openshift 4.21 güvenlik açıkları (CVE)

6.8Orta

CVE-2026-114406 22 gün önce

Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION; Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support

The system certificate authority (CA) store in Red Hat products, distributed via ca-certificates RPM packages, included multiple root CA certificates of authorities, which signed intermediate CA certificates with weak private keys issued by the eMudhra certif…

8.8Yüksek

CVE-2026-104795 29 gün önce

Insights-runtime-extractor: insights-runtime-extractor: container escape via privileged binary execution

Red Hat Red Hat OpenShift Container Platform 4.19; Red Hat Red Hat OpenShift Container Platform 4.20; Red Hat Red Hat OpenShift Container Platform 4.21; Red Hat Red Hat OpenShift Container Platform 4.22

The insights-runtime-extractor runs as a privileged DaemonSet (`hostPID: true`) that scans container processes for runtime fingerprinting. When scanning a container, the coordinator: 1. **fork()s** a child process 2. **setns()** into the target container's P…

7.7Yüksek

CVE-2026-75888 1 ay önce

Openshift/console: openshift/console: authenticated ssrf via helm chart url fetch

Red Hat Red Hat OpenShift Container Platform 4.12; Red Hat Red Hat OpenShift Container Platform 4.14; Red Hat Red Hat OpenShift Container Platform 4.15; Red Hat Red Hat OpenShift Container Platform 4.16

A flaw was found in the OpenShift console. An authenticated console user can exploit a Server-Side Request Forgery (SSRF) vulnerability by providing a specially crafted Helm chart URL without proper validation. This allows the user to make the console pod fet…

7.7Yüksek

CVE-2026-93017 1 ay önce

Insights-operator: gather serviceaccount has cluster-wide secret read plus nodes/proxy and cluster-reader

Red Hat Red Hat OpenShift Container Platform 4.12; Red Hat Red Hat OpenShift Container Platform 4.14; Red Hat Red Hat OpenShift Container Platform 4.15; Red Hat Red Hat OpenShift Container Platform 4.16

The `insights-operator-gather` ClusterRole grants the operator's service account read access to secrets in the core API group with no namespace or resourceNames restriction — therefore, access to every secret in every namespace in the cluster. Ref: https://g…

6.8Orta

CVE-2026-107176 1 ay önce

Cluster-samples-operator: role reads all secrets in openshift-config, not just pull-secret

Red Hat Red Hat OpenShift Container Platform 4.19; Red Hat Red Hat OpenShift Container Platform 4.20; Red Hat Red Hat OpenShift Container Platform 4.21; Red Hat Red Hat OpenShift Container Platform 4.22

A flaw was found in the cluster-samples-operator. The RBAC Role coreos-pull-secret-reader in namespace openshift-config grants get, list, and watch permissions on all Secret resources without resourceNames scoping. The operator only requires access to the pul…

7.1Yüksek

CVE-2026-96577 1 ay önce

Oc-mirror__release-4.21: embedded local cache registry listens on all interfaces without authentication, with delete enabled

Red Hat Red Hat OpenShift Container Platform 4.18; Red Hat Red Hat OpenShift Container Platform 4.19; Red Hat Red Hat OpenShift Container Platform 4.20; Red Hat Red Hat OpenShift Container Platform 4.21

A flaw was found in oc-mirror. During mirroring operations, the embedded local cache registry binds to all network interfaces without authentication or encryption instead of restricting access to the local system. An unauthenticated attacker on an adjacent ne…

6.1Orta

CVE-2026-83589 1 ay önce

Oauth-proxy: open redirect via /\ and /\t bypass in post-login redirect

Red Hat Red Hat OpenShift Container Platform 4.12; Red Hat Red Hat OpenShift Container Platform 4.14; Red Hat Red Hat OpenShift Container Platform 4.15; Red Hat Red Hat OpenShift Container Platform 4.16

A flaw was found in oauth-proxy. The application fails to properly validate the destination redirect parameter (`rd`) during post-login redirection. A remote attacker can exploit this vulnerability by enticing a user to follow a specially crafted link, result…

7.1Yüksek

CVE-2026-87114 1 ay önce

Kube-compare: container:// reference extraction runs the image entrypoint and silently escalates to sudo

Red Hat Red Hat OpenShift Container Platform 4.19; Red Hat Red Hat OpenShift Container Platform 4.20; Red Hat Red Hat OpenShift Container Platform 4.21; Red Hat Red Hat OpenShift Container Platform 4.22

A flaw was found in kube-compare. When processing a 'container://' reference path, the tool incorrectly executes an untrusted container image's entrypoint instead of merely extracting data from a stopped container. This allows a remote attacker to achieve arb…

