VulertSecurity VulertSecurity

Vulnerability Database · Go · Package report

github.com/open-feature/open-feature-operator: vulnerability history, versions and safety

github.com/open-feature/open-feature-operator is a package in the Go ecosystem. Vulert records 4 vulnerabilities for it across 120 releases, from Apr 2023 to Jul 2026. Each vulnerability names the versions it affects, the fixed version to move to, and a workaround where no fix has been published.

i
4 vulnerabilities recorded H1 M1 U2
i
2 with no fix published

No patched version yet — these are the ones to plan around.

See the unfixed vulnerabilities →
i
2 in the last 12 months

Most recent disclosure 17 Jul 2026.

See the disclosure history →
i
0 malicious-package vulnerabilities

No published version shipped hostile code.

See all github.com/open-feature/open-feature-operator vulnerabilities

Vulert verdict on github.com/open-feature/open-feature-operator v0.9.3 i

Updated on 23 Oct 2026

Careful: v0.9.3 has 4 known vulnerabilities, and 2 have no fix yet. Use an earlier safe version, or the workaround listed for each one.

Package health score 60/100
  • Security Some issues to review
  • Maintenance Sustainable
  • Popularity Niche
  • Community Quiet

The current release has a vulnerability with no published fix, which caps this score.

What to do: Pin an earlier, unaffected release if you can, and apply the workaround each vulnerability lists until a fix is published. No fix yet: Vulert alerts you the moment one is published. Monitor it with Vulert →

  • Current release v0.9.3 — affected i
  • Vulnerabilities on record 4 over 3 years · 2 in the last year i
  • Latest disclosure 17 Jul 2026 i
  • Highest CVSS 8.8 i
  • With no published fix 2 i
  • Stars 316 i
  • OpenSSF scorecard 6/10 i
  • Last release 1 month ago i
  • Licence Apache-2.0 i

Version list, release dates, licence and dependants published by the Go module proxy, refreshed 23 Oct 2026. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Versions

Which versions are affected

Every version Vulert tracks for github.com/open-feature/open-feature-operator, newest first, with the vulnerabilities recorded against each one. A version showing none has no vulnerability in the Vulert database — open it for the full picture on that release.

