Vulnerabilidades de container native virtualization (CVE)

8.8Alta

CVE-2026-13622 hace 2 meses

Kubevirt: virt-handler-rhel9: kubevirt: virt-handler migration proxy follows symlinks allowing container escape to host

Red Hat Red Hat Container Native Virtualization 4.12; Red Hat Red Hat Container Native Virtualization 4.13; Red Hat Red Hat Container Native Virtualization 4.14; Red Hat Red Hat Container Native Virtualization 4.15

A symlink following vulnerability was found in KubeVirt's virt-handler migration proxy. During live migration, virt-handler dials Unix sockets inside the target virt-launcher pod via /proc/<pid>/root/ paths using net.Dial() without symlink protection. These s…

7.7Alta

CVE-2026-17527 hace 3 meses

Virt-cdi-operator: containerized-data-importer: cdi.kubevirt.io:view aggregated clusterrole grants create on datavolumes/source, allowing unauthorized pvc clone

Red Hat Red Hat Container Native Virtualization 4.14; Red Hat Red Hat Container Native Virtualization 4.16; Red Hat Red Hat Container Native Virtualization 4.17; Red Hat Red Hat Container Native Virtualization 4.18

In containerized-data-importer (CDI), the aggregated cdi.kubevirt.io:view ClusterRole, intended to provide read-only access to CDI resources, includes a rule granting create on the datavolumes/source subresource. CDI's DataVolume clone authorization accepts t…

7.3Alta

CVE-2026-13201 hace 4 meses

Kubevirt: virt-handler-rhel9: kubevirt: safepath symlink following in virt-handler enables notify socket hijacking and node-level vm disruption

Red Hat Red Hat Container Native Virtualization 4.12; Red Hat Red Hat Container Native Virtualization 4.13; Red Hat Red Hat Container Native Virtualization 4.14; Red Hat Red Hat Container Native Virtualization 4.15

A flaw was found in KubeVirt's safepath package used by virt-handler. The OpenAtNoFollow function uses O_PATH|O_NOFOLLOW to obtain a file descriptor to a path leaf, but downstream operations resolve the path via /proc/self/fd/N using link-following syscalls. …

9.3Crítica

CVE-2026-44990 hace 4 meses

Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html`

apostrophecms sanitize-html; Red Hat multicluster engine for Kubernetes 2.1; Red Hat multicluster engine for Kubernetes 2.11; Red Hat multicluster engine for Kubernetes 2.17

ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Under the default configuration, versions of `sanitize-html` prior to 2.17.4 can turn attacker-controlled content inside a …

7.0Alta

CVE-2026-44495 hace 4 meses

Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge

axios axios; Red Hat Red Hat AMQ Broker 7.13.6; Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8; Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9

Axios is a promise based HTTP client for the browser and Node.js. From 0.19.0 to before 0.31.1 and 1.15.2, Axios contains prototype-pollution gadgets in request config processing. If another vulnerability in the same JavaScript process has already polluted Ob…

8.7Alta

CVE-2026-44494 hace 4 meses

Axios: Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`

axios axios; Red Hat Red Hat AMQ Broker 7.13.6; Red Hat Red Hat AMQ Broker 7.14.1; Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8

Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.16.0, the Axios library is vulnerable to a Prototype Pollution "Gadget" attack that allows any Object.prototype pollution in the application's dependency tree to be escal…

1.1%EPSS

8.6Alta

CVE-2026-44492 hace 4 meses

Axios: shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)

axios axios; Red Hat Red Hat AMQ Broker 7.13.6; Red Hat Red Hat AMQ Broker 7.14.1; Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8

Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios does not normalise IPv4-mapped IPv6 addresses. When NO_PROXY lists an IPv4 address such as 127.0.0.1 or 169.254.169.254, a request URL using the IPv4-mapped IP…

12%EPSS

7.7Alta

CVE-2026-9804 hace 5 meses

Kubevirt: kubevirt: vmexport directory symlink escape enables exporter pod file read

Red Hat Red Hat Container Native Virtualization 4.17; Red Hat Red Hat Container Native Virtualization 4.18; Red Hat Red Hat Container Native Virtualization 4.19; Red Hat Red Hat Container Native Virtualization 4.20

A flaw was found in KubeVirt's virt-exportserver component. An attacker with specific namespace-level access can exploit a path traversal vulnerability in the VMExport directory endpoint. By placing a symbolic link (symlink) within an exported filesystem Pers…

