Skip to content
OpenAdvisories

Package · Go

github.com/open-feature/open-feature-operator

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • Medium 4.3
    CVE-2026-54495

    Cross-namespace FeatureFlagSource and InProcessConfiguration resolution exposes spec contents on multi-tenant clusters

    The OpenFeature Operator allows users to expose feature flags to applications. In version 0.9.2 and earlier, a tenant who can create a controller-owned workload can use the openfeature.dev/featureflagsource annotation with NAMESPACE/NAME syntax to reference a…

    open-feature open-feature-operator github.com/open-feature/open-feature-operator Go
  • High 8.1
    CVE-2023-29018

    OpenFeature Operator vulnerable to Cluster-level Privilege Escalation

    The OpenFeature Operator allows users to expose feature flags to applications. Assuming the pre-existence of a vulnerability that allows for arbitrary code execution, an attacker could leverage the lax permissions configured on `open-feature-operator-controll…

    open-feature open-feature-operator github.com/open-feature/open-feature-operator Go