE-2026-56852\n  purl:     pkg:golang/golang.org%2Fx%2Ftext@v0.37.0\n  binary:   /usr/bin/helm-controller (stripped)\n  packages: golang.org/x/text/unicode/norm (package)\n  detail:   linked\n  llm:      exploitable=unlikely confidence=medium\n            golang.org/x/text/unicode/norm is a transitive dependency typically pulled in for string normalization; helm-controller is a Kubernetes reconciliation controller unlikely to run Unicode normalization on attacker-controlled input paths, and static linkage alone doesn't establish reachability from network-facing code.\n\n[LINKED]               k8s.io/kubernetes@v1.35.1\n  cve:      GO-2025-3547\n  from:     golang\n  epss:     22.3% percentile (epss 0.00301) for CVE-2024-7598\n  purl:     pkg:golang/k8s.io%2Fkubernetes@v1.35.1\n  binary:   /usr/bin/helm-controller (stripped)\n  packages: k8s.io/kubernetes (module)\n  detail:   linked\n  llm:      exploitable=unlikely confidence=low\n            k8s.io/kubernetes is a large module often pulled in only for API types/client libraries rather than actual server logic, and static analysis shows only linkage (not reachability) in a helm-controller binary, which typically doesn't run the vulnerable kube-apiserver/kubelet code paths; without confirmed call-path reachability or attacker-controlled input to the vulnerable function, real-world exploitability is low.\n\n\nALREADY VEXED (1) - a published statement answers these; vexscan's own verdict is unchanged\nSEVERITY  ADVISORY      PACKAGE           VERSION  FIXED IN  EPSS   VEX STATUS    JUSTIFICATION\nUNKNOWN   GO-2026-5942  golang.org/x/net  v0.55.0  0.56.0    26.4%  not_affected  vulnerable_code_not_present\n\n[LINKED]               golang.org/x/net@v0.55.0\n  cve:      GO-2026-5942\n  from:     golang\n  fixed in: 0.56.0\n  epss:     26.4% percentile (epss 0.00339) for CVE-2026-46600\n  purl:     pkg:golang/golang.org%2Fx%2Fnet@v0.55.0\n  binary:   /usr/bin/helm-controller (stripped)\n  packages: golang.org/x/net/dns/dnsmessage (package)\n  detail:   linked\n  evidence: [vendor-vex] Rancher Security team published not_affected for pkg:golang/github.com/k3s-io/helm-controller (vulnerable_code_not_present);\nstatement names pkg:golang/golang.org/x/net@v0.47.0; component is pkg:golang/golang.org%2Fx%2Fnet@v0.55.0\n  vendor:   Rancher Security team says not_affected (vulnerable_code_not_present)\n            Govulncheck determined that the vulnerable code isn't called\n            product pkg:golang/github.com/k3s-io/helm-controller, published 2026-07-22T03:28:02Z\n            matched loosely: statement names pkg:golang/golang.org/x/net@v0.47.0; component is pkg:golang/golang.org%2Fx%2Fnet@v0.55.0\n  llm:      exploitable=unlikely confidence=medium\n            helm-controller links golang.org/x/net/dns/dnsmessage transitively (e.g. via net/http or Kubernetes client libraries) but does not itself\nperform custom DNS message parsing of attacker-controlled data; typical Go DNS resolution paths rarely trigger the vulnerable code path with untrusted\n input.\n\n\nRULED OUT (1) - the vulnerable code is not present or cannot run\nSEVERITY  ADVISORY      PACKAGE                   VERSION  FIXED IN  EPSS   BASIS\nUNKNOWN   GO-2026-5158  go.opentelemetry.io/otel  v1.41.0  1.44.0    14.7%  pclntab\n\n[NOT PRESENT]          go.opentelemetry.io/otel@v1.41.0\n  cve:      GO-2026-5158\n  from:     golang\n  fixed in: 1.44.0\n  epss:     14.7% percentile (epss 0.00237) for CVE-2026-41178\n  purl:     pkg:golang/go.opentelemetry.io%2Fotel@v1.41.0\n  binary:   /usr/bin/helm-controller (stripped)\n  packages: go.opentelemetry.io/otel/baggage, go.opentelemetry.io/otel/propagation (package)\n  vex:      vulnerable_code_not_present [pclntab]\n  evidence: [vendor-vex] Rancher Security team published not_affected for pkg:golang/github.com/k3s-io/helm-controller (vulnerable_code_not_present);\nstatement names pkg:golang/go.opentelemetry.io/otel@v1.41.0; component is pkg:golang/go.opentelemetry.io%2Fotel@v1.41.0\n  vendor:   Rancher Security team says not_affected (vulnerable_code_not_present)\n            Govulncheck determined that the vulnerable code isn't called\n            product pkg:golang/github.com/k3s-io/helm-controller, published 2026-07-25T03:31:58Z\n            matched loosely: statement names pkg:golang/go.opentelemetry.io/otel@v1.41.0; component is pkg:golang/go.opentelemetry.io%2Fotel@v1.41.0\n\n\n  golang   Go                         73 components     5 findings\n  os       Alpine:v3.24               16 components     0 