Openshift
Monthly
Improper authentication in the OpenShift Console's CatalogdHandler allows unauthenticated remote attackers to forward the openshift-session-token cookie and send requests to the in-cluster catalogd service, disclosing the internal operator-catalog index and providing a relay into the openshift-catalogd namespace (CVE-2026-75886, CVSS 7.2). This affects Red Hat OpenShift Container Platform 4. No public exploit identified at time of analysis; exploitation requires network reachability to the exposed console endpoint.
Privilege escalation in Red Hat Ansible Automation Platform 2 (built on the AWX upstream project) lets an authenticated AAP platform administrator escape the container-group sandbox and obtain OpenShift namespace-level access, including the ability to read and exfiltrate namespace secrets. The flaw is reachable over the network (AV:N) with no user interaction (UI:N) and changes scope across the container/namespace boundary (S:C), but it is gated on the highest AAP privilege tier (PR:H), so it is an insider or compromised-admin scenario rather than an unauthenticated attack; only deployments that use container groups backed by OpenShift/Kubernetes are exposed. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); no vendor-released patch has been identified at time of analysis, so mitigation depends on restricting the vulnerable field or the administrators who can reach it.
Unauthenticated remote attackers can manipulate SQL database queries in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift, giving them a high-integrity impact with limited confidentiality and availability effects on affected payments-processing deployments. The flaw is a boolean-based blind SQL injection rooted in improper neutralization of special elements in a boolean expression (CWE-74), exploitable over the network with low complexity and no authentication or user interaction per the assessed CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L (base 8.2). No public exploit code has been identified and there is no confirmation of active exploitation; IBM has published a vendor advisory containing patch guidance, but affected version ranges are expressed as a wildcard CPE, so defenders must match their specific build against IBM's advisory to determine exposure.
Unauthenticated insertion of malicious runbook content into the vector database backing IBM Financial Transaction Manager (FTM) for Red Hat OpenShift's AI agent allows retrieval-augmented generation (RAG) poisoning that can steer AI-driven MCP tool calls toward unauthorized payment actions or exfiltration of payment data. IBM self-rates the issue CVSS 7.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L), reflecting unauthenticated network reachability and low attack complexity rather than high per-impact severity, since the realized effect is mediated by LLM behavior and is probabilistic rather than deterministic. The flaw is rooted in CWE-74 at api.vectordb.runbooks.js:51; no public exploit code identified at time of analysis and the issue is not tied to confirmed active exploitation, with exposure limited to deployments where the FTM AI agent endpoint is network-accessible and the agent has MCP tools wired to payment-affecting actions.
Stored cross-site scripting in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift allows an attacker with adjacent-network positioning to plant script inside stored network acknowledgement data, which then executes in the browsers of authenticated FTM operators and can lead to session hijacking and unauthorised operator-level payment actions. The flaw sits in the NetworkAcknowledgement React component (NetworkAcknowledgement.jsx:42), which renders stored acknowledgement content without adequate output encoding. The vendor rates it 9.3, while the assessed vector is CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N, where the requirement that a legitimate operator open the affected view is the practical limiting factor; no public exploit code and no confirmed active exploitation were identified at time of analysis, but the payments context and scope change keep the impact ceiling high.
Unauthenticated remote code execution in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift allows an attacker positioned on an adjacent network segment to send a crafted Java-serialized payload to the PayDir Business Rules Manager RMI SSL endpoint and execute arbitrary code on the target host. Because the vulnerable service is exposed with no authentication and no user interaction required (CVSS 8.8, AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), successful exploitation exposes all PayDir credentials and enables manipulation of payment business rules, producing high confidentiality and integrity impact. The adjacency requirement is the primary limiting factor, and no public exploit identified at time of analysis; a vendor patch is available per the IBM advisory.
Missing authentication for a critical function in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift allows a remote, unauthenticated attacker to read sensitive information and modify system configurations on an affected deployment. With CVSS 7.3 (AV:N/AC:L/PR:N/UI:N), no credentials, user interaction, or non-default configuration are required, so any network-reachable FTM instance with the vulnerable function exposed is at risk; exploitation is limited chiefly by FTM's narrow enterprise-payments install base and whether that endpoint is actually reachable. No public exploit code has been identified at time of analysis, and IBM has released a patch.
XML external entity (XXE) injection in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift allows an unauthenticated attacker positioned on an adjacent network segment to submit crafted XML that the product's parser resolves against external entities, resulting in disclosure of server-side files or server-side request forgery against internal services. The CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, 7.4 High) requires no credentials and no user interaction, but the adjacent-network attack vector and the confidentiality-only impact mean exploitation depends heavily on whether an XML-accepting endpoint is reachable from an untrusted same-segment network and on what sensitive files or internal services are reachable from the server context. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (no CISA KEV listing), and IBM has published a patch advisory; despite the High score this is a moderate-priority issue that should not be over-prioritized relative to internet-reachable, integrity- or availability-impacting flaws.
Authentication bypass and sensitive-information disclosure in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift stem from a hard-coded cryptographic key (CWE-321) embedded in the product, scoring 8.1 (High) with the vector AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. Because the key is embedded and therefore shared across deployments, an unauthenticated attacker who is positioned on the same adjacent network as an affected OpenShift deployment can bypass authentication and read or tamper with sensitive financial-transaction data, with no user interaction required; the assessment notes this is not confirmed as directly reachable from the public internet despite the description's 'remote attacker' phrasing. A vendor patch is available, and no public exploit code has been identified at time of analysis.
Cleartext transmission of sensitive information in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift can expose financial transaction data to passive interception by an attacker who is positioned on the adjacent network path carrying the affected traffic. Only deployments where a sensitive channel lacks properly configured transport encryption (for example, TLS disabled or misconfigured) are exposed; where channels are protected end to end, the flaw does not arise. Cisco-style remote internet exploitation is not the scenario here, and no public exploit code or confirmed active exploitation was identified at time of analysis. Our independent assessment rates this as a real but low-priority issue, with an assessed vector of CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - adjacent-network access plus a cleartext deployment are both required, making successful exploitation contingent on deployment configuration.
