{"id":"CVE-2022-2385","aliases":["EUVD-2022-6388","GHSA-pp3f-98qg-5g75","GO-2022-0547","SUSE-SU-2022:2583-1","SUSE-SU-2026:2643-1"],"status":"published","title":"AccessKeyID validation bypass","description":"A security issue was discovered in aws-iam-authenticator where an allow-listed IAM identity may be able to modify their username and escalate privileges.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.01101,"percentile":0.65902,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2022-07-12T14:25:10Z","modified":"2026-10-28T02:30:31Z","fixes":[{"ecosystem":"Go","package":"sigs.k8s.io/aws-iam-authenticator","fixed_in":["0.5.9"],"sources":["ghsa","osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15","package":"aws-iam-authenticator","fixed_in":["0.5.3-150000.1.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP1","package":"aws-iam-authenticator","fixed_in":["0.5.3-150000.1.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP2","package":"aws-iam-authenticator","fixed_in":["0.5.3-150000.1.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP3","package":"aws-iam-authenticator","fixed_in":["0.5.3-150000.1.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"aws-iam-authenticator","fixed_in":["0.5.3-150000.1.9.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"aws-iam-authenticator","fixed_in":["0.5.3-150000.1.9.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"aws-iam-authenticator","fixed_in":["0.5.3-150000.1.9.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"sigs.k8s.io/aws-iam-authenticator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.9"}]}]},{"source":"osv","ecosystem":"Go","package":"sigs.k8s.io/aws-iam-authenticator","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.5.9"}]}]},{"source":"osv","ecosystem":"Go","package":"sigs.k8s.io/aws-iam-authenticator","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.5.9"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15","package":"aws-iam-authenticator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.3-150000.1.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP1","package":"aws-iam-authenticator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.3-150000.1.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP2","package":"aws-iam-authenticator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.3-150000.1.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP3","package":"aws-iam-authenticator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.3-150000.1.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"aws-iam-authenticator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.3-150000.1.9.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"aws-iam-authenticator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.3-150000.1.9.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"aws-iam-authenticator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.3-150000.1.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"aws-iam-authenticator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.18-150000.1.17.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"aws-iam-authenticator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.18-150000.1.17.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP6","package":"aws-iam-authenticator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.18-150000.1.17.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP7","package":"aws-iam-authenticator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.18-150000.1.17.1"}]}],"bundled":6}],"products":[{"vendor":"kubernetes","product":"aws-iam-authenticator"}],"references":[{"url":"https://github.com/kubernetes-sigs/aws-iam-authenticator/issues/472","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory","report","web"]},{"url":"https://groups.google.com/a/kubernetes.io/g/dev/c/EMxHpU-1ZYs","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Mailing