clusterctl vulnerabilities (openSUSE)

2 vulnerabilities.

• clusterctl openSUSE OpenTelemetry-Go has an incomplete fix for CVE-2026-24051: BSD kenv command not using absolute path enables PATH hijacking CVE-2026-39883 Fix available 7.3 HighApril 8, 2026
• clusterctl openSUSE gRPC-Go has an authorization bypass via missing leading slash in :path CVE-2026-33186 Public exploitFix available 9.1 CriticalMarch 18, 2026