Sensitive information disclosure in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift stems from the product's use of a hard-coded or predictable cryptographic key (CWE-321). Per the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, 7.5), an unauthenticated remote attacker who obtains that static key can read data the product intended to protect, with no integrity or availability impact. The real gate is acquiring or deriving the embedded key rather than defeating authentication: no public exploit identified at time of analysis, EPSS is only 0.26% (17th percentile), and CISA SSVC records exploitation as none with Automatable set to no, making this a moderate, not urgent, priority.
Hard-coded cryptographic keys and initialization vectors in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift allow a remote authenticated attacker (CVSS 3.1 PR:L, 7.1 overall) to decrypt protected sensitive information and forge authentication tags, because the same static key material is baked into every deployment rather than generated per installation. Affected builds are the OpenShift-packaged FTM at 4.0.6.0 (including Interim Fixes 1 through 6) and, per ENISA EUVD, the 4.0.7.0 through 4.0.10.0 Interim Fix 06 range; the decisive prerequisite is compromise of a low-privilege account, and impact is primarily confidentiality with only partial integrity (C:H/I:L/A:N) and no availability loss. Exploitation is currently assessed as none - no public exploit code identified at time of analysis, EPSS only 0.22% (13th percentile), CISA SSVC exploitation "none", automatable "no" - which makes this a moderate-severity, lower-priority issue in practice.
Message forgery in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift lets remote, unauthenticated attackers send messages bearing forged cryptographic signatures that the platform improperly accepts as authentic, undermining the integrity of trusted transaction messaging (CWE-347, CVSS 7.5, integrity-only impact with no confidentiality or availability loss). Affected releases are the 4.0.6.0 line, including Interim Fixes 1 through 6, plus 4.0.7.0, 4.0.8.0, 4.0.9.0 and 4.0.10.0 Interim Fix 06. Exploitation is remote and requires no authentication or user interaction (PR:N/UI:N) but demands that an attacker understand and correctly craft a message in FTM's expected format and that an FTM message interface be reachable; there is no public exploit identified at time of analysis (EPSS 0.19%, 9th percentile), CISA SSVC rates exploitation as none and automatable as no, and there is no KEV listing.
Remote code execution via ESQL command injection affects IBM Financial Transaction Manager (FTM) for Red Hat OpenShift, where externally supplied input is combined into ESQL statements without neutralization of special elements. Per IBM PSIRT scoring (CVSS 8.1, AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), an unauthenticated remote attacker who can reach a vulnerable FTM message flow that builds ESQL commands from attacker-controlled data can achieve full confidentiality, integrity, and availability impact within the FTM runtime and its connected resources. The high attack-complexity rating reflects a non-default precondition - typically a specific flow or configuration that routes untrusted data into ESQL - so exposure is limited to environments running FTM on OpenShift with such a flow. No public exploit code identified at time of analysis and the issue is not listed in CISA KEV; EPSS data was not provided.
Cleartext transmission of sensitive information in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift exposes transaction data, credentials, or other confidential payloads to anyone able to observe network traffic on the same segment. The issue affects deployments of FTM for OpenShift where the relevant transport is not wrapped in TLS; an unauthenticated attacker with an adjacent-network position (per the assessed vector PR:N, AV:A) can passively capture that traffic, though a successful capture depends on the specific unencrypted channel being in use (AC:H), which is why the independently assessed impact is limited to confidentiality only. No public exploit code has been identified at time of analysis, and there is no indication of active exploitation, so this remains a low-real-world-priority issue despite the headline 7.5 (High) CVSS score.
Improper restriction of XML external entity references in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift allows an attacker positioned on an adjacent network segment - or elsewhere within the same cluster network - to read sensitive files and internal resources by submitting a crafted XML document to an FTM parsing endpoint. The assessed CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, 7.4 High) confirms the exploitation requirements: no credentials and no user interaction are needed, but the adjacent-network prerequisite rather than an internet-facing vector meaningfully narrows the attacker population, and impact is confined strictly to confidentiality with no integrity or availability effect. There is no public exploit identified at time of analysis, no EPSS signal or CISA KEV listing is present in the provided data, and IBM has published a vendor advisory with a patch available for this CWE-611 flaw.
IBM Financial Transaction Manager (FTM) for Red Hat OpenShift fails to properly validate symbolic links, allowing an authenticated remote user to read files outside the intended path and disclose sensitive information held by the financial platform. The affected code path is reachable across the network (AV:N) but requires a valid FTM session (PR:L), and no public exploit code or confirmed active exploitation has been identified at time of analysis. IBM has published a vendor patch via its support portal; while the vendor-assigned CVSS of 9.9 implies a scope-changing, high-integrity and high-availability impact, independent analysis of the described weakness assesses it as an information-disclosure issue (file read) rather than full system compromise.
Unauthenticated remote code execution is possible in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift because the product improperly deserializes untrusted data (CWE-502), allowing a remote attacker who can reach a vulnerable endpoint to execute arbitrary code with the privileges of the affected service. IBM rates the flaw CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning no authentication, no user interaction and only network reachability are required, so any default-exposed FTM instance is at risk; the practical limiting factor is exposure, since FTM is specialized financial middleware normally deployed inside enterprise OpenShift clusters rather than on the public internet. Patch available per vendor advisory; no public exploit identified at time of analysis (no CISA KEV listing and no POC reporting in the available intelligence), though deserialization RCE is a well-understood and reliably weaponizable bug class once reachability exists.