List","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-2385","tags":["advisory"]},{"url":"https://github.com/kubernetes-sigs/aws-iam-authenticator/pull/469","tags":["web"]},{"url":"https://github.com/kubernetes-sigs/aws-iam-authenticator/releases/tag/v0.5.9","tags":["web"]},{"url":"https://github.com/kubernetes-sigs/aws-iam-authenticator/commit/029d1dcf2ec8d662d9b1c21260bb197404bc8218","tags":["web"]},{"url":"https://github.com/advisories/GHSA-pp3f-98qg-5g75","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/2xxx/CVE-2022-2385.json","tags":["advisory"]},{"url":"https://github.com/kubernetes-sigs/aws-iam-authenticator","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20222583-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1201395","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-2385","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262643-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1200528","tags":["report"]},{"url":"https://bugzilla.suse.com/1227519","tags":["report"]},{"url":"https://bugzilla.suse.com/1239947","tags":["report"]},{"url":"https://bugzilla.suse.com/1249141","tags":["report"]},{"url":"https://bugzilla.suse.com/1265842","tags":["report"]},{"url":"https://bugzilla.suse.com/1266651","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-1996","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-39689","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47910","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33814","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39821","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2022-2385","title":"AccessKeyID validation bypass","description":"A security issue was discovered in aws-iam-authenticator where an allow-listed IAM identity may be able to modify their username and escalate privileges.","status":"published","published":"2022-07-12T14:25:10.421Z","modified":"2024-09-16T22:25:39.286Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:34:32.495407Z"}],"euvd":[{"id":"EUVD-2022-6388","description":"A security issue was discovered in aws-iam-authenticator where an allow-listed IAM identity may be able to modify their username and escalate privileges.","status":"published","published":"2022-07-12T14:25:10Z","modified":"2024-09-16T22:25:39Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-03T00:55:02.946444Z"}],"ghsa":[{"id":"GHSA-pp3f-98qg-5g75","title":"aws-iam-authenticator allow-listed IAM identity may be able to modify their username, escalate privileges before v0.5.9","description":"A security issue was discovered in aws-iam-authenticator where an allow-listed IAM identity may be able to modify their username and escalate privileges.","status":"published","published":"2022-07-13T00:00:41Z","modified":"2023-04-13T18:21:09Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:36:50.476488Z"}],"nvd":[{"id":"CVE-2022-2385","description":"A security issue was discovered in aws-iam-authenticator where an allow-listed IAM identity may be able to modify their username and escalate privileges.","status":"published","published":"2022-07-12T19:15:08.487Z","modified":"2026-06-17T04:41:48.023Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6,"vector":"AV:N/AC:M/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:07:23.322724Z"}],"osv":[{"id":"CVE-2022-2385","title":"AccessKeyID validation bypass","description":"A security issue was discovered in aws-iam-authenticator where an allow-listed IAM identity may be able to modify their username and escalate privileges.","status":"published","published":"2022-07-12T14:25:10.421Z","modified":"2026-10-28T02:30:31.012019398Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:44:24.428403Z"},{"id":"GHSA-pp3f-98qg-5g75","title":"aws-iam-authenticator allow-listed IAM identity may be able to modify their username, escalate privileges before v0.5.9","description":"A security issue was discovered in aws-iam-authenticator where an allow-listed IAM identity may be able to modify their username and escalate privileges.","status":"published","published":"2022-07-13T00:00:41Z","modified":"2024-08-21T15:42:04.700985Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:46:53.244788Z"},{"id":"GO-2022-0547","title":"aws-iam-authenticator allow-listed IAM identity