findings\n  affected by severity: 3 unknown\n  3 affected: 1 fixable, 2 with no fix yet\n  already vexed: 1 by Rancher Security team\n  priority: none in CISA's known-exploited catalog, 0 at or above the 90th EPSS percentile, 3 scored\n  priority data: EPSS 2026-08-05, KEV catalog 2026.08.05\n  5 findings in 3 section(s): AFFECTED (3), ALREADY VEXED (1), RULED OUT (1)", "creation_timestamp": "2026-08-06T00:00:18.137148Z"}, {"uuid": "3182c8d1-9595-4669-a1c4-8401aefa3f1b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-1767", "type": "seen", "source": "https://t.me/EchelonEyes/3742", "content": "\u041e\u043f\u0430\u0441\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Kubernetes: \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043c\u043e\u0433\u0443\u0442 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0447\u0443\u0436\u0438\u043c \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f\u043c Git \n\n\u041d\u0430 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0435 Kubernetes \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2025-1767, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 \u043d\u0430 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u0435 \u043f\u043e\u0434\u043e\u0432 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0442\u043e\u043c\u0430 gitRepo \u0434\u043b\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u044b\u043c \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f\u043c Git \u0434\u0440\u0443\u0433\u0438\u0445 \u043f\u043e\u0434\u043e\u0432 \u043d\u0430 \u0442\u043e\u043c \u0436\u0435 \u0443\u0437\u043b\u0435. \u0423\u0440\u043e\u0432\u0435\u043d\u044c \u0443\u0433\u0440\u043e\u0437\u044b \u043e\u0446\u0435\u043d\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u043a\u0430\u043a \u0441\u0440\u0435\u0434\u043d\u0438\u0439 (\u043e\u0446\u0435\u043d\u043a\u0430 CVSS 6.5). \n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u044b Kubernetes, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0435 \u0443\u0441\u0442\u0430\u0440\u0435\u0432\u0448\u0438\u0435 \u0442\u043e\u043c\u0430 in-tree gitRepo \u0434\u043b\u044f \u043a\u043b\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0435\u0432 Git \u0438\u0437 \u0434\u0440\u0443\u0433\u0438\u0445 \u043f\u043e\u0434\u043e\u0432 \u043d\u0430 \u0442\u043e\u043c \u0436\u0435 \u0443\u0437\u043b\u0435. \u041f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u044d\u0442\u0430 \u0444\u0443\u043d\u043a\u0446\u0438\u044f \u0441\u0447\u0438\u0442\u0430\u0435\u0442\u0441\u044f \u0443\u0441\u0442\u0430\u0440\u0435\u0432\u0448\u0435\u0439 \u0438 \u0431\u043e\u043b\u044c\u0448\u0435 \u043d\u0435 \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u0442 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u0432\u0441\u0435 \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u044b, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0435 \u0435\u0451, \u043e\u0441\u0442\u0430\u044e\u0442\u0441\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u043c\u0438.\n\n\u0414\u043b\u044f \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440 init \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u043c\u0430\u043d\u0434\u044b git clone \u0441 \u043f\u043e\u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u043c \u043c\u043e\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0434\u0438\u0440\u0435\u043a\u0442\u043e\u0440\u0438\u0438 \u0432 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440 \u0432 \u043f\u043e\u0434\u0435. \u0422\u0430\u043a\u0436\u0435 \u043c\u043e\u0436\u043d\u043e \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0442\u043e\u043c\u0430 gitRepo \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u043f\u043e\u043b\u0438\u0442\u0438\u043a, \u0442\u0430\u043a\u0438\u0445 \u043a\u0430\u043a ValidatingAdmissionPolicy \u0438\u043b\u0438 Restricted pod security standard.\n\n\u0427\u0442\u043e\u0431\u044b \u043f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c, \u0431\u044b\u043b\u0430 \u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0430, \u043c\u043e\u0436\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u043c\u0430\u043d\u0434\u0443 \u0434\u043b\u044f \u043f\u043e\u0438\u0441\u043a\u0430 \u043f\u043e\u0434\u043e\u0432, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0445 \u0442\u043e\u043c in-tree gitRepo. \n\n\u0411\u0443\u0434\u044c\u0442\u0435 \u0431\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u044b \u0438 \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u0435 \u0441\u0432\u043e\u0438 \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u044b!