Remote code execution in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift lets an unauthenticated network attacker run arbitrary code on affected deployments. The flaw is CWE-94 (improper control of code generation): user-controlled input is passed into a JavaScript `new Function()` constructor without neutralization, so injected input is compiled and executed as code. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) no credentials, privileges, or victim interaction are required - only network reach to the vulnerable code path. No public exploit code has been identified at time of analysis, and there is no confirmed active exploitation (CISA KEV); the practical limiting factor is exposure, since the specific input-handling routine must be reachable and FTM's narrow financial-services enterprise footprint constrains the target population.
Authenticated remote code execution affects IBM Financial Transaction Manager (FTM) for Red Hat OpenShift, where a buffer overflow (out-of-bounds write) in an FTM component lets an attacker with valid low-privilege credentials submit crafted input and gain code execution in the containerized transaction platform. The vendor rates this 8.5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H), and our independent assessment concurs on high confidentiality and integrity impact while treating the scope change as unproven (S:U). Exploitation requires authentication (PR:L) and is not considered reliably repeatable on the first attempt (AC:H), and no public exploit identified at time of analysis. A vendor patch is available per IBM advisory node/7288641, so organizations running FTM on OpenShift should treat this as a priority patch action for their FTM estate.
Remote, unauthenticated attackers who can reach the application endpoints of IBM Financial Transaction Manager (FTM) for Red Hat OpenShift can perform unauthorized actions because the software fails to properly authenticate requests and subsequently omits authorization checks. Affected deployments are those running versions 4.0.6.0 through 4.0.10.0 Interim Fix 064, including Operator 4.4.6+20260807.081800 and the 4.0.6.0 Refresh build, per the EUVD version list. Impact is confined to integrity - attackers can trigger unauthorized operations or modify data, but there is no confidentiality or availability consequence per the assessed CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N), and there is no public exploit identified at time of analysis, with EPSS at only 0.60% (47th percentile) and CISA SSVC recording no observed exploitation.
Server-side request forgery (CWE-918) in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift at affected levels allows an authenticated local attacker to coerce the FTM server into issuing attacker-influenced requests, yielding disclosure of sensitive information and enabling unauthorized actions - rated CVSS 3.1 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), high confidentiality and integrity impact with no availability impact. Exploitation requires a deployed affected FTM instance plus valid low-privilege authenticated access reachable locally (the vector is local, not internet-facing, and user interaction is not required); no public exploit code has been identified at time of analysis and EPSS is 0.15% (5th percentile), while CISA SSVC records Exploitation: none and Automatable: no. This is a moderate-priority, not a drop-everything, issue: the niche financial middleware footprint, locally-scoped vector, and mandatory authentication mean an unauthenticated external attacker cannot exploit it directly against a default internet-facing posture. A vendor patch is available.
IBM Financial Transaction Manager (FTM) for Red Hat OpenShift contains a command execution flaw stemming from functionality being pulled in from an untrusted control sphere (CWE-829), so an attacker who already holds a low-privilege foothold in the OpenShift environment hosting the product can influence the untrusted source and cause arbitrary commands to run within the FTM process context. The attack is local (AV:L, PR:L, UI:N) - there is no unauthenticated or internet-facing path to the flaw - which limits exposure to environments that actually run the affected FTM build. No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV; the vendor has published a patch, and the vendor base score of 8.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) reflects a scope-change assumption that independent assessment does not confirm, so real-world severity should be treated as high-but-localized rather than remotely critical.
Privilege escalation in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift lets a remote authenticated attacker who already holds a privileged account exceed the permissions assigned to that account, with high impact across confidentiality, integrity and availability. IBM rates it 9.1 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H), a score driven mainly by the Scope-Change flag; our independent assessment preserves the full CIA impact but treats scope as unchanged, because the high starting-privilege requirement narrows the realistic attacker population to insiders or holders of compromised privileged credentials, and the deployment footprint is limited to organizations running FTM on OpenShift. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; IBM has published a vendor patch advisory.
Local credential exposure in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift allows an already-authenticated, low-privilege local user to read insufficiently protected credentials and then use them to perform unauthorized actions against the environment, yielding high confidentiality and integrity impact with no availability impact. Only deployments running FTM for Red Hat OpenShift 4.0.6.0 through 4.0.10.0 (including the 0.6.0 Refresh build with Operator 4.4.6+20260807.081800 and 4.0.10.0 Interim Fix 064) are affected. Exploitation requires local access plus a valid low-privilege identity; no public exploit code has been identified at time of analysis (EPSS 0.14%, 4th percentile), and CISA SSVC records no known exploitation.
Deserialization of untrusted data in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift lets an unauthenticated attacker who already has network reachability to the affected component from an adjacent network segment execute arbitrary code with high impact to confidentiality, integrity and availability (CVSS 3.1 base 8.8). The exposure prerequisite is meaningful: the flaw is reachable from a neighboring position such as a compromised pod, sidecar or host inside the same OpenShift cluster or VLAN, not directly from the public internet, and no authentication or user interaction is required once that path is reachable. At the time of analysis there is no public exploit code identified and no evidence of confirmed active exploitation (no CISA KEV listing); IBM has published a vendor fix via its support advisory, so the primary risk window is the interval between advisory release and patch deployment.
Remote code execution in IBM FTM for Red Hat OpenShift is possible when an authenticated attacker submits a manipulated quantity value to a vulnerable feature, causing an out-of-bounds write (CWE-787) that can lead to arbitrary code execution. The CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects a network-reachable, low-complexity flaw requiring low privileges and no user interaction, with full confidentiality, integrity, and availability impact. No public exploit code or confirmed active exploitation was identified in the provided intelligence at time of analysis; a vendor patch is available via IBM support node 7288641.