may be able to modify their username, escalate privileges before v0.5.9 in sigs.k8s.io/aws-iam-authenticator","description":"aws-iam-authenticator allow-listed IAM identity may be able to modify their username, escalate privileges before v0.5.9 in sigs.k8s.io/aws-iam-authenticator","status":"published","published":"2024-08-21T15:11:36Z","modified":"2026-03-03T04:50:36.338552Z","updated_at":"2026-11-02T15:47:00.918515Z"},{"id":"SUSE-SU-2022:2583-1","title":"Security update for aws-iam-authenticator","description":"This update for aws-iam-authenticator fixes the following issues:\n\n- CVE-2022-2385: Fixed AccessKeyID validation bypass (bsc#1201395).\n","status":"published","published":"2022-07-29T08:42:22Z","modified":"2026-02-04T03:29:13.653612Z","updated_at":"2026-11-02T15:53:50.965375Z"},{"id":"SUSE-SU-2026:2643-1","title":"Security update for aws-iam-authenticator","description":"This update for aws-iam-authenticator fixes the following issues\n\n- CVE-2022-1996: CORS bypass (bsc#1200528).\n- CVE-2022-2385: aws-iam-authenticator AccessKeyID validation bypass (bsc#1201395).\n- CVE-2024-39689: remove root certificates from `GLOBALTRUST` from the root store.\n- CVE-2025-47910: net/http: CrossOriginProtection bypass patterns are over-broad.\n- CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE\n  (bsc#1265842).\n- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation\n  bypass and privilege escalation (bsc#1266651).\n\nChanges for aws-iam-authenticator:\n\n- Update to version 0.7.18\n * Merge pull request (#1062) from CaidenBorrego/new-release\n * Creating new release for CVE mitigation\n * Merge pull request (#1057) from CaidenBorrego/caidenb-versionbump\n * Merge remote-tracking branch 'upstream/master' into caidenb-versionbump\n * Bump x/net and x/sys to remediate CVEs (bsc#1266651, CVE-2026-39821)\n- Update to 0.7.17\n * Merge pull request #1051 from CaidenBorrego/caidenb-versionbump\n * bumping version from 0.7.16-\u003e0.7.17\n * Merge pull request #1047 from CaidenBorrego/caidenb-reservedprefix-fix\n * fix: honor reservedPrefixConfig for ConfigMap and CRD backends\n * Merge pull request #1046 from CaidenBorrego/caidenb-gorunner-bump\n * fix: reject malformed mapping ARN in userIDStrict mode for dynamic files\n- Update to 0.7.16\n * Merge pull request #1041 from ronaldngounou/rngounou/bump-go-1.26.3\n * Pin GitHub Actions to full-length commit SHAs\n * fix: bump go version to 1.26.3 for CVEs\n- from version 0.7.15\n * Merge pull request #1035 from Ganiredi/bump-version-0.7.15\n * Bump version to 0.7.15\n * Merge pull request #1030 from Ganiredi/1.36-k8s-deps\n * 1.36.0 dependency update\n- from version 0.7.14\n * Merge pull request #1029 from CaidenBorrego/caidenb-gorunner-bump\n * Bump version to 0.7.14\n * Bumping gorunner image tag in Dockerfile for CVE mitigation\n- from version 0.7.13\n * Merge pull request #1020 from dheeraj-coding/master\n * feat: add manual dispatch function for create-release.yml\n * Merge pull request #1019 from dheeraj-coding/master\n * fix: create-release workflow failures\n * Merge pull request #1017 from Ganiredi/1.36-k8s-deps\n * Merge pull request #1018 from dheeraj-coding/master\n * fix: build failure due to stale gcb image by updating to latest\n * Release 0.7.13\n * Merge pull request #1016 from Ganiredi/1.36-k8s-deps\n * Merge branch 'master' into 1.36-k8s-deps\n * Merge pull request #1013 from kubernetes-sigs/dependabot/go_modules/misc-dependencies-be00ae3611\n * 1.36.rc release\n * Merge pull request #1015 from dheeraj-coding/master\n * fix: bump go version 1.26.2 for CVEs\n * chore(deps): Bump the misc-dependencies group across 3 directories with 6 updates\n (bsc#1265842, CVE-2026-33814)\n * Merge pull request #1011 from kubernetes-sigs/dependabot/go_modules/observability-dependencies-9e34dd3c34\n * Merge pull request #1009 from kubernetes-sigs/dependabot/go_modules/misc-dependencies-b5e1eeb2d5\n * Merge pull request #1004 from bryantbiggs/chore/fix-goreleaser-deprecations\n * Merge pull request #1010 from kubernetes-sigs/dependabot/go_modules/aws-dependencies-7118f1d525\n * chore(deps): Bump the observability-dependencies group across 2 directories with 2 updates\n * chore(deps): Bump the aws-dependencies group across 2 directories with 6 updates\n * chore(deps): Bump the misc-dependencies group across 3 directories with 2 updates\n * Merge pull request #1008 from kubernetes-sigs/dependabot/go_modules/aws-dependencies-3ce7b5fcac\n * chore(deps): Bump the aws-dependencies group across 2 directories with 12 updates\n * Merge pull request #1006 from kubernetes-sigs/dependabot/go_modules/k8s-dependencies-09346e948b\n * chore(deps): Bump the k8s-dependencies group across 3 directories with 8 updates\n * Merge pull request #1005 from kubernetes-sigs/dependabot/go_modules/aws-dependencies-508cd0fd8e\n * chore(deps): Bump the aws-dependencies group across 2 directories with 15 updates\n * fix: update Makefile goreleaser target for v2 compatibility\n * fix: resolve goreleaser v2 deprecations\n- Update to version 0.7.12\n * Update OWNERS in reviewers and approvers list\n * Release 0.7.12\n * ci: add verify job to catch unrun gofmt and go mod tidy\n * chore(lint): harden linter config and fix coverage gaps\n * fix(lint): add revive and unparam linters with full compliance\n * ci: add unit test job, expand golangci config, add make update/verify\n * docs(e2e): fix Go version, remove non-existent make target, fix typo\n * docs(release): remove stale ECR image update instructions and fix asset version placeholders\n * fix: address code review findings in repo cleanup branch\n * docs: rewrite development.md as a practical local dev guide\n * chore: repo cleanup, developer experience improvements\n * chore: reduce binary size by 59% (80 MB -\u003e 33 MB)\n * fix(lint): replace deprecated NewSimpleClientset and fix embedded field selector\n * fix(tests): address code review findings in integration test framework\n * fix(tests): address post-refactor issues and add go workspace\n * refactor(tests): remove k8s.io/kubernetes dependency from test modules\n * chore: update all dependencies to latest versions\n- Set GOWORK=off to make building with vendored dependencies work\n- Update to version 0.7.11\n * Merge pull request #988 from dstdfx/bump-version\n * Bump version to 0.7.11\n * Merge pull request #985 from dstdfx/bump-go-version-1.25.7\n * Update go.mod for e2e/int tests\n * Update go.mod\n * Merge pull request #986 from ShiriNmi1520/master\n * Clarify README 'Run the server' deployment instructions\n * Bump go to 1.25.7\n * Merge pull request #983 from eks-distro-pr-bot/eks-distro-pr-bot/go-version-bumps\n * Creating PR to update Go version to 1.25.6\n- Update to version 0.7.10:\n * 1.35.0 dependency update\n * Creating PR to update Go version to 1.25.5\n * chore(deps): Bump the observability-dependencies group across 2 directories with 1 update\n * chore(deps): Bump the misc-dependencies group across 3 directories with 13 updates\n * chore(deps): Bump the observability-dependencies group across 1 directory with 2 updates\n * chore(deps): Bump the misc-dependencies group across 3 directories with 27 updates\n * chore(deps): Bump the aws-dependencies group across 2 directories with 11 updates\n * chore(deps): Bump the misc-dependencies group across 2 directories with 17 updates\n- Update to version 0.7.9\n * Creating PR to update Go version to 1.25.4\n * chore(deps): Bump the aws-dependencies group across 2 directories with 13 updates\n * chore(deps): Bump golangci/golangci-lint-action in the actions group\n * chore(deps): Bump the observability-dependencies group across 3 directories with 2 updates\n * chore(deps): Bump sigs.k8s.io/apiserver-network-proxy/konnectivity-client\n * chore(deps): Bump the aws-dependencies group across 2 directories with 14 updates\n * bump golang version to 1.25.3\n * Creating PR to update Go version to 1.25.3\n * chore(deps): Bump github.com/onsi/ginkgo/v2\n * chore(deps): Bump the observability-dependencies group across 3 directories with 1 update\n * chore(deps): Bump the misc-dependencies group across 3 directories with 11 updates\n * chore(deps): Bump the misc-dependencies group