Detections
Analytics

Chainguard: kubeflow-centraldashboard: security update to 2.0.0-r8

medium Tenable Cloud Security Plugin ID 478124

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior
 to 1.4.1, the forge.http client stored cookie names and paths from Set-Cookie response headers in ordinary
 JavaScript objects. A malicious server could use the cookie name __proto__ so that the attacker-controlled
 cookie path was written as a property on Object.prototype, or use inherited names such as constructor to
 modify Object. An empty cookie value could use the removal path to delete an inherited Object.prototype
 property. Applications using forge.http directly or through forge.xhr are affected; applications that do
 not use forge.http are unaffected. This issue is fixed in version 1.4.1. (CVE-2026-118777)

Solution

Update the kubeflow-centraldashboard library and its related packages to version 2.0.0-r8 or later.

Plugin Details

Severity: Medium

ID: 478124

Version: Revision 1.1

Type: Local

Published: 10/31/2026

Updated: 10/31/2026

Risk Information

VPR

Risk Factor: Low

Score: 2.1

Percentile: 8.3

CVSS v2

Risk Factor: Medium

Base Score: 4

Temporal Score: 3

Vector: CVSS2#AV:N/AC:H/Au:N/C:N/I:P/A:P

CVSS Score Source: CVE-2026-118777

CVSS v3

Risk Factor: Medium

Base Score: 4.8

Temporal Score: 4.2

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 10/29/2026

Reference Information

CVE: CVE-2026-118777