IP-DB.com
Türkçe English Deutsch Español
Entrar Obtener clave API

Vulnerabilidades de openshift (CVE)

Registros CVE publicados para openshift, los más recientes primero. Siga el producto para recibir un correo con cada nueva.

4.16 1274.19 1254.18 1134.17 1124.14 1114.15 1094.12 1034.20 1004.13 994.21 924.22 744.11 34.10 1
188 resultados
6.8Media
CVE-2026-114406

Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION; Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support

The system certificate authority (CA) store in Red Hat products, distributed via ca-certificates RPM packages, included multiple root CA certificates of authorities, which signed intermediate CA certificates with weak private keys issued by the eMudhra certif…

8.8Alta
CVE-2026-104795

Insights-runtime-extractor: insights-runtime-extractor: container escape via privileged binary execution

Red Hat Red Hat OpenShift Container Platform 4.19; Red Hat Red Hat OpenShift Container Platform 4.20; Red Hat Red Hat OpenShift Container Platform 4.21; Red Hat Red Hat OpenShift Container Platform 4.22

The insights-runtime-extractor runs as a privileged DaemonSet (`hostPID: true`) that scans container processes for runtime fingerprinting. When scanning a container, the coordinator: 1. **fork()s** a child process 2. **setns()** into the target container's P…

7.7Alta
CVE-2026-75888

Openshift/console: openshift/console: authenticated ssrf via helm chart url fetch

Red Hat Red Hat OpenShift Container Platform 4.12; Red Hat Red Hat OpenShift Container Platform 4.14; Red Hat Red Hat OpenShift Container Platform 4.15; Red Hat Red Hat OpenShift Container Platform 4.16

A flaw was found in the OpenShift console. An authenticated console user can exploit a Server-Side Request Forgery (SSRF) vulnerability by providing a specially crafted Helm chart URL without proper validation. This allows the user to make the console pod fet…

7.7Alta
CVE-2026-93017

Insights-operator: gather serviceaccount has cluster-wide secret read plus nodes/proxy and cluster-reader

Red Hat Red Hat OpenShift Container Platform 4.12; Red Hat Red Hat OpenShift Container Platform 4.14; Red Hat Red Hat OpenShift Container Platform 4.15; Red Hat Red Hat OpenShift Container Platform 4.16

The `insights-operator-gather` ClusterRole grants the operator's service account read access to secrets in the core API group with no namespace or resourceNames restriction — therefore, access to every secret in every namespace in the cluster. Ref: https://g…

6.8Media
CVE-2026-107176

Cluster-samples-operator: role reads all secrets in openshift-config, not just pull-secret

Red Hat Red Hat OpenShift Container Platform 4.19; Red Hat Red Hat OpenShift Container Platform 4.20; Red Hat Red Hat OpenShift Container Platform 4.21; Red Hat Red Hat OpenShift Container Platform 4.22

A flaw was found in the cluster-samples-operator. The RBAC Role coreos-pull-secret-reader in namespace openshift-config grants get, list, and watch permissions on all Secret resources without resourceNames scoping. The operator only requires access to the pul…

7.1Alta
CVE-2026-96577

Oc-mirror__release-4.21: embedded local cache registry listens on all interfaces without authentication, with delete enabled

Red Hat Red Hat OpenShift Container Platform 4.18; Red Hat Red Hat OpenShift Container Platform 4.19; Red Hat Red Hat OpenShift Container Platform 4.20; Red Hat Red Hat OpenShift Container Platform 4.21

A flaw was found in oc-mirror. During mirroring operations, the embedded local cache registry binds to all network interfaces without authentication or encryption instead of restricting access to the local system. An unauthenticated attacker on an adjacent ne…

6.1Media
CVE-2026-83589

Oauth-proxy: open redirect via /\ and /\t bypass in post-login redirect

Red Hat Red Hat OpenShift Container Platform 4.12; Red Hat Red Hat OpenShift Container Platform 4.14; Red Hat Red Hat OpenShift Container Platform 4.15; Red Hat Red Hat OpenShift Container Platform 4.16

A flaw was found in oauth-proxy. The application fails to properly validate the destination redirect parameter (`rd`) during post-login redirection. A remote attacker can exploit this vulnerability by enticing a user to follow a specially crafted link, result…

7.1Alta
CVE-2026-87114

Kube-compare: container:// reference extraction runs the image entrypoint and silently escalates to sudo