across 3 directories with 5 updates\n * chore(deps): Bump the aws-dependencies group across 2 directories with 3 updates\n- Update to version 0.7.8\n * chore: Bump indirect Kubernetes dependencies to latest\n * chore: Bump Kubernetes dependencies to latest\n * Bump the misc-dependencies group across 3 directories with 18 updates\n * Bump the aws-dependencies group across 2 directories with 11 updates\n * Fix CVE-2025-47910\n * Bump go.opentelemetry.io/auto/sdk\n * Bump the aws-dependencies group across 2 directories with 1 update\n * Bump the misc-dependencies group across 3 directories with 10 updates\n- from version 0.7.7\n * add support for aws-eusc partition\n * chore: Commit changes from `make codegen`\n * fix: Use `.go-version` for the go version\n * feat: Add `golanglint-ci` pull request review; resolve all findings\n * Add haoranleo as approver\n * Bump the observability-dependencies group across 3 directories with 3 updates\n * Bump actions/setup-go from 5 to 6 in the actions group\n * Bump the misc-dependencies group across 3 directories with 8 updates\n * Bump github.com/coreos/go-oidc\n * Bump the observability-dependencies group across 3 directories with 12 updates\n- from version 0.7.6\n * feat: Update go version to `1.25`; update dependencies to latest\n to patch reported vulnerabilities\n * Force TCP URLs for etcd compatibility\n * Update go dependencies with 1.34.0\n * Bump the k8s-dependencies group across 3 directories with 8 updates\n * Bump the k8s-dependencies group across 3 directories with 1 update\n * Bump actions/checkout from 4 to 5 in the actions group\n * Bump the aws-dependencies group across 2 directories with 13 updates\n- from version 0.7.5\n * migrate hostname verification to sdk go v2\n- from version 0.7.4\n * chore: Move observability dependencies to separate dependabot update group\n * Bump the aws-dependencies group across 2 directories with 12 updates\n- from version 0.7.3\n * update Approvers/reviewers\n * update go version to 1.24.4\n * added logs for global region fallback\n * added global region fallback to imds\n * Bump sigs.k8s.io/apiserver-network-proxy/konnectivity-client\n * bumps kops and k8s versions, replaced node label 'master' with 'control-plane'\n * added imds logic back in, with EC2_METADATA enabled by default\n * removed headersourceacct from ststest, return err if no region cfg\n * added context chaining, cleanup\n * add context chaining, client config fixes\n * Move non problematic cache logs into debug\n * Rename log-level to log-verbosity, remove AutomaticEnv\n * lint fixes\n * get region from imds if not in config\n * added go.sum entries for tests/integration, fixed imds nil pointer dereference\n * Revert 'Bump sigs.k8s.io/apiserver-network-proxy/konnectivity-client'\n * added some context chaining, fixed region config in GetWithOptions\n * updated arn, deleted v1-v2 creds converter\n * updated pkg/token to v2\n * updated pkg/filecache\n * updated arn in pkg/server to use v2\n * updated pkg/server to use v2\n * upgraded ec2provider\n * Bump the misc-dependencies group across 3 directories with 5 updates\n * Bump the misc-dependencies group across 3 directories with 6 updates\n * Bump the misc-dependencies group across 3 directories with 9 updates\n * Use logrus for filecache logs\n * Add quiet mode (cache only)\n- from version 0.7.2\n * Bump the misc-dependencies group across 3 directories with 43 updates\n * Bump the k8s-dependencies group across 3 directories with 2 updates\n- from version 0.7.1\n * Revert 'Add 2 more tag validation checks'\n * Update the gorunner to v0.18.0-eks-1-32-latest\n * update the go version to 1.24.2\n * adding yue9944882 to owner\n * adds http2 support\n * Bump the aws-dependencies group across 2 directories with 3 updates\n * Update configmap.go\n * release authenticator from mainline with 0.7.0\n * Bump goreleaser/goreleaser-action from 5 to 6 in the actions group\n * Bump the misc-dependencies group across 3 directories with 41 updates\n * Remove no-op err assignment\n * Fix credential expirability check\n * chore: Update golan x package