Mirror Registry For Red Hat Openshift EUVD-2025-209308

The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L) indicates network-accessible, low-complexity exploitation requiring no privileges or user interaction, resulting in a 5.3 score reflecting limited confidentiality impact. The EPSS score and exploitation probability are not provided, preventing comparative risk assessment against exploit likelihood; however, user enumeration attacks are generally trivial to automate and require minimal skill. There is no CISA KEV status or public proof-of-concept documentation in the input, indicating no confirmed active exploitation at this time. While the attack surface is broad (unauthenticated, remote, low complexity), the real-world impact is moderate: user enumeration enables targeted phishing, credential stuffing, or social engineering campaigns against known valid accounts, but does not directly compromise authentication or data confidentiality. Organizations running older versions should prioritize patching, but this is not a critical vulnerability warranting emergency response.

An attacker sends authentication requests with common email addresses and usernames to the Mirror Registry login and account creation endpoints. By observing response differences (such as "user not found" versus "invalid password" error messages, HTTP status codes, or response timing), the attacker builds a list of valid registered users. This enumeration could then feed targeted phishing attacks against registry administrators or container pipeline operators, or credential stuffing attacks using breached password lists. The attack requires only HTTP network access to the registry and no authentication credentials.