7.5Yüksek

CVE-2026-75887 1 ay önce

Openshift/console: openshift/console: unauthenticated path traversal in i18n locale handler

Red Hat Red Hat OpenShift Container Platform 4.12; Red Hat Red Hat OpenShift Container Platform 4.13; Red Hat Red Hat OpenShift Container Platform 4.14; Red Hat Red Hat OpenShift Container Platform 4.15

A flaw was found in the OpenShift console. An unauthenticated attacker can exploit a path traversal vulnerability by manipulating the `lng` and `ns` query parameters in the `/locales/resource.json` endpoint. This allows the attacker to read sensitive `*.json`…

7.2Yüksek

CVE-2026-75886 1 ay önce

Openshift/console: openshift/console: unauthenticated reverse proxy to in-cluster catalogd service with session token forwarding

Red Hat Red Hat OpenShift Container Platform 4.17; Red Hat Red Hat OpenShift Container Platform 4.18; Red Hat Red Hat OpenShift Container Platform 4.19; Red Hat Red Hat OpenShift Container Platform 4.20

A flaw was found in openshift/console. An unauthenticated remote attacker can exploit a misconfiguration in the CatalogdHandler, which lacks proper authentication, and the forwarding of the `openshift-session-token` cookie. This allows the attacker to send re…

9.3Kritik

CVE-2026-75885 1 ay önce

Openshift/console: openshift/console: unauthenticated ssrf and resource exhaustion via devfile parser endpoint

Red Hat Red Hat OpenShift Container Platform 4.12; Red Hat Red Hat OpenShift Container Platform 4.13; Red Hat Red Hat OpenShift Container Platform 4.14; Red Hat Red Hat OpenShift Container Platform 4.15

A flaw was found in the OpenShift console. Unauthenticated access to the `/api/devfile/` and `/api/devfile/samples/` endpoints allows a remote attacker to send crafted devfile payloads. This can lead to Server-Side Request Forgery (SSRF), where the console po…

7.5Yüksek

CVE-2026-49329 2 ay önce

Openshift/oauth-server: openshift/oauth-server: quadratic-time dos via accept-language header underscore bypass on unauthenticated login endpoints

Red Hat Red Hat OpenShift Container Platform 4.14; Red Hat Red Hat OpenShift Container Platform 4.15; Red Hat Red Hat OpenShift Container Platform 4.16; Red Hat Red Hat OpenShift Container Platform 4.18

A flaw was found in openshift/oauth-server. The OAuth login and error page endpoints pass the unauthenticated Accept-Language header to golang.org/x/text/language.ParseAcceptLanguage() without input validation. A bypass of the CVE-2022-32149 mitigation exists…

7.4Yüksek

CVE-2026-50236 3 ay önce

Openshift/console: authenticated ssrf with full response reflection and path neutralization via dev console webhook helpers in openshift console

Red Hat Red Hat OpenShift Container Platform 4.14; Red Hat Red Hat OpenShift Container Platform 4.15; Red Hat Red Hat OpenShift Container Platform 4.16; Red Hat Red Hat OpenShift Container Platform 4.17

An authenticated SSRF flaw was found in the OpenShift Console Dev Console webhook helpers. User-supplied target URLs are fetched server-side without validation, with path neutralization enabling arbitrary endpoint targeting and full response reflection from t…

7.4Yüksek

CVE-2026-50237 3 ay önce

Openshift/console: namespace tenant ssrf with egress bypass, catalog poisoning, and admin-mediated supply chain escalation via projecthelmchartrepository in openshift console

Red Hat Red Hat OpenShift Container Platform 4.12; Red Hat Red Hat OpenShift Container Platform 4.13; Red Hat Red Hat OpenShift Container Platform 4.14; Red Hat Red Hat OpenShift Container Platform 4.15

A Server-Side Request Forgery and supply chain flaw was found in the OpenShift Console Helm catalog proxy. A namespace tenant can plant a ProjectHelmChartRepository with an arbitrary URL that the console pod fetches server-side, bypassing tenant egress restri…

7.5Yüksek

CVE-2026-15816 3 ay önce

Dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die()

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION; Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support

A flaw was found in dracut. The die() error-handling function writes its message into a shell script under the initramfs emergency-hook directory without properly shell-quoting it. When the message contains data derived from the DHCP ROOT_PATH option, an atta…

7.6Yüksek

CVE-2026-16313 3 ay önce

Sg3_utils: sg3_utils: arbitrary command execution via udev property injection in sg_inq --export

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support; Red Hat Red Hat Enterprise Linux 8