transitive dependencies\n * fix: Correct codgen script due to deprecated script removal\n * Update configmap test per 1.32.0 change in client-go\n * Update upstream dependencies to v1.32.0\n * chore: Update to go `1.23.4`\n * deps: Update `golang.org/x/crypto` library to remediate high CVE\n * chore: Add dependabot configuration to automatically check for package updates weekly\n * handle scenario when the file is created but doesn't have content\n * update code and add tests\n * remove nnmin-aws from approver list\n * add kmala to the owners list\n * update metrics dimention to stsregion\n * add default timeout for http client\n * log sts host instead of global/regional\n * update log\n * remove typo and log line\n * remove typo\n * Bump test go versions\n * add logs and metrics dimentions to find sts call success/failures on global/regional endpoints\n * Bump go minor version\n * Update aws-iam-authenticator installation command\n * use protobuf content type instead of json for k8s client\n * Update RELEASE.md\n * Bump go-restful in e2e and integration tests\n * Bump go-restful\n * Remove outdated changelog artifacts\n * Bump deploy/example.yaml version\n * Update filecache to use AWS SDK Go V2 with wrappers\n * Refactored token filecache\n * Fix x-amz-expires header value\n * Remove parameterized AWS session from token.go\n * Parse source account from sourceARN\n * Add sourceArn to sts through headers\n * Add configurable Now time for signature generation\n * cleanup to use composite literals\n * update to sig.k8s.io namespace\n * retain original field\n * update the image to latest to fix CVE-2024-39689\n * add a namespaced field\n * Update upstream dependencies to v1.31.0\n * update the go version to 1.22.5\n * Add unit test\n * skip service validation to get the default regions endpoint\n * fix: Run `go mod tidy` to fix `go.sum` files\n * fix: Update goreleaser workflow to fix warnings and artifact generation\n * update aws go sdk to 1.54.6\n * chore: Remove emeritus reviewers from `SECURITY_CONTACTS`\n * fix: Add random string to e2e test role to avoid pipeline run conflicts\n * fix: Run `go mod tidy` from `tests/integration` directory\n * chore: Update CLI dependencies `cobra` and `viper`\n * updating google.golang.org/grpc/otelgrpc to v0.47.0\n * chore: Update CI action versions, remove `push` trigger\n * chore: Align go versions and remove unused files\n * updating k8s client libraries and go version\n * adding new approvers - nnmin-aws\n * Bump go version to 1.21.8\n * Bump github.com/golang/protobuf v1.5.4, google.golang.org/protobuf v1.33.0\n * chore: Re-update to latest patch version of K8s packages\n * fix time formatting\n * refactor structs for dynamic file load\n * add support for adoption rate metrics for cam\n * add support for e2e latency for dynamic mode\n * Switch to GOTOOLCHAIN env setting from gimme\n * Switch back to use go-version from go-image-tag\n * Switch to use go-image-tag from go-version\n * Repo controlled build go version\n * chore: Re-update and align\n * fix semantic error\n * feat: Re-update K8s packages to latest release\n * fix: Use `SIGDescribe`\n * fix: Use `framework.WithDisruptive()`\n * fix: [Disruptive] in plain text is deprecated and must be added through WithDisruptive instead\n * chore: Update dependencies for `e2e` tests\n * fix: Add context to `StartTestServer`\n * fix: Align integration test `replace` versions in `go.mod`\n * fix: Fix codegen and update `replace` test integration dependencies\n * fix: Integration test dependencies run `go mod tidy`\n * fix: Downgrade `k8s.io/sample-controller` which requires updating context handling\n * chore: Update app K8s dependencies\n * adding nnmin-aws into reviewers\n * Replace deprecated `ioutil` package\n * fix base image to use latest\n * minor fix the IAM user arn verification\n * Fix role ARN comparison for user ID strict check (#669)\n * Check ARN for user ID strict check (#660)\n * Update go to 1.21.5\n * Change s3 bucket for e2e tests, current default exists somewhere (#652)\n- Bump minimum Go version to 1.25 in BuildRequires\n- Update