Unauthenticated HTTP requests to the OpenShift console's /api/devfile/ and /api/devfile/samples/ endpoints let remote attackers trigger server-side request forgery from the console pod into internal cluster services and exhaust console memory through repeated large requests lacking a Content-Length header. Red Hat rates this 9.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L); our assessment agrees on the unauthenticated, network-reachable SSRF crossing a trust boundary but lowers confidentiality to C:L because only partial internal responses are reflected, producing a lower composite score. Clusters that expose the web console to untrusted networks are most at risk; no public exploit identified at time of analysis and no confirmed active exploitation (not in CISA KEV).
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resources by rapidly opening and immediately canceling (RST_STREAM) large numbers of streams over a single connection, a technique dubbed the 'Rapid Reset' attack. The flaw is confirmed actively exploited (CISA KEV) following large-scale weaponization observed August through October 2023, with publicly available exploit code and an EPSS score of 94.45% placing it in the 100th percentile for likelihood of exploitation. Virtually every major HTTP/2 stack - including nghttp2, Netty, Envoy, and Eclipse Jetty - is affected.
Multiple unspecified API endpoints in Jenkins before 1.650 and LTS before 1.642.2 allow remote authenticated users to execute arbitrary code via serialized data in an XML file, related to XStream and. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 90.9%.
The Fingerprints pages in Jenkins before 1.638 and LTS before 1.625.2 might allow remote attackers to obtain sensitive job and build name information via a direct request. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 27.4%.
Unauthenticated local invocation of the Business Rules Manager commands REST endpoint in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift lets an actor who already has a foothold in the hosting environment exhaust resources and halt business-rule management functions. The flaw is a missing authentication check (CWE-306) in CommandsResource.java:31; the CVSS 3.1 vector (AV:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 6.2) confirms that no credentials or user interaction are required, but also that the attack path is local and that the only impact is availability - there is no data disclosure or modification. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (not in CISA KEV); the local attack vector is the primary factor keeping this a low-to-moderate priority issue despite the 6.2 base score. A vendor patch is available per the IBM advisory.
Local privilege escalation in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift lets an attacker who already holds a low-privileged foothold inside a running FTM container - such as a compromised service account or code execution gained through a separate flaw - elevate their privileges within that container. The issue is rated CVSS 3.1 base 4.4 (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) and stems from improper privilege management (CWE-250), meaning the component runs with more authority than it needs; the scope is unchanged, so the flaw by itself does not provide a path to the host node or to other containers. No public exploit identified at time of analysis, and exploitation requires local authenticated access with no remote or unauthenticated vector.
Open redirect in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift lets an unauthenticated remote attacker craft a request with a manipulated Host header so that authenticated operators who follow an attacker-supplied link are bounced to an attacker-controlled site for credential phishing. The weakness resides in the PMP HostHeaderFilter (HostHeaderFilter.java:151) and is rated CVSS 5.4 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N), meaning there is no direct code execution, data modification, or service disruption and success depends entirely on social-engineering the operator into clicking the redirect. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV).
SQL injection in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift allows a remote authenticated attacker to read sensitive data from the underlying database, with impact confined to confidentiality (CVSS 6.5, C:H/I:N/A:N). The flaw is network-reachable with low attack complexity and no user interaction, but exploitation is gated behind a valid authenticated account (PR:L) on the FTM deployment. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor has published a fix; practical risk is tempered by the product's restricted financial-sector deployment footprint, making this a moderate-severity, real-but-not-urgent issue.
Unauthenticated remote attackers can clear active chat sessions in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift because the component handling chat sessions performs improper authorization, rated CVSS 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L). Any network-reachable deployment of the FTM chat-session feature is exposed, and exploitation requires no credentials or user interaction - but the impact is deliberately narrow: no data can be read (C:N) and the only effect is disruption of in-progress chat sessions (I:L/A:L), making this a genuinely lower-tier issue despite the MEDIUM score. No public exploit identified at time of analysis, and CISA KEV does not list this CVE.
Improper enforcement of mutual TLS client-certificate verification in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift can let an unauthenticated remote attacker who already holds a position on the network path obtain sensitive information from the service. The flaw (CWE-295) is rated CVSS 3.1 3.7 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N), meaning exploitation is remotely reachable yet constrained by high attack complexity and yields only limited confidentiality impact with no integrity or availability effect. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (not in CISA KEV); the overall risk is genuinely low-priority despite remote reachability, and a vendor patch is available.
Authenticated remote users of IBM Financial Transaction Manager (FTM) for Red Hat OpenShift can forge entries in the transaction audit log by supplying a crafted HTTP header that the application fails to validate properly. Successful abuse requires only valid low-privilege credentials (CVSS 3.1 base 4.3, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), so the practical consequence is limited to the integrity of the audit trail - no data disclosure, no service disruption, and no unauthenticated attack path. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score provided; combined with the narrow, specialized deployment footprint of the platform, this is a genuinely low-priority issue whose signals are consistent rather than conflicting.
Improper authorization controls in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift let an authenticated, low-privilege user forge identities and act as another user across the network, bypassing the platform's security checks. Only integrity is affected - an attacker can perform unauthorized actions under a spoofed identity, but there is no exposure of confidential data and no denial-of-service impact, and a valid account on the FTM instance is a prerequisite (PR:L, so the flaw is not exploitable pre-authentication). No public exploit has been identified at time of analysis and the issue is not listed in CISA KEV; with a CVSS base of 6.5 and a narrow deployment footprint in financial transaction environments, it is a genuine but moderate-priority issue.
Resource exhaustion in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift allows unauthenticated attackers on an adjacent network segment to force a denial-of-service condition by driving endpoint behavior that allocates resources without limits or throttling (CWE-770). The assigned CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 6.5) confines the attack surface to callers who can already reach a vulnerable FTM endpoint from the same network segment or cluster network, and limits the outcome to availability loss - service crash or hang - with no confidentiality or integrity impact. No public exploit code has been identified at time of analysis, the issue is not listed in CISA KEV, and IBM has published a vendor advisory with remediation guidance, making this a mid-severity availability issue rather than an urgent priority.