A flaw was found in sg3_utils. The sg_inq command, when invoked with the --export option, outputs device identification data without sanitizing control characters in SCSI name string fields. A newline character embedded in a device-supplied name string can in…

8.5Yüksek

CVE-2026-49332 3 ay önce

Openshift/oauth-proxy: openshift/oauth-proxy: underscore header smuggling enables identity impersonation on wsgi/php upstreams

Red Hat Red Hat OpenShift Container Platform 4.12; Red Hat Red Hat OpenShift Container Platform 4.13; Red Hat Red Hat OpenShift Container Platform 4.14; Red Hat Red Hat OpenShift Container Platform 4.15

A flaw was found in openshift/oauth-proxy. The proxy sets authenticated identity headers using only dash-variant keys (X-Forwarded-User) but does not strip underscore-variant keys (X_Forwarded_User) from incoming requests. WSGI and PHP frameworks normalize bo…

9.4Kritik

CVE-2026-16242 3 ay önce

Hypershift: konnectivity proxy-server accepts agent connections without validating client certificates

Red Hat multicluster engine for Kubernetes 2.1; Red Hat multicluster engine for Kubernetes 2.11; Red Hat multicluster engine for Kubernetes 2.17; Red Hat multicluster engine for Kubernetes 2.6

A flaw was found in the Konnectivity proxy-server configuration for hosted control planes. The agent-facing listener was started without --cluster-ca-cert (and without token-based agent authentication), so client certificates were not validated. A remote atta…

7.8Yüksek

CVE-2026-15809 4 ay önce

Github.com/cri-o/cri-o: fix bypass for cve-2022-4318 — /etc/passwd injection via home env

Red Hat Red Hat OpenShift Container Platform 4.12; Red Hat Red Hat OpenShift Container Platform 4.13; Red Hat Red Hat OpenShift Container Platform 4.14; Red Hat Red Hat OpenShift Container Platform 4.15

A flaw was found in CRI-O. The fix for a previous vulnerability (CVE-2022-4318) was incorrect, allowing it to be bypassed. An attacker capable of setting environment variables on a container can inject a newline character into the HOME environment variable. T…

8.0Yüksek

CVE-2026-14476 4 ay önce

Sssd: sssd: gpo cache path traversal via unsanitized gpcfilesyspath allows kerberos authentication bypass

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support; Red Hat Red Hat Enterprise Linux 8

A path traversal flaw was found in SSSD's AD GPO provider. The ad_gpo_extract_smb_components() function does not sanitize .. sequences in the gPCFileSysPath LDAP attribute, allowing an attacker with AD GPO management access to write files outside the GPO cach…

8.8Yüksek

CVE-2026-14474 4 ay önce

Sssd: sssd: sudo ldap provider searches entire directory tree for sudorole objects by default, enabling privilege escalation

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support; Red Hat Red Hat Enterprise Linux 8

A flaw was found in SSSD's LDAP sudo provider. When the ldap_sudo_search_base option is not explicitly configured, SSSD searches the entire LDAP directory tree for sudoRole objects. An authenticated attacker with write access to any subtree can inject a sudoR…

7.5Yüksek

CVE-2026-14164 4 ay önce

Libarchive: double-free vulnerability in rar5 decompression logic via dangling filtered_buf pointer in init_unpack()

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Red Hat Enterprise Linux 9; Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

A double free issue has been identified in libarchive's RAR5 reader. During parsing of a specially crafted RAR5 archive, the filtered_buf pointer may remain stale after being freed during unpacking state reinitialization. Subsequent processing of another arch…

7.5Yüksek

CVE-2026-13676 4 ay önce

fast-uri vulnerable to host confusion via failed IDN canonicalization

fast-uri fast-uri; Red Hat Red Hat AMQ Broker 7.13.6; Red Hat Red Hat AMQ Broker 7.14.1; Red Hat Red Hat Enterprise Linux 10

fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs. The IDN conversion path calls a helper that does not exist on the global URL constructor, silently leaving the host in its original Unicode form…

7.8Yüksek

CVE-2026-46331 4 ay önce

net/sched: fix pedit partial COW leading to page cache corruption

Linux Linux; Red Hat NVIDIA for RHEL 10; Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support

In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the …

9.3Kritik

CVE-2026-44990 5 ay önce

Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html`

apostrophecms sanitize-html; Red Hat multicluster engine for Kubernetes 2.1; Red Hat multicluster engine for Kubernetes 2.11; Red Hat multicluster engine for Kubernetes 2.17

ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Under the default configuration, versions of `sanitize-html` prior to 2.17.4 can turn attacker-controlled content inside a …