9.9Crítica

CVE-2026-7374 hace 5 meses

Kubevirt: kubevirt virt-handler: privilege escalation and node compromise via symlink following vulnerability

kubevirt; Red Hat Red Hat Container Native Virtualization 4.12; Red Hat Red Hat Container Native Virtualization 4.13; Red Hat Red Hat Container Native Virtualization 4.14

A flaw was found in KubeVirt's virt-handler component. This vulnerability allows an authenticated OpenShift user with edit permissions in a single namespace to exploit improper symlink validation when connecting to virtual machine console sockets. By replacin…

6.5Media

CVE-2026-42044 hace 6 meses

Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`

axios axios; Red Hat HawtIO HawtIO 4.4.0; Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8; Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9

Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.15.2, he Axios library is vulnerable to a Prototype Pollution "Gadget" attack that allows any Object.prototype pollution in the application's dependency tree to be escala…

8.7Alta

CVE-2026-35469 hace 6 meses

SpdyStream: DOS on CRI

moby spdystream; Red Hat Red Hat OpenShift Container Platform 4.19; Red Hat RHEM 1.0 for RHEL 9; Red Hat RHEM 1.1 for RHEL 10

spdystream is a Go library for multiplexing streams over SPDY connections. In versions 0.5.0 and below, the SPDY/3 frame parser does not validate attacker-controlled counts and lengths before allocating memory. Three allocation paths are affected: the SETTING…

4.8Media

CVE-2026-40175 hace 7 meses

Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain

axios axios; Siemens gWAP; Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9; Red Hat Streams for Apache Kafka 3.2.0

Axios is a promise based HTTP client for the browser and Node.js. Versions prior to 1.15.0 and 0.3.1 are vulnerable to a specific gadget-style attack chain in which prototype pollution in a third-party dependency may be leveraged to inject unsanitized header …

2.0%EPSS

7.5Alta

CVE-2026-32280 hace 7 meses

Unexpected work during chain building in crypto/x509

Go standard library crypto/x509; Red Hat Cryostat 4 on RHEL 9; Red Hat HawtIO HawtIO 4.4.0; Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8

During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 an…

9.1Crítica

CVE-2026-33186 hace 7 meses

gRPC-Go has an authorization bypass via missing leading slash in :path

grpc grpc-go; Red Hat Cryostat 4 on RHEL 9; Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support

gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 `:path` pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests …

1.6%EPSS

8.5Alta

CVE-2025-14459 hace 9 meses

Virt-cdi-controller: unauthorized pvc cloning via dataimportcron

Red Hat RHEL-9-CNV-4.19; Red Hat Red Hat OpenShift Virtualization 4

A flaw was found in KubeVirt Containerized Data Importer (CDI). This vulnerability allows a user to clone PersistentVolumeClaims (PVCs) from unauthorized namespaces, resulting in unauthorized access to data via the DataImportCron PVC source mechanism.

6.4Media

CVE-2025-57848 hace 1 año

Container-native-virtualization: privilege escalation via excessive /etc/passwd permissions

Red Hat RHEL-8-CNV-4.12; Red Hat RHEL-9-CNV-4.14

A container privilege escalation flaw was found in certain Container-native Virtualization images. This issue stems from the /etc/passwd file being created with group-writable permissions during build time. In certain conditions, an attacker who can execute c…

6.4Media

CVE-2025-7195 hace 1 año

Operator-sdk: privilege escalation due to incorrect permissions of /etc/passwd

operator-framework operator-sdk; Red Hat RHEL-9-CNV-4.17; Red Hat RHEL-9-CNV-4.18; Red Hat RHEL-9-CNV-4.20

Early versions of Operator-SDK provided an insecure method to allow operator containers to run in environments that used a random UID. Operator-SDK before 0.15.2 provided a script, user_setup, which modifies the permissions of the /etc/passwd file to 664 duri…

8.3Alta

CVE-2024-3727 hace 2 años

Containers/image: digest type does not guarantee valid type

image; Red Hat OADP-1.3-RHEL-9; Red Hat Red Hat Advanced Cluster Security 4.4; Red Hat Red Hat Advanced Cluster Security 4.5

A flaw was found in the github.com/containers/image library. This flaw allows attackers to trigger unexpected authenticated registry accesses on behalf of a victim user, causing resource exhaustion, local path traversal, and other attacks.

1.3%EPSS