IP-DB.com
Türkçe English Deutsch Español
Entrar Obtener clave API

Vulnerabilidades de openshift 4.15 (CVE)

Registros CVE publicados para openshift 4.15, los más recientes primero. Siga el producto para recibir un correo con cada nueva.

114 resultados
7.4Alta
CVE-2026-92092

Openshift-ansible: openshift-ansible: installer container downloads and executes remote inventory script without integrity verification

Red Hat Red Hat OpenShift Container Platform 4.14; Red Hat Red Hat OpenShift Container Platform 4.15; Red Hat Red Hat OpenShift Container Platform 4.16; Red Hat Red Hat OpenShift Container Platform 4.17

A flaw was found in openshift-ansible. The installer container's `run` script downloads and executes remote inventory and dynamic scripts without integrity verification. A remote attacker, by performing a Man-in-the-Middle (MITM) attack or compromising the HT…

7.7Alta
CVE-2026-75888

Openshift/console: openshift/console: authenticated ssrf via helm chart url fetch

Red Hat Red Hat OpenShift Container Platform 4.12; Red Hat Red Hat OpenShift Container Platform 4.13; Red Hat Red Hat OpenShift Container Platform 4.14; Red Hat Red Hat OpenShift Container Platform 4.15

A flaw was found in the OpenShift console. An authenticated console user can exploit a Server-Side Request Forgery (SSRF) vulnerability by providing a specially crafted Helm chart URL without proper validation. This allows the user to make the console pod fet…

7.7Alta
CVE-2026-93017

Insights-operator: gather serviceaccount has cluster-wide secret read plus nodes/proxy and cluster-reader

Red Hat Red Hat OpenShift Container Platform 4.12; Red Hat Red Hat OpenShift Container Platform 4.13; Red Hat Red Hat OpenShift Container Platform 4.14; Red Hat Red Hat OpenShift Container Platform 4.15

The `insights-operator-gather` ClusterRole grants the operator's service account read access to secrets in the core API group with no namespace or resourceNames restriction — therefore, access to every secret in every namespace in the cluster. Ref: https://g…

6.1Media
CVE-2026-83589

Oauth-proxy: open redirect via /\ and /\t bypass in post-login redirect

Red Hat Red Hat OpenShift Container Platform 4.12; Red Hat Red Hat OpenShift Container Platform 4.13; Red Hat Red Hat OpenShift Container Platform 4.14; Red Hat Red Hat OpenShift Container Platform 4.15

A flaw was found in oauth-proxy. The application fails to properly validate the destination redirect parameter (`rd`) during post-login redirection. A remote attacker can exploit this vulnerability by enticing a user to follow a specially crafted link, result…

7.3Alta
CVE-2026-101295

Oc-mirror: oc-mirror: path traversal / arbitrary file write in operator catalog image extraction

Red Hat Red Hat OpenShift Container Platform 4.13; Red Hat Red Hat OpenShift Container Platform 4.15; Red Hat Red Hat OpenShift Container Platform 4.17; Red Hat Assisted Installer for Red Hat OpenShift Container Platform 2

Path traversal / arbitrary file write in oc-mirror's operator catalog image extraction. When mirroring operator catalogs using either the legacy v1 path (--v1) or the OCI feature path (--use-oci-feature), oc-mirror extracts tar entries from catalog image laye…

7.5Alta
CVE-2026-75887

Openshift/console: openshift/console: unauthenticated path traversal in i18n locale handler

Red Hat Red Hat OpenShift Container Platform 4.12; Red Hat Red Hat OpenShift Container Platform 4.13; Red Hat Red Hat OpenShift Container Platform 4.14; Red Hat Red Hat OpenShift Container Platform 4.15

A flaw was found in the OpenShift console. An unauthenticated attacker can exploit a path traversal vulnerability by manipulating the `lng` and `ns` query parameters in the `/locales/resource.json` endpoint. This allows the attacker to read sensitive `*.json`…

9.3Crítica
CVE-2026-75885

Openshift/console: openshift/console: unauthenticated ssrf and resource exhaustion via devfile parser endpoint

Red Hat Red Hat OpenShift Container Platform 4.12; Red Hat Red Hat OpenShift Container Platform 4.13; Red Hat Red Hat OpenShift Container Platform 4.14; Red Hat Red Hat OpenShift Container Platform 4.15

