Security | PFCP https://pfcomputing.com/en/categories/security/ Security en-us Thu, 23 Jul 2026 13:00:00 +0900 [Notice] Mitigation for GhostLock (CVE-2026-43499) Completed https://pfcomputing.com/en/news/20260723/ Thu, 23 Jul 2026 13:00:00 +0900 https://pfcomputing.com/en/news/20260723/ A local privilege escalation vulnerability in the Linux kernel, GhostLock (CVE-2026-43499), has been disclosed.

To address this vulnerability, PFCP completed emergency maintenance on July 23, 2026, during which we updated the Linux kernel on the host operating system of PFCP-managed Kubernetes nodes.

Mitigation

The Linux kernel on the host operating system (Ubuntu 24.04 LTS) of PFCP-managed Kubernetes nodes has been updated to 6.8.0-136.136, which addresses GhostLock (CVE-2026-43499).

Completion Time

July 23, 2026, 12:00 JST

Customer Action Required

No action is required from PFCP users.

For details of the maintenance associated with this update, please refer to the following announcement.

References

PFCP is committed to providing timely security updates so that our users can continue to use our services with confidence.

]]> [Report] Authentication Misconfiguration Fix https://pfcomputing.com/en/news/20260512-2/ Tue, 12 May 2026 17:00:00 +0900 https://pfcomputing.com/en/news/20260512-2/ A misconfiguration was found in part of the authentication settings for PFCP’s Kubernetes clusters.

Under certain conditions, HTTP access through PFCP’s Identity-Aware Proxy could have allowed access to Pods in namespaces that the user was not authorized to access.

In response, the ExternalName Service feature used in the affected access path has been disabled, and the related authentication settings have been reviewed. This issue has been resolved.

Mitigation:

  • Disabled ExternalName Service.
  • Reviewed related authentication settings.

Completion Date:

May 12, 2026

User Impact:

No action is required from users. You can continue using the service as usual.

PFCP remains committed to maintaining and improving security so that users can use the service with confidence.

]]> [Report] Initial Mitigation Completed for Linux Kernel Vulnerability https://pfcomputing.com/en/news/20260508/ Fri, 08 May 2026 11:50:00 +0900 https://pfcomputing.com/en/news/20260508/ A high-severity vulnerability was reported in the Linux kernel. PFCP has disabled the vulnerable feature in its Kubernetes clusters, completing the initial mitigation.

Mitigation:

Disabled the vulnerable feature.

Completion Time:

May 8, 2026, 12:00 JST

User Impact:

No action is required from users. You can continue using the service as usual.

Vulnerability Details:

No CVE has been assigned, but please refer to the following information.

PFCP is committed to providing prompt security updates so that users can use the service with confidence.

]]> [Report] Initial Mitigation Completed for Linux Kernel Vulnerability https://pfcomputing.com/en/news/20260430/ Thu, 30 Apr 2026 15:00:00 +0900 https://pfcomputing.com/en/news/20260430/ A high-severity vulnerability was reported in the Linux kernel. PFCP has disabled the vulnerable feature in its Kubernetes clusters, completing the initial mitigation.

Mitigation:

Disabled the vulnerable feature.

Completion Date:

April 30, 2026

User Impact:

No action is required from users. You can continue using the service as usual.

Vulnerability Details:

PFCP is committed to providing prompt security updates so that users can use the service with confidence.

]]> [Important] Emergency Security Response and Re-Login Request Following Compromise of Python Package "litellm" https://pfcomputing.com/en/news/20260325/ Wed, 25 Mar 2026 16:00:00 +0900 https://pfcomputing.com/en/news/20260325/ The Python package “litellm” was found to be compromised, with malicious code embedded that steals credentials.

This is an extremely serious incident: the malicious code can execute simply by having the package installed. To ensure the security of the entire cluster, PFCP has taken emergency security measures.

We apologize for the inconvenience. Please review the following information and take the necessary action (re-login) as described below.

Security measures taken:

  • Action: Forced reset of kubectl credentials (tokens)
  • Time: March 25, 2026, 13:00 JST

As a result of this action, all existing credentials have been invalidated. You will need to re-login before using kubectl going forward.

Impact:

  • All existing kubectl credentials have been invalidated.
  • Authentication errors will occur when running kubectl commands.
  • Running workloads are not affected.

How to re-login:

Please follow the steps in the documentation below to log in again.

https://docs.pfcomputing.com/cluster/connect-to-cluster.html

Background (overview of the litellm compromise):

Versions 1.82.7 and 1.82.8 of “litellm” contained code that exfiltrated sensitive information—including environment variables and Kubernetes configuration (~/.kube/config)—to an external server.

The malicious code executes simply by starting a Python process. Because Kubernetes tokens may have been stolen without your knowledge, PFCP performed a cluster-wide reset.

Action requested of users:

  1. Immediately check whether the affected version is installed in your PFCP execution environment and on your local PC.
    • Check command: pip list | grep litellm
  2. Treat all secrets (SSH keys, cloud service API keys, etc.) accessible from any environment where this package was installed as potentially compromised, and revoke and reissue them.

Detailed information (GitHub Issue):

https://github.com/BerriAI/litellm/issues/24512

We apologize for the inconvenience and appreciate your understanding and cooperation as we take these necessary steps to maintain security.

]]> [Report] Mitigation complete for ingress-nginx vulnerabilities https://pfcomputing.com/en/news/20260204/ Wed, 04 Feb 2026 09:00:00 +0900 https://pfcomputing.com/en/news/20260204/ Four vulnerabilities, including high-severity issues, were reported in ingress-nginx, the open-source software used for workload publishing. PFCP has completed mitigation by upgrading Kubernetes clusters to a fixed version.

Mitigation Details:

ingress-nginx version upgrade (v1.14.3)

Mitigation Completion Date:

2026/02/04

User Impact:

No action is required on the user side. You can continue using the service as usual.

Vulnerability Details:

PFCP will continue to provide timely security updates so users can use our services with confidence.

]]> [Report] Mitigation complete for runc vulnerabilities https://pfcomputing.com/en/news/20251105/ Wed, 05 Nov 2025 19:00:00 +0900 https://pfcomputing.com/en/news/20251105/ Three high-severity vulnerabilities were reported in the container runtime runc. PFCP has already upgraded all Kubernetes clusters to a fixed version.

For details on the vulnerabilities, please refer to the links below.

]]>