i
Version Released Vulert vulnerabilities Licence Fix published Details
v0.9.4-0.20260925143441-43abcefaccfd 25 Sep 2026 H1 M1 U2 Apache-2.0 No Details →
v0.9.3 28 Aug 2026 H1 M1 U2 Apache-2.0 No Details →
v0.9.3-0.20260731151906-14a38644319e 31 Jul 2026 H1 M1 U2 Apache-2.0 No Details →
v0.9.3-0.20260604201841-32b3b65cdbdf 04 Jun 2026 H1 M1 U2 Apache-2.0 No Details →
v0.9.2 27 May 2026 H1 M1 U2 Apache-2.0 No Details →
v0.9.1 01 May 2026 H1 M1 U2 Apache-2.0 No Details →
v0.8.10-0.20260417155900-d75846283f14 17 Apr 2026 H1 M1 U2 Apache-2.0 No Details →
v0.9.0 17 Apr 2026 H1 M1 U2 Apache-2.0 No Details →
v0.0.0-20260410201100-3cf6a6a0ecf2 10 Apr 2026 H1 M1 U2 Apache-2.0 No Details →
v0.8.10-0.20260410201100-3cf6a6a0ecf2 10 Apr 2026 H1 M1 U2 Apache-2.0 No Details →
v0.0.0-20260321141944-1047003fcd23 21 Mar 2026 H1 M1 U2 Apache-2.0 No Details →
v0.8.10-0.20260321141944-1047003fcd23 21 Mar 2026 H1 M1 U2 Apache-2.0 No Details →
v0.0.0-20260105195433-e6d6be9aa091 05 Jan 2026 H1 M1 U2 Apache-2.0 No Details →
v0.8.9 05 Jan 2026 H1 M1 U2 Apache-2.0 No Details →
v0.8.8 09 Oct 2025 H1 M1 U2 Apache-2.0 No Details →
v0.8.7 28 Jul 2025 H1 M1 U2 Apache-2.0 No Details →
v0.8.6 13 Jun 2025 H1 M1 U2 Apache-2.0 No Details →
v0.8.5 31 Jan 2025 H1 M1 U2 Apache-2.0 No Details →
v0.8.4 14 Jan 2025 H1 M1 U2 Apache-2.0 No Details →
v0.8.3 13 Jan 2025 H1 M1 U2 Apache-2.0 No Details →
v0.8.3-0.20250113162151-674dd16ac4dc 13 Jan 2025 H1 M1 U2 Apache-2.0 No Details →
v0.8.2 13 Jan 2025 H1 M1 U2 Apache-2.0 No Details →
v0.8.2-0.20250113144816-b393a2669c05 13 Jan 2025 H1 M1 U2 Apache-2.0 No Details →
v0.8.1 30 Oct 2024 H1 M1 U2 Apache-2.0 No Details →
v0.8.1-0.20241030162427-838bddaabce6 30 Oct 2024 H1 M1 U2 Apache-2.0 No Details →
v0.7.3-0.20241024181137-bcdafd29a0bd 24 Oct 2024 H1 M1 U2 Apache-2.0 No Details →
v0.8.0 24 Oct 2024 H1 M1 U2 Apache-2.0 No Details →
v0.7.3-0.20241022201635-e11515993677 22 Oct 2024 H1 M1 U2 Apache-2.0 No Details →
v0.7.2 12 Aug 2024 H1 M1 U2 Apache-2.0 No Details →
v0.7.2-0.20240812184909-7ace54d6a491 12 Aug 2024 H1 M1 U2 Apache-2.0 No Details →
v0.7.1 23 Jul 2024 H1 M1 U2 Apache-2.0 No Details →
v0.6.2-0.20240708162254-917a680fb363 08 Jul 2024 H1 M1 U2 Apache-2.0 No Details →
v0.7.0 08 Jul 2024 H1 M1 U2 Apache-2.0 No Details →
v0.6.2-0.20240704115437-65c3c262110c 04 Jul 2024 H1 M1 U2 Apache-2.0 No Details →
v0.6.1 06 Jun 2024 H1 M1 U2 Apache-2.0 No Details →
v0.6.1-0.20240606185421-339e5c8cf49c 06 Jun 2024 H1 M1 U2 Apache-2.0 No Details →
v0.5.8-0.20240529194940-7eaba4fa2137 29 May 2024 H1 M1 U2 Apache-2.0 No Details →
v0.6.0 29 May 2024 H1 M1 U2 Apache-2.0 No Details →
v0.5.7 29 May 2024 H1 M1 U2 Apache-2.0 No Details →
v0.5.7-0.20240529160553-1ea457fdcb38 29 May 2024 H1 M1 U2 Apache-2.0 No Details →