Authenticated path traversal in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift lets a remote attacker holding a valid FTM account manipulate file paths in a file-handling operation so that files are written or modified outside the intended directory. Because the flaw requires authentication and yields only limited integrity and availability impact - with no confidentiality exposure and no user interaction - it scores 5.4 and represents a medium-severity, low-priority issue rather than a high-urgency one. A vendor patch is available via IBM support node 7288641, and no public exploit code has been identified at time of analysis (no CISA KEV listing).
IBM Financial Transaction Manager (FTM) for Red Hat OpenShift ships with missing server-side authorization checks on payment-mutation functions, letting a low-privileged authenticated user invoke actions reserved for higher-privileged roles. The flaw is network-reachable and low-complexity (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, 6.5 Medium), with the damage confined to integrity - unauthorized modification or execution of payment transactions - and no confidentiality or availability impact. Exploitation requires a valid FTM for Red Hat OpenShift account (PR:L) plus reachability of the affected payment endpoints; no public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor has published a fix.
Cross-site scripting in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift allows a remote, unauthenticated attacker to inject HTML/JavaScript that executes in the browser of a logged-in FTM operator, because HTML input is not properly neutralized (CWE-79). Exploitation requires the victim to load attacker-controlled content while holding an authenticated FTM session, so a successful attack is gated on user interaction and is confined to the victim's browser context rather than the FTM host itself. IBM has published a vendor advisory with fix guidance, no public exploit code and no confirmed active exploitation were identified at time of analysis, and EPSS data was not provided; the independent assessment rates this as CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, a lower integrity impact than the 8.2 base score supplied with the CVE, and the deployment is narrowed by FTM's specialized financial-transaction-processing footprint on OpenShift.
Local attackers with a low-privileged account on the host or container running IBM Financial Transaction Manager (FTM) for Red Hat OpenShift can read insufficiently protected credentials, potentially enabling lateral movement or further compromise. No public exploit was identified at time of analysis, and exploitation requires an existing local foothold-remote or unauthenticated access is not possible. Despite the MEDIUM 6.5 base score, this is a genuinely LOW-priority issue because it only affects confidentiality and benefits an attacker post-compromise.
IBM Financial Transaction Manager (FTM) for Red Hat OpenShift contains an XML external entity (XXE) flaw that lets an authenticated, low-privilege user who can reach an XML-accepting endpoint coerce the application's XML parser into resolving attacker-supplied external entity references, resulting in disclosure of sensitive information such as local files or internal service responses. Per the CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C) the attack is network-reachable but requires a valid low-privilege account and an application code path that parses untrusted XML with external entity/DTD resolution left enabled, and our independent assessment scores the impact as confidentiality-only (C:H/I:N/A:N) rather than the vendor's mixed confidentiality/integrity rating. Exploitation is gated by authentication and by the presence of a suitable XML-processing entry point, and no public exploit identified at time of analysis; a vendor patch is available, which together keep this a mid-severity, configuration-dependent information-disclosure issue rather than an urgent priority.
BMCtest's test harness starts an Ironic bare-metal provisioning service without authentication or TLS, letting an attacker on the adjacent network modify node and provisioning state through the unauthenticated Ironic API for as long as the test is running. Exploitation is heavily constrained by a timing race: the unprotected Ironic instance exists only during an active bmctest run, and the attacker must reach the API before the harness tears it down, which is why the CVSS vector carries AC:H and the overall score is only 5.3 (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N, integrity-only impact). No public exploit identified at time of analysis, and the independent assessment rates this as a genuinely low-priority issue despite the CWE-306 missing-authentication framing.
Integer overflow in GLib's GIO escape_byte_string() function enables heap buffer overflow and denial-of-service when processing malicious filesystem attribute values over the network. The vulnerability affects GLib across GNOME, Red Hat Enterprise Linux 7-10, and OpenShift 4.0+, requiring only unauthenticated network access and user interaction. EPSS score of 0.07% (percentile 22) indicates low exploitation probability despite CVSS 6.5, suggesting the attack requires specific file/attribute handling conditions; no public exploit or active exploitation (CISA KEV) confirmed at analysis time.
A flaw was found in grub2. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
A flaw was found in rsync which could be triggered when rsync compares file checksums. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 19.1%.
A flaw was found in the decompression function of registry-support. Rated high severity (CVSS 8.0), this vulnerability is remotely exploitable, no authentication required. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.
A flaw was found in github.com/openshift/apiserver-library-go, used in OpenShift 4.12 and 4.11, that contains an issue that can allow low-privileged users to set the seccomp profile for pods they. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Birthday attack against 64-bit block ciphers flaw (CVE-2016-2183) was reported for the health checks port (9979) on etcd grpc-proxy component. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Openshift 4.9 does not use HTTP Strict Transport Security (HSTS) which may allow man-in-the-middle (MITM) attacks. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
A flaw was found in Openshift. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The response header has not enabled X-FRAME-OPTIONS, Which helps prevents against Clickjacking attack.. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A credentials leak was found in the OpenShift Container Platform. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
It was found in OpenShift, before version 4.8, that the generated certificate for the in-cluster Service CA, incorrectly included additional certificates. Rated medium severity (CVSS 4.6), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
A content spoofing vulnerability was found in the openshift/console 3.11 and 4.x. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
A vulnerability was found in Red Hat Ceph Storage 4 and Red Hat Openshift Container Storage 4.2 where, A nonce reuse vulnerability was discovered in the secure mode of the messenger v2 protocol,. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable, no authentication required.
