Cross-namespace FeatureFlagSource and InProcessConfiguration resolution exposes spec contents on multi-tenant clusters

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-54495 · Microsoft / collected KEV context

EUVD-2026-82405

GHSA-398h-7f66-3h4p

GO-2026-5998

cve-program · CVE-2026-54495

• https://github.com/open-feature/open-feature-operator/security/advisories/GHSA-398h-7f66-3h4p
• https://github.com/open-feature/open-feature-operator/issues/847

euvd · EUVD-2026-82405

• https://github.com/open-feature/open-feature-operator/security/advisories/GHSA-398h-7f66-3h4p
• https://github.com/open-feature/open-feature-operator/issues/847

nvd · CVE-2026-54495

• https://github.com/open-feature/open-feature-operator/issues/847
• https://github.com/open-feature/open-feature-operator/security/advisories/GHSA-398h-7f66-3h4p

osv · GHSA-398h-7f66-3h4p

• https://github.com/open-feature/open-feature-operator/security/advisories/GHSA-398h-7f66-3h4p
• https://github.com/open-feature/open-feature-operator/issues/847
• https://github.com/open-feature/open-feature-operator

osv · GO-2026-5998

• https://github.com/open-feature/open-feature-operator/security/advisories/GHSA-398h-7f66-3h4p
• https://github.com/open-feature/open-feature-operator/issues/847

No related operational record is retained in the current change model.