v0.5.6 28 May 2024 H1 M1 U2 Apache-2.0 No Details →
v0.5.6-0.20240528170006-546635e6d486 28 May 2024 H1 M1 U2 Apache-2.0 No Details →
v0.5.6-0.20240523120500-a8b7ad49d836 23 May 2024 H1 M1 U2 Apache-2.0 No Details →
v0.5.6-0.20240523114447-06b399e0cf39 23 May 2024 H1 M1 U2 Apache-2.0 No Details →
v0.5.6-0.20240515133230-d54914460b9f 15 May 2024 H1 M1 U2 Apache-2.0 No Details →
v0.5.6-0.20240515051759-b0b99a7d101f 15 May 2024 H1 M1 U2 Apache-2.0 No Details →
v0.5.6-0.20240514154846-65e20cf72b3e 14 May 2024 H1 M1 U2 Apache-2.0 No Details →
v0.5.6-0.20240514051833-b21378e4e58b 14 May 2024 H1 M1 U2 Apache-2.0 No Details →
v0.5.5 13 May 2024 H1 M1 U2 Apache-2.0 No Details →
v0.5.5-0.20240506125212-c4831a3cdc00 06 May 2024 H1 M1 U2 Apache-2.0 No Details →
v0.5.5-0.20240229200925-2e5947734440 29 Feb 2024 H1 M1 U2 Apache-2.0 No Details →
v0.5.5-0.20240226183105-4eda2ca837c7 26 Feb 2024 H1 M1 U2 Apache-2.0 No Details →
v0.5.4 21 Feb 2024 H1 M1 U2 Apache-2.0 No Details →
v0.5.4-0.20240221150219-04c0a2ca71d1 21 Feb 2024 H1 M1 U2 Apache-2.0 No Details →
v0.5.4-0.20240221023248-a1fc38a4186f 21 Feb 2024 H1 M1 U2 Apache-2.0 No Details →
v0.5.4-0.20240129193720-ffc6cec3b19d 29 Jan 2024 H1 M1 U2 Apache-2.0 No Details →
v0.5.4-0.20240124062957-3271f3362351 24 Jan 2024 H1 M1 U2 Apache-2.0 No Details →
v0.5.4-0.20240108135233-f3f942728719 08 Jan 2024 H1 M1 U2 Apache-2.0 No Details →
v0.5.3 29 Dec 2023 H1 M1 U2 Apache-2.0 No Details →
v0.5.3-0.20231229162410-0affaa5968e3 29 Dec 2023 H1 M1 U2 Apache-2.0 No Details →
v0.5.3-0.20231207014117-70fb5d954973 07 Dec 2023 H1 M1 U2 Apache-2.0 No Details →
v0.5.2 06 Dec 2023 H1 M1 U2 Apache-2.0 No Details →
v0.5.1 01 Dec 2023 H1 M1 U2 Apache-2.0 No Details →
v0.5.0 29 Nov 2023 H1 M1 U2 Apache-2.0 No Details →
v0.4.0 29 Nov 2023 H1 M1 U2 Apache-2.0 No Details →
v0.2.37-0.20231129174946-069e2754210d 29 Nov 2023 H1 M1 U2 Apache-2.0 No Details →
v0.2.37-0.20231128164602-c6165d426b5b 28 Nov 2023 H1 M1 U2 Apache-2.0 No Details →
v0.2.37-0.20231122071444-17a547f88595 22 Nov 2023 H1 M1 U2 Apache-2.0 No Details →
v0.2.37-0.20231120144522-ccc0471c15cb 20 Nov 2023 H1 M1 U2 Apache-2.0 No Details →
v0.2.37-0.20231120060443-233be79b56cc 20 Nov 2023 H1 M1 U2 Apache-2.0 No Details →
v0.2.37-0.20231117101310-726a7f714906 17 Nov 2023 H1 M1 U2 Apache-2.0 No Details →
v0.2.37-0.20231117055644-1287b0785fd9 17 Nov 2023 H1 M1 U2 Apache-2.0 No Details →
v0.2.37-0.20231116141945-d234410a8097 16 Nov 2023 H1 M1 U2 Apache-2.0 No Details →
v0.2.37-0.20231116103437-e3c8b4290be9 16 Nov 2023 H1 M1 U2 Apache-2.0 No Details →
v0.2.37-0.20231116083411-cdc4af495f37 16 Nov 2023 H1 M1 U2 Apache-2.0 No Details →
v0.2.37-0.20231115174606-18569182c1f2 15 Nov 2023 H1 M1 U2 Apache-2.0 No Details →