to version 0.6.31\n- from version 0.6.30\n * Small fixes missed during cherrypicking\n * Cherry-picked file changes from commit\n https://github.com/kubernetes-sigs/aws-iam-authenticator/pull/554/commits\n * Simplify featuregate flag parsing for SSORoleMatch\n * Support un-canonicalized ARNs in filemapper\n * Add SSO Role suffix support (#416)\n * Chore: Update golang x package transitive dependencies\n- Add -buildmode=pie to go build command line (bsc#1239947)\n- Update to version 0.6.29\n- from version 0.6.28\n * Update owners list to sync master branch\n * Lpdate log\n * Add logs and metrics dimentions to find sts call\n success/failures on global/regional endpoints\n * Return 429 for STS throttling\n- Update to 0.6.27\n- from version 0.6.26\n- from version 0.6.25\n- from version 0.6.24\n * Update the image to latest to fix CVE-2024-3968\n- from version 0.6.23\n- Update to version 0.6.22\n- Update to version 0.6.21\n- from version 0.6.20\n * Merge pull request #713 from jaidevmane/updating-otelgrpc-to-v0.51.0\n * Merge pull request #709 from bryantbiggs/chore/update-ci-versions\n * Merge pull request #708 from jaidevmane/updating-deps\n * Merge pull request #707 from jaidevmane/adding-new-approvers\n * Merge pull request #687 from bryantbiggs/chore/update-app-k8s-dependencies\n- from version 0.6.19\n * Bump github.com/golang/protobuf v1.5.4,\n google.golang.org/protobuf v1.33.0\n- from version 0.6.18\n- from version 0.6.17\n * Fix base image to use latest and release v0.6.17\n- from version 0.6.16\n- from version 0.6.15\n * Fix role ARN comparison for user ID strict check (#669) (#671)\n- Bump minimum Go version to 1.22 in BuildRequires\n- Update to version 0.6.14\n * Check ARN for user ID strict check (#660) (#664)\n * Update go to 1.21.5 (#663)\n * Update go to 1.21.4 (#648) (#659)\n- Update to version 0.6.13\n * Cherry-pick: Fix federated user ID parsing #644 (#654)\n * Fix issue 606: use latest version of aws-sdk-go (#650)\n * Change s3 bucket for e2e tests, current default exists somewhere (#653)\n- from version 0.6.12\n * Avoid parsing single quote empty inputs\n * Avoid parsing known empty inputs\n- Update to version 0.6.11\n * Optimize only rebuild mapper when the actual backend modes change\n * Add int test for dynamic backend mode\n * Add DynamicBackendMode\n * Allow running create release from Github UI\n- Update to version 0.6.10\n * Update go.sum\n * Only replace x/net\n * Add build-all-images make target\n * Enable cross-compilation in Dockerfile\n- from version 0.6.9\n * Add DynamicFileError Metric\n- from version 0.6.8\n * Add comments explicitly on what we need to do later\n * Shutdown gracefully and avoid the extra thread\n leak checks that EtcdMain barfs on\n * Switch to newer ginkgo v2\n * Bump dependencies and go version (in go.mod) (bsc#1200528, CVE-2022-1996)\n- from version 0.6.7\n * (no changes)\n- from version 0.6.6\n * Add Username Prefix Enforce for DynamicFile mode\n- from version 0.6.5\n * Update the aws sdk go version to latest\n * Update base image in Docker file\n- from version 0.6.4\n * Loop up RoleMapping with UserId in dynamocfile mode\n * Install kind if it doesn't exist to _output\n * Update server_test for expose principal ID in audit log\n * Expose Principal Id to audit log\n * Migrate away from google.com gcp project k8s-testimages\n * Build s390x/ppc64le binaries\n * Add default instance region in sts hostname\n- from version 0.6.3\n * Bump aws sdk go to v1.44.145\n * Update Dockerfile to pull from https://gallery.ecr.aws/ \\\n eks-distro-build-tooling/golang to avoid reaching pull\n rate limit from docker.io\n * Add go mod for E2E\n * Add install kind into e2e script\n * Move e2e test from start dev script + minor fix for run.sh\n * Add end to end test for mountfile mode in kind Update Makefile\n to support run e2e from either kind or kops.