Red Hat Red Hat OpenShift Container Platform 4.19; Red Hat Red Hat OpenShift Container Platform 4.20; Red Hat Red Hat OpenShift Container Platform 4.21; Red Hat Red Hat OpenShift Container Platform 4.22

A flaw was found in kube-compare. When processing a 'container://' reference path, the tool incorrectly executes an untrusted container image's entrypoint instead of merely extracting data from a stopped container. This allows a remote attacker to achieve arb…

7.5Alta
CVE-2026-75887

Openshift/console: openshift/console: unauthenticated path traversal in i18n locale handler

Red Hat Red Hat OpenShift Container Platform 4.12; Red Hat Red Hat OpenShift Container Platform 4.13; Red Hat Red Hat OpenShift Container Platform 4.14; Red Hat Red Hat OpenShift Container Platform 4.15

A flaw was found in the OpenShift console. An unauthenticated attacker can exploit a path traversal vulnerability by manipulating the `lng` and `ns` query parameters in the `/locales/resource.json` endpoint. This allows the attacker to read sensitive `*.json`…

7.2Alta
CVE-2026-75886

Openshift/console: openshift/console: unauthenticated reverse proxy to in-cluster catalogd service with session token forwarding

Red Hat Red Hat OpenShift Container Platform 4.17; Red Hat Red Hat OpenShift Container Platform 4.18; Red Hat Red Hat OpenShift Container Platform 4.19; Red Hat Red Hat OpenShift Container Platform 4.20

A flaw was found in openshift/console. An unauthenticated remote attacker can exploit a misconfiguration in the CatalogdHandler, which lacks proper authentication, and the forwarding of the `openshift-session-token` cookie. This allows the attacker to send re…

7.5Alta
CVE-2026-94640

Rpcbind: unbounded memory allocation in rpcbind statistics tracking allows unauthenticated remote denial of service

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 8; Red Hat Red Hat Enterprise Linux 9; Red Hat Red Hat OpenShift Container Platform 4.22

A flaw was found in rpcbind. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service (DoS) by sending a large number of unique requests. The rpcbind service records previously unseen RPC (Remote Procedure Call) statistics in …

7.4Alta
CVE-2026-75939

Openshift/oc-mirror: release signature verification: openpgp signatureerror checked before signed body is consumed

Red Hat Red Hat OpenShift Container Platform 4.18; Red Hat Red Hat OpenShift Container Platform 4; Red Hat Red Hat OpenShift Container Platform 5

A flaw was found in openshift/oc-mirror. The tool incorrectly verifies PGP (Pretty Good Privacy) release image signatures by checking for signature errors before the entire signed body is processed, leading to a bypass of the signature verification. A remote …

9.3Crítica
CVE-2026-75885

Openshift/console: openshift/console: unauthenticated ssrf and resource exhaustion via devfile parser endpoint

Red Hat Red Hat OpenShift Container Platform 4.12; Red Hat Red Hat OpenShift Container Platform 4.13; Red Hat Red Hat OpenShift Container Platform 4.14; Red Hat Red Hat OpenShift Container Platform 4.15

A flaw was found in the OpenShift console. Unauthenticated access to the `/api/devfile/` and `/api/devfile/samples/` endpoints allows a remote attacker to send crafted devfile payloads. This can lead to Server-Side Request Forgery (SSRF), where the console po…

7.5Alta
CVE-2026-49329

Openshift/oauth-server: openshift/oauth-server: quadratic-time dos via accept-language header underscore bypass on unauthenticated login endpoints

Red Hat Red Hat OpenShift Container Platform 4.14; Red Hat Red Hat OpenShift Container Platform 4.15; Red Hat Red Hat OpenShift Container Platform 4.16; Red Hat Red Hat OpenShift Container Platform 4.18

A flaw was found in openshift/oauth-server. The OAuth login and error page endpoints pass the unauthenticated Accept-Language header to golang.org/x/text/language.ParseAcceptLanguage() without input validation. A bypass of the CVE-2022-32149 mitigation exists…

7.4Alta
CVE-2026-50236

Openshift/console: authenticated ssrf with full response reflection and path neutralization via dev console webhook helpers in openshift console

Red Hat Red Hat OpenShift Container Platform 4.14; Red Hat Red Hat OpenShift Container Platform 4.15; Red Hat Red Hat OpenShift Container Platform 4.16; Red Hat Red Hat OpenShift Container Platform 4.17

An authenticated SSRF flaw was found in the OpenShift Console Dev Console webhook helpers. User-supplied target URLs are fetched server-side without validation, with path neutralization enabling arbitrary endpoint targeting and full response reflection from t…

