EUVD-2026-33275
GHSA-76ww-43j5-78x5
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Lifecycle Timeline
1DescriptionCVE.org
A flaw was found in the OpenShift Router. A user with EndpointSlice write access can exploit this vulnerability by creating a Service backed by an FQDN (Fully Qualified Domain Name) EndpointSlice that resolves to a cloud metadata endpoint. This allows the router to proxy requests to the cloud metadata endpoint, leading to the disclosure of instance credentials and other sensitive metadata. This bypasses previous security measures for validating IP addresses.
AnalysisAI
Server-side request forgery in Red Hat OpenShift Container Platform 4's Router component allows authenticated users with EndpointSlice write permissions to coerce the router into proxying requests to cloud provider instance metadata endpoints (e.g., 169.254.169.254), exposing instance credentials and sensitive metadata. The flaw bypasses prior IP-address-based validation by abusing FQDN-backed EndpointSlices that resolve to metadata services. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated OpenShift user (PR:L) with RBAC permission to create or update EndpointSlice (and typically Service/Route) objects in at least one namespace on a target OpenShift Container Platform 4 cluster; the cluster must be deployed on a cloud provider exposing an instance metadata service reachable from the router pods (e.g., AWS, Azure, GCP) - on-premise clusters without such an endpoint are not exploitable for credential disclosure. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) reflects a network-reachable, low-complexity attack requiring low privileges, with a scope change and high confidentiality impact - consistent with SSRF leaking cloud credentials across a trust boundary. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with a low-privileged OpenShift account that holds EndpointSlice write permission in any namespace creates a Service plus an EndpointSlice whose addressType is FQDN and whose endpoint resolves (via attacker-controlled DNS or a public record) to 169.254.169.254. The attacker then sends an HTTP request through the cluster's exposed Router to a route mapped at that Service; the router proxies the request to the cloud metadata endpoint and returns IAM credentials for the underlying node, which the attacker uses to pivot into the cloud account. |
| Remediation | Patch available per vendor advisory: apply the OpenShift Container Platform 4 update referenced in https://access.redhat.com/security/cve/CVE-2026-42965 for your supported channel, and track the Bugzilla entry https://bugzilla.redhat.com/show_bug.cgi?id=2483184 for the exact z-stream fix versions. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Audit all users and service accounts with EndpointSlice write permissions across OpenShift 4 clusters; document current access. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More from same product – last 7 days
Out-of-bounds heap write in QEMU's virtio-blk device allows a high-privileged guest to crash the host QEMU process. The
Heap out-of-bounds read in MIT krb5's LDAP KDB plugin allows a compromised or malicious LDAP backend to crash the KDC or
Vendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today