v0.2.37-0.20231108054703-a97d336468d5 08 Nov 2023 H1 M1 U2 Apache-2.0 No Details →
v0.2.37-0.20231107131815-dc5487eb2f21 07 Nov 2023 H1 M1 U2 Apache-2.0 No Details →
v0.2.37-0.20231107064614-3acd49289a40 07 Nov 2023 H1 M1 U2 Apache-2.0 No Details →
v0.0.0-20231024084929-e0e638b0bc52 24 Oct 2023 H1 M1 U2 Apache-2.0 No Details →
v0.2.37-0.20231024084929-e0e638b0bc52 24 Oct 2023 H1 M1 U2 Apache-2.0 No Details →
v0.2.37-0.20231013143447-32ddf002e6c2 13 Oct 2023 H1 M1 U2 Apache-2.0 No Details →
v0.2.36 07 Aug 2023 H1 M1 U2 Apache-2.0 No Details →
v0.2.36-0.20230807220204-4d5dfdd46316 07 Aug 2023 H1 M1 U2 Apache-2.0 No Details →
v0.2.36-0.20230801195317-e74006872ebb 01 Aug 2023 H1 M1 U2 Apache-2.0 No Details →
v0.2.35 01 Aug 2023 H1 M1 U2 Apache-2.0 No Details →
v0.2.35-0.20230615124428-09dcbc1b181a 15 Jun 2023 H1 M1 U2 Apache-2.0 No Details →
v0.2.34 13 Apr 2023 H1 M1 U2 Apache-2.0 No Details →
v0.2.33 12 Apr 2023 H1 M1 U2 Apache-2.0 No Details →
v0.2.32 12 Apr 2023 H1 M1 U2 Apache-2.0 No Details →
v0.2.32-0.20230403160311-6f1f93c98c7b 03 Apr 2023 H1 M1 U2 Apache-2.0 No Details →
v0.2.32-0.20230331163141-651c63c5feeb 31 Mar 2023 H1 M1 U2 Apache-2.0 No Details →
v0.2.32-0.20230327160722-abe56e143053 27 Mar 2023 H1 M1 U2 Apache-2.0 No Details →
v0.2.32-0.20230327132014-6ed4cef4a7d1 27 Mar 2023 H1 M1 U2 Apache-2.0 No Details →
v0.2.32-0.20230323185843-613306011016 23 Mar 2023 H1 M1 U2 Apache-2.0 No Details →
v0.2.31 16 Mar 2023 H1 M1 U2 Apache-2.0 No Details →
v0.2.30 16 Mar 2023 H1 M1 U2 Apache-2.0 No Details →
v0.2.30-0.20230224163544-38a14644e687 24 Feb 2023 H1 M1 U2 Apache-2.0 No Details →
v0.2.29 23 Feb 2023 H1 M1 U2 Apache-2.0 No Details →
v0.2.28 28 Jan 2023 H1 M1 U2 Apache-2.0 No Details →
v0.2.27 27 Jan 2023 H1 M1 U2 — No Details →
v0.2.27-0.20230127171052-7cba7e14c223 27 Jan 2023 H1 M1 U2 — No Details →
v0.2.26 26 Jan 2023 H1 M1 U2 — No Details →
v0.2.25 25 Jan 2023 H1 M1 U2 — No Details →
v0.2.24 17 Jan 2023 H1 M1 U2 — No Details →
v0.2.23 06 Jan 2023 H1 M1 U2 — No Details →
v0.2.23-0.20221221164214-15ad25161402 21 Dec 2022 H1 M1 U2 — No Details →
v0.2.22 16 Dec 2022 H1 M1 U2 — No Details →
v0.2.21 16 Dec 2022 H1 M1 U2 — No Details →
v0.2.20 18 Nov 2022 H1 M1 U2 — No Details →
v0.2.20-0.20221116142003-1b01cec8e81b 16 Nov 2022 H1 M1 U2 — No Details →
v0.2.19 15 Nov 2022 H1 M1 U2 — No Details →
v0.2.19-0.20221115093554-675724a078ea 15 Nov 2022 H1 M1 U2 — No Details →
v0.2.18 10 Nov 2022 H1 M1 U2 — No Details →
v0.2.17 07 Nov 2022 H1 M1 U2 — No Details →
v0.0.0-20221101150518-698a10964ed6 01 Nov 2022 H1 M1 U2 — No Details →
v0.2.16 27 Oct 2022 H1 M1 U2 — No Details →
v0.2.16-0.20221025043630-2bd953f643b9 25 Oct 2022 H1 M1 U2 — No Details →
v0.2.15 25 Oct 2022 H1 M1 U2 — No Details →
v0.2.14 25 Oct 2022 H1 M1 U2 — No Details →