A flaw was found in the OpenShift console. Unauthenticated access to the `/api/devfile/` and `/api/devfile/samples/` endpoints allows a remote attacker to send crafted devfile payloads. This can lead to Server-Side Request Forgery (SSRF), where the console po…

7.5Alta
CVE-2026-49329

Openshift/oauth-server: openshift/oauth-server: quadratic-time dos via accept-language header underscore bypass on unauthenticated login endpoints

Red Hat Red Hat OpenShift Container Platform 4.13; Red Hat Red Hat OpenShift Container Platform 4.14; Red Hat Red Hat OpenShift Container Platform 4.15; Red Hat Red Hat OpenShift Container Platform 4.16

A flaw was found in openshift/oauth-server. The OAuth login and error page endpoints pass the unauthenticated Accept-Language header to golang.org/x/text/language.ParseAcceptLanguage() without input validation. A bypass of the CVE-2022-32149 mitigation exists…

7.4Alta
CVE-2026-50236

Openshift/console: authenticated ssrf with full response reflection and path neutralization via dev console webhook helpers in openshift console

Red Hat Red Hat OpenShift Container Platform 4.14; Red Hat Red Hat OpenShift Container Platform 4.15; Red Hat Red Hat OpenShift Container Platform 4.16; Red Hat Red Hat OpenShift Container Platform 4.17

An authenticated SSRF flaw was found in the OpenShift Console Dev Console webhook helpers. User-supplied target URLs are fetched server-side without validation, with path neutralization enabling arbitrary endpoint targeting and full response reflection from t…

7.4Alta
CVE-2026-50237

Openshift/console: namespace tenant ssrf with egress bypass, catalog poisoning, and admin-mediated supply chain escalation via projecthelmchartrepository in openshift console

Red Hat Red Hat OpenShift Container Platform 4.12; Red Hat Red Hat OpenShift Container Platform 4.13; Red Hat Red Hat OpenShift Container Platform 4.14; Red Hat Red Hat OpenShift Container Platform 4.15

A Server-Side Request Forgery and supply chain flaw was found in the OpenShift Console Helm catalog proxy. A namespace tenant can plant a ProjectHelmChartRepository with an arbitrary URL that the console pod fetches server-side, bypassing tenant egress restri…

7.5Alta
CVE-2026-15816

Dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die()

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION; Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support

A flaw was found in dracut. The die() error-handling function writes its message into a shell script under the initramfs emergency-hook directory without properly shell-quoting it. When the message contains data derived from the DHCP ROOT_PATH option, an atta…

7.6Alta
CVE-2026-16313

Sg3_utils: sg3_utils: arbitrary command execution via udev property injection in sg_inq --export

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support; Red Hat Red Hat Enterprise Linux 8

A flaw was found in sg3_utils. The sg_inq command, when invoked with the --export option, outputs device identification data without sanitizing control characters in SCSI name string fields. A newline character embedded in a device-supplied name string can in…

8.5Alta
CVE-2026-49332

Openshift/oauth-proxy: openshift/oauth-proxy: underscore header smuggling enables identity impersonation on wsgi/php upstreams

Red Hat Red Hat OpenShift Container Platform 4.12; Red Hat Red Hat OpenShift Container Platform 4.13; Red Hat Red Hat OpenShift Container Platform 4.14; Red Hat Red Hat OpenShift Container Platform 4.15

A flaw was found in openshift/oauth-proxy. The proxy sets authenticated identity headers using only dash-variant keys (X-Forwarded-User) but does not strip underscore-variant keys (X_Forwarded_User) from incoming requests. WSGI and PHP frameworks normalize bo…

9.4Crítica
CVE-2026-16242

Hypershift: konnectivity proxy-server accepts agent connections without validating client certificates

Red Hat multicluster engine for Kubernetes 2.1; Red Hat multicluster engine for Kubernetes 2.11; Red Hat multicluster engine for Kubernetes 2.17; Red Hat multicluster engine for Kubernetes 2.6

A flaw was found in the Konnectivity proxy-server configuration for hosted control planes. The agent-facing listener was started without --cluster-ca-cert (and without token-based agent authentication), so client certificates were not validated. A remote atta…

7.8Alta
CVE-2026-15809

Github.com/cri-o/cri-o: fix bypass for cve-2022-4318 — /etc/passwd injection via home env

