// LIVE

INTELCritical Citrix NetScaler memory flaw actively exploited in attacks

INTELTelnyx joins LiteLLM in latest PyPI package poisoning tied to Trivy breach

INTELStorm Brews Over Critical, No-Click Telegram Flaw

INTELFTC Action Against Match and OkCupid for Deceiving Users, Sharing Personal Data

INTELTeamPCP Supply Chain Campaign: Update 004 - Databricks Investigating Alleged Com

INTELHealthcare IT Platform CareCloud Probing Potential Data Breach

INTELSecurity updates for Monday

INTEL'When intelligence and trust move together, AI stops being an experiment and sta

INTELRussian APT Star Blizzard Adopts DarkSword iOS Exploit Kit

INTELDisclosure of Replay Attack Vulnerability in Signed References

INTELHackers now exploit critical F5 BIG-IP flaw in attacks, patch now

INTELTelnyx Targeted in Growing TeamPCP Supply Chain Attack

CVE(Pwn2Own) Canon imageCLASS MF654Cdw TTF Parsing Out-Of-Bounds Write Remote Code

CVEZDI-26-204: Canon imageCLASS MF654Cdw XPS Parser Vulnerability

CVEZDI-26-202: QNAP TS-453E Hyper Data Protector Plugin SQL Injection RCE Vulnerabi

INTELCritical Citrix NetScaler memory flaw actively exploited in attacks

INTELTelnyx joins LiteLLM in latest PyPI package poisoning tied to Trivy breach

INTELStorm Brews Over Critical, No-Click Telegram Flaw

INTELFTC Action Against Match and OkCupid for Deceiving Users, Sharing Personal Data

INTELTeamPCP Supply Chain Campaign: Update 004 - Databricks Investigating Alleged Com

INTELHealthcare IT Platform CareCloud Probing Potential Data Breach

INTELSecurity updates for Monday

INTEL'When intelligence and trust move together, AI stops being an experiment and sta

INTELRussian APT Star Blizzard Adopts DarkSword iOS Exploit Kit

INTELDisclosure of Replay Attack Vulnerability in Signed References

INTELHackers now exploit critical F5 BIG-IP flaw in attacks, patch now

INTELTelnyx Targeted in Growing TeamPCP Supply Chain Attack

CVE(Pwn2Own) Canon imageCLASS MF654Cdw TTF Parsing Out-Of-Bounds Write Remote Code

CVEZDI-26-204: Canon imageCLASS MF654Cdw XPS Parser Vulnerability

CVEZDI-26-202: QNAP TS-453E Hyper Data Protector Plugin SQL Injection RCE Vulnerabi

OPS INTEL SOURCE: Kubernetes Blog · 2026-03-19

Kubernetes v1.35 Enhances Security with Exec Plugin Allowlist

— min read

·

GENERATED BY aria-32b

·

VIA Kubernetes Blog

#kubernetes-v1-35 #security-updates #credential-plugin-policy

◎

ARIA ANALYSIS aria-32b · 2026-03-19

Kubernetes v1.35 adds a beta feature allowing users to restrict executable plugins used in kubeconfig files for enhanced security.

TL;DR

Kubernetes v1.35 adds a beta feature allowing users to restrict executable plugins used in kubeconfig files for enhanced security.

What happened

['SIG-Auth and SIG-CLI introduced the credential plugin policy and allowlist as a beta feature in Kubernetes 1.35.', 'The new security feature restricts which credential plugins kubectl is allowed to execute based on user-defined policies.', 'Users can configure this through the kuberc file or directly via the client-go library.']

Why it matters for ops

['Kubernetes allows downloading or auto-generating kubeconfigs that specify executables for fetching credentials, posing a risk of running malicious code.', 'The new feature aims to mitigate these risks by giving users control over allowed credential plugins and their paths.']

Mitigation

Configure kubectl with a restrictive policy through the new allowlist feature.
Verify paths and names of allowed plugins meticulously to prevent unauthorized access.

Action items

Review existing kubeconfig files for potential security risks.
Implement strict credential plugin policies in production environments.

Detection IOCs

credentialPluginPolicy set to DenyAll or Allowlist in kuberc configuration
errors related to unauthorized credential plugin execution

Source link

https://kubernetes.io/blog/2026/01/09/kubernetes-v1-35-kuberc-credential-plugin-allowlist/

// SOURCES

Kubernetes Blog — Original article ↗