\n * Add end to end test for dynamicfile backend\n- Update to version 0.6.2\n * Add automatic release creation\n * Add tag workflow to release-0.6 branch\n * Remove dependency from PR #416\n * Revert 'Add SSO Role suffix support (#416)\n- from version 0.6.1\n * Test release tagging\n * Fix file permissions\n * Tag release on update to version.txt\n * Update Dockerfile to pull from\n https://gallery.ecr.aws/eks-distro-build-tooling/golang\n to avoid reaching pull rate limit from docker.io\n * Added Issue and PR templates (#517)\n * Update Dockerfile to use Golang as builder\n- from version 0.6.0\n * Print CommitID too on startup\n * Print version on startup\n * Add new backend mode DYNAMICFILE\n * Update go.mod and go.sum for tests/integrations\n * Replace tabs with spaces in go.mod\n * Bump aws sdk go to v1.44.107\n * Minor fix on the script to solve permission\n denied issue when run make start-dev\n * Working E2E tests in prow\n * Non-blocking E2E tests\n * Add e2e recipe to Makefile\n * Basic E2E testing for authenticator\n * Initialize metrics in NewVerifier() if needed\n * Added ConfiguredInitDirectories featuregate for init command\n * rm more v1alpha1 version\n * Bump 0.6 (#471)\n * Bump version in Makefile\n * Add query parameter validation for multiple parameters\n * Replace deprecated seccomp annotation with seccompProfile.\n * Replace deprecated critical pod annotation with priorityClassName.\n * Whitespace consistency fixes.\n * Use rbac.authorization.k8s.io/v1 instead of v1beta1 in example manifest.\n * Lowercase the ARN keys\n * Remove vendor directory\n * linux/amd64 only for image target\n * Don't push on image target\n- from version 0.5.16\n * Shutdown gracefully and avoid the extra thread leak\n checks that EtcdMain barfs on\n * Bump dependencies and go version (in go.mod)\n- from version 0.5.15\n- from version 0.5.14\n- from version 0.5.13\n- from version 0.5.12\n * Fix Makefile on branch release-0.5 (#520)\n * rm more v1alpha1 version (#516)\n- from version 0.5.11\n * Add end to end test for mountfile mode in kind Update\n Makefile to support run e2e from either kind or kops.\n- Update to version 0.5.10\n * Automated cherry pick of #491: Bump aws sdk go to v1.44.107 (#493)\n * Remove vendor from release-0.5 (#498)\n- Update to version 0.5.9\n * Add query parameter validation for multiple parameters (#469)\n (bsc#1201395, CVE-2022-2385)\n- from version 0.5.8\n * Revert use of upstream yaml parsing (#455)\n- from version 0.5.7\n * Remove duplicate InitMetrics by @jngo2 in (#448)\n + Fixes a crash when executing authenticator in server mode\n- from version 0.5.6\n * Bump AWS SDK to v1.43.28 (#445)\n * Use the apiversion from KUBERNETES_EXEC_INFO (#439)\n * Bump promptui module to v0.9.0 (#437)\n- from version 0.5.5\n * Use full package name for goreleaser version (#433)\n * Add sts error metric (#430)\n * Emit metric for EC2 describeInstance calls (#428)\n * Rename configmap_watch_failures to configmap_watch_failures_total (#432)\n * Simplify goreleaser Dockerfiles (#431)\n * Don't pass metrics around (#423)\n- from version 0.5.4\n * Embed go-runner into the image (#426)\n * Bump Go to 1.17 in Travis (#414)\n * Build multi-arch images (#417)\n * Add kind-based development environment (#422\n * Add jaypipes to approvers/reviewers (#407\n * Fix deps (#396\n * Fix panic when cache file can't be Stat-ed (#410\n * Fix missing status definition in v1 CRD (#411)\n * Use ./hack/install-etcd.sh (#405\n * Run integration tests with per-test role (#402\n * Add a counter for API server watch failures (#400)\n * Upgrade CRD manifest to v1 (#397\n * Move inactives to emeritus_approvers and add active users (#399)\n * Fix tests add vendor (#398)\n * Integration test framework (#395)\n * Add cloudbuild \u0026 improvements (#394)\n * Fix typo (#390)\n * Add user/role subcommands (#381)\n * goreleaser: bump release to 0.164.0 and fix config deprecations (#371)\n * Run go mod vendor (#388)\n * doc: fix typo in RELEASE.md (#376)\n * [pkg/token]: Update credential API version (#386)\n * Enrich Audit Logs with additional AWS Identity details\n (via audit logs' 'extra' map) (#372)\n- Enable vendoring for Go module dependencies\n","status":"published","published":"2026-06-26T08:35:05Z","modified":"2026-06-27T08:45:05.148057969Z","updated_at":"2026-11-02T15:54:04.519245Z"}]}}