7.4Alta
CVE-2026-50237

Openshift/console: namespace tenant ssrf with egress bypass, catalog poisoning, and admin-mediated supply chain escalation via projecthelmchartrepository in openshift console

Red Hat Red Hat OpenShift Container Platform 4.12; Red Hat Red Hat OpenShift Container Platform 4.13; Red Hat Red Hat OpenShift Container Platform 4.14; Red Hat Red Hat OpenShift Container Platform 4.15

A Server-Side Request Forgery and supply chain flaw was found in the OpenShift Console Helm catalog proxy. A namespace tenant can plant a ProjectHelmChartRepository with an arbitrary URL that the console pod fetches server-side, bypassing tenant egress restri…

7.8Alta
CVE-2026-72693

Kbd: local privilege escalation in openvt via incorrect process owner verification allowing passwordless root login

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 8; Red Hat Red Hat Enterprise Linux 9; Red Hat Red Hat OpenShift Container Platform 4.22

`openvt -u` is intended to identify the owner of the current VT and then execute `login` as that user from a privileged context. In the documented `kbrequest`/init usage, the ownership test in `authenticate_user()` relies on `stat("/proc/<pid>/fd/0")`. `stat(…

7.5Alta
CVE-2026-15816

Dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die()

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION; Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support

A flaw was found in dracut. The die() error-handling function writes its message into a shell script under the initramfs emergency-hook directory without properly shell-quoting it. When the message contains data derived from the DHCP ROOT_PATH option, an atta…

7.3Alta
CVE-2026-71226

Libkcapi: memory corruption via uncanceled aio requests on error in libkcapi's one-shot aio path

Stephan Muelle libkcapi; Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Red Hat Enterprise Linux 8

Memory Corruption via Uncanceled AIO Requests on Error: libkcapi's one-shot AIO path can return an error before all submitted IOCBs are drained, allowing later kernel writes into caller-owned output buffers.

7.6Alta
CVE-2026-16313

Sg3_utils: sg3_utils: arbitrary command execution via udev property injection in sg_inq --export

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support; Red Hat Red Hat Enterprise Linux 8

A flaw was found in sg3_utils. The sg_inq command, when invoked with the --export option, outputs device identification data without sanitizing control characters in SCSI name string fields. A newline character embedded in a device-supplied name string can in…

8.5Alta
CVE-2026-49332

Openshift/oauth-proxy: openshift/oauth-proxy: underscore header smuggling enables identity impersonation on wsgi/php upstreams

Red Hat Red Hat OpenShift Container Platform 4.12; Red Hat Red Hat OpenShift Container Platform 4.13; Red Hat Red Hat OpenShift Container Platform 4.14; Red Hat Red Hat OpenShift Container Platform 4.15

A flaw was found in openshift/oauth-proxy. The proxy sets authenticated identity headers using only dash-variant keys (X-Forwarded-User) but does not strip underscore-variant keys (X_Forwarded_User) from incoming requests. WSGI and PHP frameworks normalize bo…

7.5Alta
CVE-2026-16445

Dracut: dracut: root code execution via dhcp options command injection in networkmanager initrd module

Red Hat Red Hat Enterprise Linux 8; Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support; Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On; Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support

A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP options, such as a malicious root-path, next-server, or bootfile name, to a system using dracut's NetworkManager-based ini…

3.2%EPSS
7.3Alta
CVE-2026-12080

Qemu-kvm: qemu-guest-agent: local privilege escalation via symlink attack in guest-ssh-add-authorized-keys

Red Hat Red Hat Enterprise Linux 9; Red Hat Red Hat OpenShift Container Platform 4.22; Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 6

A flaw was found in the QEMU Guest Agent (qga). A local unprivileged user can exploit a vulnerability in the guest-ssh-add-authorized-keys command handler by manipulating symbolic links. This can occur either through a deterministic directory-symlink bypass o…

9.4Crítica
CVE-2026-16242

Hypershift: konnectivity proxy-server accepts agent connections without validating client certificates

Red Hat multicluster engine for Kubernetes 2.1; Red Hat multicluster engine for Kubernetes 2.11; Red Hat multicluster engine for Kubernetes 2.17; Red Hat multicluster engine for Kubernetes 2.6

A flaw was found in the Konnectivity proxy-server configuration for hosted control planes. The agent-facing listener was started without --cluster-ca-cert (and without token-based agent authentication), so client certificates were not validated. A remote atta…