\n\n#\u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \n\n\u0418\u0441\u0442\u043e\u0447\u043d\u0438\u043a: https://github.com/kubernetes/kubernetes/issues/130786", "creation_timestamp": "2026-07-26T02:00:31.742424Z"}, {"uuid": "d1b101c4-50de-4a0f-b4c9-964259ae713a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-1767", "type": "seen", "source": "https://t.me/EchelonEyes/3742", "content": "\u041e\u043f\u0430\u0441\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Kubernetes: \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043c\u043e\u0433\u0443\u0442 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0447\u0443\u0436\u0438\u043c \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f\u043c Git \n\n\u041d\u0430 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0435 Kubernetes \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2025-1767, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 \u043d\u0430 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u0435 \u043f\u043e\u0434\u043e\u0432 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0442\u043e\u043c\u0430 gitRepo \u0434\u043b\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u044b\u043c \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f\u043c Git \u0434\u0440\u0443\u0433\u0438\u0445 \u043f\u043e\u0434\u043e\u0432 \u043d\u0430 \u0442\u043e\u043c \u0436\u0435 \u0443\u0437\u043b\u0435. \u0423\u0440\u043e\u0432\u0435\u043d\u044c \u0443\u0433\u0440\u043e\u0437\u044b \u043e\u0446\u0435\u043d\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u043a\u0430\u043a \u0441\u0440\u0435\u0434\u043d\u0438\u0439 (\u043e\u0446\u0435\u043d\u043a\u0430 CVSS 6.5). \n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u044b Kubernetes, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0435 \u0443\u0441\u0442\u0430\u0440\u0435\u0432\u0448\u0438\u0435 \u0442\u043e\u043c\u0430 in-tree gitRepo \u0434\u043b\u044f \u043a\u043b\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0435\u0432 Git \u0438\u0437 \u0434\u0440\u0443\u0433\u0438\u0445 \u043f\u043e\u0434\u043e\u0432 \u043d\u0430 \u0442\u043e\u043c \u0436\u0435 \u0443\u0437\u043b\u0435. \u041f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u044d\u0442\u0430 \u0444\u0443\u043d\u043a\u0446\u0438\u044f \u0441\u0447\u0438\u0442\u0430\u0435\u0442\u0441\u044f \u0443\u0441\u0442\u0430\u0440\u0435\u0432\u0448\u0435\u0439 \u0438 \u0431\u043e\u043b\u044c\u0448\u0435 \u043d\u0435 \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u0442 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u0432\u0441\u0435 \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u044b, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0435 \u0435\u0451, \u043e\u0441\u0442\u0430\u044e\u0442\u0441\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u043c\u0438.\n\n\u0414\u043b\u044f \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440 init \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u043c\u0430\u043d\u0434\u044b git clone \u0441 \u043f\u043e\u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u043c \u043c\u043e\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0434\u0438\u0440\u0435\u043a\u0442\u043e\u0440\u0438\u0438 \u0432 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440 \u0432 \u043f\u043e\u0434\u0435. \u0422\u0430\u043a\u0436\u0435 \u043c\u043e\u0436\u043d\u043e \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0442\u043e\u043c\u0430 gitRepo \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u043f\u043e\u043b\u0438\u0442\u0438\u043a, \u0442\u0430\u043a\u0438\u0445 \u043a\u0430\u043a ValidatingAdmissionPolicy \u0438\u043b\u0438 Restricted pod security standard.\n\n\u0427\u0442\u043e\u0431\u044b \u043f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c, \u0431\u044b\u043b\u0430 \u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0430, \u043c\u043e\u0436\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u043c\u0430\u043d\u0434\u0443 \u0434\u043b\u044f \u043f\u043e\u0438\u0441\u043a\u0430 \u043f\u043e\u0434\u043e\u0432, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0445 \u0442\u043e\u043c in-tree gitRepo. \n\n\u0411\u0443\u0434\u044c\u0442\u0435 \u0431\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u044b \u0438 \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u0435 \u0441\u0432\u043e\u0438 \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u044b!