CWE-250 Execution with Unnecessary Privileges

OpenShift Builder has a path traversal, allows command injection in privileged BuildContainer

Fission runtime pods automount the fission-fetcher service-account token into the user function container, granting function code namespace-wide secret / configmap read

Daytona: Path traversal in sandbox volume id mounts arbitrary host paths into the sandbox — cross-tenant data access and host escape

Fission: Environment Runtime.Container and Builder.Container SecurityContext bypass allows privileged pod creation

Fission builder pods auto-mount the fission-builder ServiceAccount token in the user-supplied builder container

actual Allows Electron to Run As Node

IPAM controller service account granted unnecessary full access to Secrets

Fission builder accepts arbitrary buildcmd strings from Environment.spec.builder.command, allowing the builder pod to invoke arbitrary executables

Dask Distributed is Vulnerable to Remote Code Execution via Jupyter Proxy and Dashboard

CloudNativePG's metrics exporter allows privilege escalation to PostgreSQL superuser and OS RCE

OpenLearnX has Critical Remote Code Execution Through Python Sandbox Escape via Code Execution Environment

OpenC3 COSMOS: Permissions Bypass Provides User Access to Unassigned Administrative Actions via Script Runner Tool

Submariner Operator sets unnecessary RBAC permissions

OliveTin's RestartAction always runs actions as guest

OpenClaw has multiple E2E/test Dockerfiles that run all processes as root

theshit's Improper Privilege Dropping Allows Local Privilege Escalation via Command Re-execution

OpenClaw: Docker container escape via unvalidated bind mount config injection

Skipper is vulnerable to arbitrary code execution through lua filters

Neuron MySQLWriteTool allows arbitrary/destructive SQL when exposed to untrusted prompts (agent “footgun”)

Apache Airflow's create action can upsert existing Pools/Connections/Variables

Apache Airflow `/api/v2/dagReports` executes DAG Python in API

open-webui Insecure Direct Object Reference (IDOR) vulnerability

XWiki Blog Application: Privilege Escalation (PR) from account through blog content

Argo Events users can gain privileged access to the host system and cluster with EventSource and Sensor CR

Harden-Runner allows evasion of 'disable-sudo' policy