Advanced Cluster Management For Kubernetes
Monthly
Token credential exposure in Red Hat insights-client causes the CCX_TOKEN bearer credential, used exclusively in disconnected cluster deployments, to be written in clear text to pod logs on every startup when glog verbosity is set to level 2 or higher. Any party with read access to pod logs or an aggregated logging backend can silently harvest this credential and use it to authenticate against the CCX API, extending access beyond the originating pod (CVSS scope change S:C). No public exploit is identified at time of analysis, and EPSS at 0.21% (11th percentile) combined with SSVC exploitation status of 'none' indicates this remains theoretical rather than actively targeted.
Sensitive credential leakage in Red Hat insights-client exposes cloud.openshift.com pull-secret tokens through application log files on Advanced Cluster Management hub clusters. When insights-client receives any non-200 HTTP response from the Red Hat cloud endpoint, it writes the full request headers - including the long-lived pull-secret bearer token - to pod logs readable by local cluster users. An attacker who harvests this token can authenticate against Red Hat cloud services without possessing their own credentials. No public exploit has been identified at time of analysis, and multiple vendor-released errata patch the behavior.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resources by rapidly opening and immediately canceling (RST_STREAM) large numbers of streams over a single connection, a technique dubbed the 'Rapid Reset' attack. The flaw is confirmed actively exploited (CISA KEV) following large-scale weaponization observed August through October 2023, with publicly available exploit code and an EPSS score of 94.45% placing it in the 100th percentile for likelihood of exploitation. Virtually every major HTTP/2 stack - including nghttp2, Netty, Envoy, and Eclipse Jetty - is affected.
Path traversal in Red Hat insights-client allows a compromised spoke (managed cluster) to inject unencoded sequences into the Insights API URL path by manipulating the ClusterID value it controls, redirecting authenticated hub-side requests to unintended API endpoints. Affected deployments include any multi-cluster Red Hat Insights configuration where a spoke cluster could be under adversary control. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Unbounded recursion in Nodemailer's address parser (npm package versions 3.0.0 through 7.0.10) allows a single crafted email address header to crash the Node.js process, causing a denial of service. Because nested RFC 5322 group syntax is not legal, the parser flattens nested groups by recursively re-invoking itself, and an attacker-controlled header containing many 'label:' colon tokens drives that recursion until the stack is exhausted and the runtime throws 'Maximum call stack size exceeded'. Exploitation requires no authentication, no user interaction, and no special configuration (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5), but it only works where an application passes untrusted address strings into the parser; publicly available exploit code exists, EPSS is low at 0.56% (44th percentile), and there is no confirmed active exploitation (no CISA KEV listing).
A security vulnerability in Red Hat Advanced Cluster Management (CVSS 5.5) that allows an unprivileged user. Remediation should follow standard vulnerability management procedures.
The grc-policy-propagator allows security escalation within the cluster. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
A vulnerability was found in the search-api container in Red Hat Advanced Cluster Management for Kubernetes when a query in the search filter gets parsed by the backend. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker to crash a server in certain circumstances involving AddHostKey. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A flaw was found in rhacm versions before 2.0.5 and before 2.1.0. Rated low severity (CVSS 3.5), this vulnerability is low attack complexity. No vendor patch available.
An issue was discovered in ManagedClusterView API, that could allow secrets to be disclosed to users without the correct permissions. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Token credential exposure in Red Hat insights-client causes the CCX_TOKEN bearer credential, used exclusively in disconnected cluster deployments, to be written in clear text to pod logs on every startup when glog verbosity is set to level 2 or higher. Any party with read access to pod logs or an aggregated logging backend can silently harvest this credential and use it to authenticate against the CCX API, extending access beyond the originating pod (CVSS scope change S:C). No public exploit is identified at time of analysis, and EPSS at 0.21% (11th percentile) combined with SSVC exploitation status of 'none' indicates this remains theoretical rather than actively targeted.
Sensitive credential leakage in Red Hat insights-client exposes cloud.openshift.com pull-secret tokens through application log files on Advanced Cluster Management hub clusters. When insights-client receives any non-200 HTTP response from the Red Hat cloud endpoint, it writes the full request headers - including the long-lived pull-secret bearer token - to pod logs readable by local cluster users. An attacker who harvests this token can authenticate against Red Hat cloud services without possessing their own credentials. No public exploit has been identified at time of analysis, and multiple vendor-released errata patch the behavior.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resources by rapidly opening and immediately canceling (RST_STREAM) large numbers of streams over a single connection, a technique dubbed the 'Rapid Reset' attack. The flaw is confirmed actively exploited (CISA KEV) following large-scale weaponization observed August through October 2023, with publicly available exploit code and an EPSS score of 94.45% placing it in the 100th percentile for likelihood of exploitation. Virtually every major HTTP/2 stack - including nghttp2, Netty, Envoy, and Eclipse Jetty - is affected.
Path traversal in Red Hat insights-client allows a compromised spoke (managed cluster) to inject unencoded sequences into the Insights API URL path by manipulating the ClusterID value it controls, redirecting authenticated hub-side requests to unintended API endpoints. Affected deployments include any multi-cluster Red Hat Insights configuration where a spoke cluster could be under adversary control. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Unbounded recursion in Nodemailer's address parser (npm package versions 3.0.0 through 7.0.10) allows a single crafted email address header to crash the Node.js process, causing a denial of service. Because nested RFC 5322 group syntax is not legal, the parser flattens nested groups by recursively re-invoking itself, and an attacker-controlled header containing many 'label:' colon tokens drives that recursion until the stack is exhausted and the runtime throws 'Maximum call stack size exceeded'. Exploitation requires no authentication, no user interaction, and no special configuration (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5), but it only works where an application passes untrusted address strings into the parser; publicly available exploit code exists, EPSS is low at 0.56% (44th percentile), and there is no confirmed active exploitation (no CISA KEV listing).
A security vulnerability in Red Hat Advanced Cluster Management (CVSS 5.5) that allows an unprivileged user. Remediation should follow standard vulnerability management procedures.
The grc-policy-propagator allows security escalation within the cluster. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
A vulnerability was found in the search-api container in Red Hat Advanced Cluster Management for Kubernetes when a query in the search filter gets parsed by the backend. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker to crash a server in certain circumstances involving AddHostKey. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A flaw was found in rhacm versions before 2.0.5 and before 2.1.0. Rated low severity (CVSS 3.5), this vulnerability is low attack complexity. No vendor patch available.
An issue was discovered in ManagedClusterView API, that could allow secrets to be disclosed to users without the correct permissions. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.