Issues

• MCP HTTP gateway is unauthenticated by default and binds 0.0.0.0 — anyone on the network can mutate the cluster

  William-Lu-stack/Flawless#8 · Filter by author fufuchiu opened on Sep 9, 2026

• patch_workload interpolates the workload name into the API path unquoted — namespace guard bypass via path traversal

  William-Lu-stack/Flawless#7 · Filter by author fengrui128 opened on Sep 9, 2026

• change_success_rate counts pending / dry-run / skipped changes as successes

  William-Lu-stack/Flawless#6 · Filter by author HisStar opened on Aug 18, 2026

• [Feature]: create_pv constraints are missing from the LLM prompt

  enhancement
  William-Lu-stack/Flawless#5 · Filter by author 22373448 opened on Aug 5, 2026

• Requesting a private security contact (please enable private vulnerability reporting)

  William-Lu-stack/Flawless#4 · Filter by author aeonframework opened on Jul 27, 2026
  2