Red Hat Red Hat OpenShift Container Platform 4.12; Red Hat Red Hat OpenShift Container Platform 4.13; Red Hat Red Hat OpenShift Container Platform 4.14; Red Hat Red Hat OpenShift Container Platform 4.15

A flaw was found in CRI-O. The fix for a previous vulnerability (CVE-2022-4318) was incorrect, allowing it to be bypassed. An attacker capable of setting environment variables on a container can inject a newline character into the HOME environment variable. T…

8.0Alta
CVE-2026-14476

Sssd: sssd: gpo cache path traversal via unsanitized gpcfilesyspath allows kerberos authentication bypass

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support; Red Hat Red Hat Enterprise Linux 8

A path traversal flaw was found in SSSD's AD GPO provider. The ad_gpo_extract_smb_components() function does not sanitize .. sequences in the gPCFileSysPath LDAP attribute, allowing an attacker with AD GPO management access to write files outside the GPO cach…

8.8Alta
CVE-2026-14474

Sssd: sssd: sudo ldap provider searches entire directory tree for sudorole objects by default, enabling privilege escalation

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support; Red Hat Red Hat Enterprise Linux 8

A flaw was found in SSSD's LDAP sudo provider. When the ldap_sudo_search_base option is not explicitly configured, SSSD searches the entire LDAP directory tree for sudoRole objects. An authenticated attacker with write access to any subtree can inject a sudoR…

5.9Media
CVE-2026-58015

Glib: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receive

GNOME GLib; Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support

A flaw was found in GLib. The D-Bus client-side implementation of the DBUS_COOKIE_SHA1 SASL authentication mechanism does not validate the cookie_context parameter received from the server. A malicious D-Bus server can supply a cookie_context containing path …

7.3Alta
CVE-2026-58014

Glib: off-by-one error in glib/gkeyfile.c via "g_key_file_get_locale_string_list"

GNOME GLib; Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support

A flaw was found in GLib. An off-by-one error can occur in the g_key_file_get_locale_string_list function in the gkeyfile.c file when loading a key file with an empty value. This flaw can cause an out-of-bounds access of 1 byte or a denial of service when the…

7.5Alta
CVE-2026-14164

Libarchive: double-free vulnerability in rar5 decompression logic via dangling filtered_buf pointer in init_unpack()

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Red Hat Enterprise Linux 9; Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

A double free issue has been identified in libarchive's RAR5 reader. During parsing of a specially crafted RAR5 archive, the filtered_buf pointer may remain stale after being freed during unpacking state reinitialization. Subsequent processing of another arch…

7.8Alta
CVE-2026-46331

net/sched: fix pedit partial COW leading to page cache corruption

Linux Linux; Red Hat NVIDIA for RHEL 10; Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support

In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the …

7.5Alta
CVE-2026-44486

Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection

axios axios; Red Hat Red Hat AMQ Broker 7.13.6; Red Hat Red Hat AMQ Broker 7.14.1; Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8

Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’ Node.js HTTP adapter can leak proxy credentials to a redirect target in affected versions. When a request is sent through an authenticated proxy, Axios may ad…

8.2Alta
CVE-2026-44487

Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter

axios axios; Red Hat Red Hat AMQ Broker 7.13.6; Red Hat Red Hat AMQ Broker 7.14.1; Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8

Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’s Node.js HTTP adapter may forward a Proxy-Authorization header to a redirected origin during specific proxy-to-direct redirect flows. This affects Node.js usa…

7.5Alta
CVE-2026-44488

Axios: Allocation of Resources Without Limits or Throttling in axios

axios axios; Red Hat Red Hat AMQ Broker 7.13.6; Red Hat Red Hat AMQ Broker 7.14.1; Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8

Axios is a promise based HTTP client for the browser and Node.js. Axios versions 1.7.0 through 1.15.x did not enforce configured request and response size limits when requests were sent with the fetch adapter. Applications that selected adapter: 'fetch', or r…

7.5Alta
CVE-2026-44496

Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection

axios axios; Red Hat Red Hat AMQ Broker 7.13.6; Red Hat Red Hat AMQ Broker 7.14.1; Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8

Axios is a promise based HTTP client for the browser and Node.js. Axios versions before 0.32.0 on the 0.x line and before 1.16.0 on the 1.x line build a regular expression from the configured XSRF cookie name without escaping regex metacharacters. In standard…

5.4%EPSS