A vulnerability was found in all openshift/mediawiki 4.x.x versions prior to 4.3.0, where an insecure modification vulnerability in the /etc/passwd file was found in the openshift/mediawiki. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
A vulnerability was found in all openshift/postgresql-apb 4.x.x versions prior to 4.3.0, where an insecure modification vulnerability in the /etc/passwd file was found in the container. Rated high severity (CVSS 7.0). No vendor patch available.
A vulnerability was found in OpenShift builds, versions 4.1 up to 4.3. Rated medium severity (CVSS 5.3), this vulnerability is no authentication required. No vendor patch available.
On version 1.9.0, If DEBUG logging is enable, F5 Container Ingress Service (CIS) for Kubernetes and Red Hat OpenShift (k8s-bigip-ctlr) log files may contain BIG-IP secrets such as SSL Private Keys. Rated medium severity (CVSS 4.4), this vulnerability is low attack complexity. No vendor patch available.
A vulnerability exists in the garbage collection mechanism of atomic-openshift. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A flaw was discovered in the HPACK decoder of HAProxy, before 1.8.14, that is used for HTTP/2. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A flaw was found in ansible. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
In atomic-openshift before version 3.10.9 a malicious network-policy configuration can cause Openshift Routing to crash when using ovs-networkpolicy plugin. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expose STOMP over WebSocket endpoints with a simple, in-memory. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
A flaw was found in source-to-image function as shipped with Openshift Enterprise 3.x. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
The DPDK vhost-user interface does not check to verify that all the requested guest physical range is mapped and contiguous when performing Guest Physical Addresses to Host Virtual Addresses. Rated medium severity (CVSS 6.1), this vulnerability is no authentication required. No vendor patch available.
Red Hat OpenShift Enterprise version 3.7 is vulnerable to access control override for container network filesystems. Rated high severity (CVSS 7.1). No vendor patch available.
Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Application Platform 6.x, 5.x, and 4.3.x; Fuse 6.x; Fuse Service. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Epss exploitation probability 71.5%.
selinux-policy as packaged in Red Hat OpenShift 2 allows attackers to obtain process listing information via a privilege escalation attack. Rated low severity (CVSS 3.3), this vulnerability is low attack complexity. No vendor patch available.
Kubernetes in OpenShift3 allows remote authenticated users to use the private images of other users should they know the name of said image. Rated low severity (CVSS 3.1), this vulnerability is remotely exploitable.
libffi requests an executable stack allowing attackers to more easily trigger arbitrary code execution by overwriting the stack. Rated high severity (CVSS 7.0). No vendor patch available.
Red Hat OpenShift Enterprise 2 does not include the HTTPOnly flag in a Set-Cookie header for the GEARID cookie, which makes it easier for remote attackers to obtain potentially sensitive information. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The sandboxing code in libarchive 3.2.0 and earlier mishandles hardlink archive entries of non-zero data size, which might allow remote attackers to write to arbitrary files via a crafted archive. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Integer overflow in the _gd2GetHeader function in gd_gd2.c in the GD Graphics Library (aka libgd) before 2.2.3, as used in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8, allows remote. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 16.2%.
The API server in Kubernetes, as used in Red Hat OpenShift Enterprise 3.2, in a multi tenant environment allows remote authenticated users with knowledge of other project names to obtain sensitive. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
openshift-node in OpenShift Origin 1.1.6 and earlier improperly stores router credentials as envvars in the pod when the --credentials option is used, which allows local users to obtain sensitive. Rated medium severity (CVSS 5.1), this vulnerability is no authentication required.
Buffer overflow in lib/flow.c in ovs-vswitchd in Open vSwitch 2.2.x and 2.3.x before 2.3.3 and 2.4.x before 2.4.1 allows remote attackers to execute arbitrary code via crafted MPLS packets, as. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Red Hat OpenShift Enterprise 3.2 does not properly restrict access to STI builds, which allows remote authenticated users to access the Docker socket and gain privileges via vectors related to. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
HAproxy in Red Hat OpenShift Enterprise 3.2 and OpenShift Origin allows local users to obtain the internal IP address of a pod by reading the "OPENSHIFT_[namespace]_SERVERID" cookie. Rated low severity (CVSS 3.3), this vulnerability is low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
Red Hat OpenShift Enterprise 3.2, when multi-tenant SDN is enabled and a build is run in a namespace that would normally be isolated from pods in other namespaces, allows remote authenticated users. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Red Hat OpenShift Enterprise 3.2 and 3.1 do not properly validate the origin of a request when anonymous access is granted to a service/proxy or pod/proxy API for a specific pod, which allows remote. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable. No vendor patch available.
Red Hat OpenShift Enterprise 3.2 and OpenShift Origin allow remote authenticated users to execute commands with root privileges by changing the root password in an sti builder image. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
Red Hat OpenShift Enterprise 3.2 allows remote authenticated users to read log files from another namespace by using the same name as a previously deleted namespace when creating a new namespace. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Red Hat OpenShift Enterprise 3.1 uses world-readable permissions on the /etc/origin/master/master-config.yaml configuration file, which allows local users to obtain Active Directory credentials by. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
The API URL computer/(master)/api/xml in Jenkins before 2.3 and LTS before 1.651.2 allows remote authenticated users with extended read permission for the master node to obtain sensitive information. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
Multiple open redirect vulnerabilities in Jenkins before 2.3 and LTS before 1.651.2 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Improper authentication in the OpenShift Console's CatalogdHandler allows unauthenticated remote attackers to forward the openshift-session-token cookie and send requests to the in-cluster catalogd service, disclosing the internal operator-catalog index and providing a relay into the openshift-catalogd namespace (CVE-2026-75886, CVSS 7.2). This affects Red Hat OpenShift Container Platform 4. No public exploit identified at time of analysis; exploitation requires network reachability to the exposed console endpoint.