The newest 120 of 149 versions Vulert tracks. Severity counts are the vulnerabilities recorded against that exact release.

02 Disclosure history

How often vulnerabilities are recorded

  • 2023 1
  • 2024 1
  • 2026 2

Counted by the year Vulert recorded each vulnerability — the same date the table below shows as disclosed. 2 of the 4 were recorded in the last 12 months.

03 Vulnerabilities

Recorded vulnerabilities for github.com/open-feature/open-feature-operator

The 4 most severe of 4 vulnerabilities recorded for this package

Search all 4 in the database →
Vulnerability Severity Fixed version ↓ Disclosed ↓
CVE-2023-29018: OpenFeature Operator vulnerable to Cluster-level Privilege Escalation 8.8 high 0.2.32 12 Apr 2023
CVE-2026-54495: open-feature-operator Cross-Namespace Resource Exposure Vulnerability 4.3 medium No fix published 15 Jul 2026
CVE-2023-29018: OpenFeature Operator vulnerable to Cluster-level Privilege Escalation N/A unrated 0.2.32 20 Aug 2024
CVE-2026-54495: open-feature-operator Cross-Namespace Exposure of Spec Contents in Multi-Tenant Clusters N/A unrated No fix published 17 Jul 2026

Vulnerability wrong, a fix missing, or a package we should cover? Report it and we will fix the record. Report Vulnerability Provide Feedback

Updated: 23/Oct/2026 · Vulnerabilities in our DB: 524315

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About github.com/open-feature/open-feature-operator

Is github.com/open-feature/open-feature-operator safe to use?

Vulert records 4 vulnerabilities for github.com/open-feature/open-feature-operator in Go: 0 critical, 1 high, 1 medium and 0 low, plus 2 not yet rated. 2 of them have no published fix yet, so those are the ones to avoid or mitigate.

What is github.com/open-feature/open-feature-operator's Vulert package health score?

Vulert scores github.com/open-feature/open-feature-operator 60/100, which reads as usable, but worth attention. The score weighs the vulnerability record (40), maintenance and release cadence (25), adoption from dependents and stars (20) and community signals such as the OpenSSF scorecard and forks (15). The current release has a vulnerability with no published fix, which caps this score.

Is the latest version of github.com/open-feature/open-feature-operator affected?

Yes. v0.9.3, the version you would install today, has 4 known vulnerabilities, and 2 has no published fix yet. Use an earlier unaffected release, or the workaround each vulnerability lists.

Which version of github.com/open-feature/open-feature-operator should I use?

v0.9.3 is the version Vulert recommends for the affected releases. The version table above lists every release with the vulnerabilities recorded against it, so you can confirm the range you actually run.

How many vulnerabilities does github.com/open-feature/open-feature-operator have?

4 vulnerabilities are recorded for github.com/open-feature/open-feature-operator in the Go ecosystem: 0 critical, 1 high, 1 medium and 0 low, plus 2 not yet rated. The ledger on this page lists the same counts next to the date of the most recent disclosure.

How often are new github.com/open-feature/open-feature-operator vulnerabilities disclosed?

2 vulnerabilities were recorded for github.com/open-feature/open-feature-operator in the last 12 months, and the oldest entry in this database dates to 12 Apr 2023. Recency matters more than a lifetime total: it shows how actively new issues are being disclosed for the package you are considering.

Which versions of github.com/open-feature/open-feature-operator are affected?

Each vulnerability on this page lists the affected version range and the fixed version to move to. Open the vulnerability for the version you actually run — fixes are specific to a release line, not to the package as a whole.

How do I monitor github.com/open-feature/open-feature-operator for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the github.com/open-feature/open-feature-operator version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.