\n\n#\u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \n\n\u0418\u0441\u0442\u043e\u0447\u043d\u0438\u043a: https://github.com/kubernetes/kubernetes/issues/130786", "creation_timestamp": "2026-07-27T00:00:37.446369Z"}, {"uuid": "a83ffc87-a9e7-47d7-bde4-1be7d6dbb40b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-1767", "type": "published-proof-of-concept", "source": "https://t.me/EchelonEyes/3742", "content": "\u041e\u043f\u0430\u0441\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Kubernetes: \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043c\u043e\u0433\u0443\u0442 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0447\u0443\u0436\u0438\u043c \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f\u043c Git \n\n\u041d\u0430 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0435 Kubernetes \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2025-1767, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 \u043d\u0430 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u0435 \u043f\u043e\u0434\u043e\u0432 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0442\u043e\u043c\u0430 gitRepo \u0434\u043b\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u044b\u043c \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f\u043c Git \u0434\u0440\u0443\u0433\u0438\u0445 \u043f\u043e\u0434\u043e\u0432 \u043d\u0430 \u0442\u043e\u043c \u0436\u0435 \u0443\u0437\u043b\u0435. \u0423\u0440\u043e\u0432\u0435\u043d\u044c \u0443\u0433\u0440\u043e\u0437\u044b \u043e\u0446\u0435\u043d\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u043a\u0430\u043a \u0441\u0440\u0435\u0434\u043d\u0438\u0439 (\u043e\u0446\u0435\u043d\u043a\u0430 CVSS 6.5). \n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u044b Kubernetes, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0435 \u0443\u0441\u0442\u0430\u0440\u0435\u0432\u0448\u0438\u0435 \u0442\u043e\u043c\u0430 in-tree gitRepo \u0434\u043b\u044f \u043a\u043b\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0435\u0432 Git \u0438\u0437 \u0434\u0440\u0443\u0433\u0438\u0445 \u043f\u043e\u0434\u043e\u0432 \u043d\u0430 \u0442\u043e\u043c \u0436\u0435 \u0443\u0437\u043b\u0435. \u041f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u044d\u0442\u0430 \u0444\u0443\u043d\u043a\u0446\u0438\u044f \u0441\u0447\u0438\u0442\u0430\u0435\u0442\u0441\u044f \u0443\u0441\u0442\u0430\u0440\u0435\u0432\u0448\u0435\u0439 \u0438 \u0431\u043e\u043b\u044c\u0448\u0435 \u043d\u0435 \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u0442 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u0432\u0441\u0435 \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u044b, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0435 \u0435\u0451, \u043e\u0441\u0442\u0430\u044e\u0442\u0441\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u043c\u0438.\n\n\u0414\u043b\u044f \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440 init \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u043c\u0430\u043d\u0434\u044b git clone \u0441 \u043f\u043e\u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u043c \u043c\u043e\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0434\u0438\u0440\u0435\u043a\u0442\u043e\u0440\u0438\u0438 \u0432 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440 \u0432 \u043f\u043e\u0434\u0435. \u0422\u0430\u043a\u0436\u0435 \u043c\u043e\u0436\u043d\u043e \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0442\u043e\u043c\u0430 gitRepo \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u043f\u043e\u043b\u0438\u0442\u0438\u043a, \u0442\u0430\u043a\u0438\u0445 \u043a\u0430\u043a ValidatingAdmissionPolicy \u0438\u043b\u0438 Restricted pod security standard.\n\n\u0427\u0442\u043e\u0431\u044b \u043f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c, \u0431\u044b\u043b\u0430 \u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0430, \u043c\u043e\u0436\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u043c\u0430\u043d\u0434\u0443 \u0434\u043b\u044f \u043f\u043e\u0438\u0441\u043a\u0430 \u043f\u043e\u0434\u043e\u0432, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0445 \u0442\u043e\u043c in-tree gitRepo. \n\n\u0411\u0443\u0434\u044c\u0442\u0435 \u0431\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u044b \u0438 \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u0435 \u0441\u0432\u043e\u0438 \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u044b!\n\n#\u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \n\n\u0418\u0441\u0442\u043e\u0447\u043d\u0438\u043a: https://github.com/kubernetes/kubernetes/issues/130786", "creation_timestamp": "2026-07-28T00:00:52.417764Z"}]}