Privilege escalation in Red Hat Ansible Automation Platform 2 (built on the AWX upstream project) lets an authenticated AAP platform administrator escape the container-group sandbox and obtain OpenShift namespace-level access, including the ability to read and exfiltrate namespace secrets. The flaw is reachable over the network (AV:N) with no user interaction (UI:N) and changes scope across the container/namespace boundary (S:C), but it is gated on the highest AAP privilege tier (PR:H), so it is an insider or compromised-admin scenario rather than an unauthenticated attack; only deployments that use container groups backed by OpenShift/Kubernetes are exposed. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); no vendor-released patch has been identified at time of analysis, so mitigation depends on restricting the vulnerable field or the administrators who can reach it.
Unauthenticated remote attackers can manipulate SQL database queries in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift, giving them a high-integrity impact with limited confidentiality and availability effects on affected payments-processing deployments. The flaw is a boolean-based blind SQL injection rooted in improper neutralization of special elements in a boolean expression (CWE-74), exploitable over the network with low complexity and no authentication or user interaction per the assessed CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L (base 8.2). No public exploit code has been identified and there is no confirmation of active exploitation; IBM has published a vendor advisory containing patch guidance, but affected version ranges are expressed as a wildcard CPE, so defenders must match their specific build against IBM's advisory to determine exposure.
Unauthenticated insertion of malicious runbook content into the vector database backing IBM Financial Transaction Manager (FTM) for Red Hat OpenShift's AI agent allows retrieval-augmented generation (RAG) poisoning that can steer AI-driven MCP tool calls toward unauthorized payment actions or exfiltration of payment data. IBM self-rates the issue CVSS 7.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L), reflecting unauthenticated network reachability and low attack complexity rather than high per-impact severity, since the realized effect is mediated by LLM behavior and is probabilistic rather than deterministic. The flaw is rooted in CWE-74 at api.vectordb.runbooks.js:51; no public exploit code identified at time of analysis and the issue is not tied to confirmed active exploitation, with exposure limited to deployments where the FTM AI agent endpoint is network-accessible and the agent has MCP tools wired to payment-affecting actions.
Stored cross-site scripting in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift allows an attacker with adjacent-network positioning to plant script inside stored network acknowledgement data, which then executes in the browsers of authenticated FTM operators and can lead to session hijacking and unauthorised operator-level payment actions. The flaw sits in the NetworkAcknowledgement React component (NetworkAcknowledgement.jsx:42), which renders stored acknowledgement content without adequate output encoding. The vendor rates it 9.3, while the assessed vector is CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N, where the requirement that a legitimate operator open the affected view is the practical limiting factor; no public exploit code and no confirmed active exploitation were identified at time of analysis, but the payments context and scope change keep the impact ceiling high.
Unauthenticated remote code execution in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift allows an attacker positioned on an adjacent network segment to send a crafted Java-serialized payload to the PayDir Business Rules Manager RMI SSL endpoint and execute arbitrary code on the target host. Because the vulnerable service is exposed with no authentication and no user interaction required (CVSS 8.8, AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), successful exploitation exposes all PayDir credentials and enables manipulation of payment business rules, producing high confidentiality and integrity impact. The adjacency requirement is the primary limiting factor, and no public exploit identified at time of analysis; a vendor patch is available per the IBM advisory.
Missing authentication for a critical function in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift allows a remote, unauthenticated attacker to read sensitive information and modify system configurations on an affected deployment. With CVSS 7.3 (AV:N/AC:L/PR:N/UI:N), no credentials, user interaction, or non-default configuration are required, so any network-reachable FTM instance with the vulnerable function exposed is at risk; exploitation is limited chiefly by FTM's narrow enterprise-payments install base and whether that endpoint is actually reachable. No public exploit code has been identified at time of analysis, and IBM has released a patch.
XML external entity (XXE) injection in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift allows an unauthenticated attacker positioned on an adjacent network segment to submit crafted XML that the product's parser resolves against external entities, resulting in disclosure of server-side files or server-side request forgery against internal services. The CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, 7.4 High) requires no credentials and no user interaction, but the adjacent-network attack vector and the confidentiality-only impact mean exploitation depends heavily on whether an XML-accepting endpoint is reachable from an untrusted same-segment network and on what sensitive files or internal services are reachable from the server context. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (no CISA KEV listing), and IBM has published a patch advisory; despite the High score this is a moderate-priority issue that should not be over-prioritized relative to internet-reachable, integrity- or availability-impacting flaws.
Authentication bypass and sensitive-information disclosure in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift stem from a hard-coded cryptographic key (CWE-321) embedded in the product, scoring 8.1 (High) with the vector AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. Because the key is embedded and therefore shared across deployments, an unauthenticated attacker who is positioned on the same adjacent network as an affected OpenShift deployment can bypass authentication and read or tamper with sensitive financial-transaction data, with no user interaction required; the assessment notes this is not confirmed as directly reachable from the public internet despite the description's 'remote attacker' phrasing. A vendor patch is available, and no public exploit code has been identified at time of analysis.
Cleartext transmission of sensitive information in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift can expose financial transaction data to passive interception by an attacker who is positioned on the adjacent network path carrying the affected traffic. Only deployments where a sensitive channel lacks properly configured transport encryption (for example, TLS disabled or misconfigured) are exposed; where channels are protected end to end, the flaw does not arise. Cisco-style remote internet exploitation is not the scenario here, and no public exploit code or confirmed active exploitation was identified at time of analysis. Our independent assessment rates this as a real but low-priority issue, with an assessed vector of CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - adjacent-network access plus a cleartext deployment are both required, making successful exploitation contingent on deployment configuration.
Sensitive information disclosure in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift stems from the product's use of a hard-coded or predictable cryptographic key (CWE-321). Per the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, 7.5), an unauthenticated remote attacker who obtains that static key can read data the product intended to protect, with no integrity or availability impact. The real gate is acquiring or deriving the embedded key rather than defeating authentication: no public exploit identified at time of analysis, EPSS is only 0.26% (17th percentile), and CISA SSVC records exploitation as none with Automatable set to no, making this a moderate, not urgent, priority.
