CVE-2026-123665 Details

A permission vulnerability has been identified in Kubescape versions through 4.0.15, specifically in the Output component's GetWriter function within the file core/pkg/resultshandling/printer/printresults.go. The issue arises because the function writes scan report files using the default file creation method, which does not set explicit permissions. As a result, the files may be left world-readable. This vulnerability requires local access to exploit.

Upgrade to Kubescape version 4.0.16 or later, where this vulnerability has been addressed. In the updated version, the application explicitly sets the file permissions to '0600' after creating the report file, ensuring that only the file owner can read or write it.