Hard-coded cryptographic keys and initialization vectors in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift allow a remote authenticated attacker (CVSS 3.1 PR:L, 7.1 overall) to decrypt protected sensitive information and forge authentication tags, because the same static key material is baked into every deployment rather than generated per installation. Affected builds are the OpenShift-packaged FTM at 4.0.6.0 (including Interim Fixes 1 through 6) and, per ENISA EUVD, the 4.0.7.0 through 4.0.10.0 Interim Fix 06 range; the decisive prerequisite is compromise of a low-privilege account, and impact is primarily confidentiality with only partial integrity (C:H/I:L/A:N) and no availability loss. Exploitation is currently assessed as none - no public exploit code identified at time of analysis, EPSS only 0.22% (13th percentile), CISA SSVC exploitation "none", automatable "no" - which makes this a moderate-severity, lower-priority issue in practice.
Message forgery in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift lets remote, unauthenticated attackers send messages bearing forged cryptographic signatures that the platform improperly accepts as authentic, undermining the integrity of trusted transaction messaging (CWE-347, CVSS 7.5, integrity-only impact with no confidentiality or availability loss). Affected releases are the 4.0.6.0 line, including Interim Fixes 1 through 6, plus 4.0.7.0, 4.0.8.0, 4.0.9.0 and 4.0.10.0 Interim Fix 06. Exploitation is remote and requires no authentication or user interaction (PR:N/UI:N) but demands that an attacker understand and correctly craft a message in FTM's expected format and that an FTM message interface be reachable; there is no public exploit identified at time of analysis (EPSS 0.19%, 9th percentile), CISA SSVC rates exploitation as none and automatable as no, and there is no KEV listing.
Remote code execution via ESQL command injection affects IBM Financial Transaction Manager (FTM) for Red Hat OpenShift, where externally supplied input is combined into ESQL statements without neutralization of special elements. Per IBM PSIRT scoring (CVSS 8.1, AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), an unauthenticated remote attacker who can reach a vulnerable FTM message flow that builds ESQL commands from attacker-controlled data can achieve full confidentiality, integrity, and availability impact within the FTM runtime and its connected resources. The high attack-complexity rating reflects a non-default precondition - typically a specific flow or configuration that routes untrusted data into ESQL - so exposure is limited to environments running FTM on OpenShift with such a flow. No public exploit code identified at time of analysis and the issue is not listed in CISA KEV; EPSS data was not provided.
Cleartext transmission of sensitive information in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift exposes transaction data, credentials, or other confidential payloads to anyone able to observe network traffic on the same segment. The issue affects deployments of FTM for OpenShift where the relevant transport is not wrapped in TLS; an unauthenticated attacker with an adjacent-network position (per the assessed vector PR:N, AV:A) can passively capture that traffic, though a successful capture depends on the specific unencrypted channel being in use (AC:H), which is why the independently assessed impact is limited to confidentiality only. No public exploit code has been identified at time of analysis, and there is no indication of active exploitation, so this remains a low-real-world-priority issue despite the headline 7.5 (High) CVSS score.
Improper restriction of XML external entity references in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift allows an attacker positioned on an adjacent network segment - or elsewhere within the same cluster network - to read sensitive files and internal resources by submitting a crafted XML document to an FTM parsing endpoint. The assessed CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, 7.4 High) confirms the exploitation requirements: no credentials and no user interaction are needed, but the adjacent-network prerequisite rather than an internet-facing vector meaningfully narrows the attacker population, and impact is confined strictly to confidentiality with no integrity or availability effect. There is no public exploit identified at time of analysis, no EPSS signal or CISA KEV listing is present in the provided data, and IBM has published a vendor advisory with a patch available for this CWE-611 flaw.
IBM Financial Transaction Manager (FTM) for Red Hat OpenShift fails to properly validate symbolic links, allowing an authenticated remote user to read files outside the intended path and disclose sensitive information held by the financial platform. The affected code path is reachable across the network (AV:N) but requires a valid FTM session (PR:L), and no public exploit code or confirmed active exploitation has been identified at time of analysis. IBM has published a vendor patch via its support portal; while the vendor-assigned CVSS of 9.9 implies a scope-changing, high-integrity and high-availability impact, independent analysis of the described weakness assesses it as an information-disclosure issue (file read) rather than full system compromise.
Unauthenticated remote code execution is possible in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift because the product improperly deserializes untrusted data (CWE-502), allowing a remote attacker who can reach a vulnerable endpoint to execute arbitrary code with the privileges of the affected service. IBM rates the flaw CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning no authentication, no user interaction and only network reachability are required, so any default-exposed FTM instance is at risk; the practical limiting factor is exposure, since FTM is specialized financial middleware normally deployed inside enterprise OpenShift clusters rather than on the public internet. Patch available per vendor advisory; no public exploit identified at time of analysis (no CISA KEV listing and no POC reporting in the available intelligence), though deserialization RCE is a well-understood and reliably weaponizable bug class once reachability exists.
Remote code execution in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift lets an unauthenticated network attacker run arbitrary code on affected deployments. The flaw is CWE-94 (improper control of code generation): user-controlled input is passed into a JavaScript `new Function()` constructor without neutralization, so injected input is compiled and executed as code. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) no credentials, privileges, or victim interaction are required - only network reach to the vulnerable code path. No public exploit code has been identified at time of analysis, and there is no confirmed active exploitation (CISA KEV); the practical limiting factor is exposure, since the specific input-handling routine must be reachable and FTM's narrow financial-services enterprise footprint constrains the target population.
Authenticated remote code execution affects IBM Financial Transaction Manager (FTM) for Red Hat OpenShift, where a buffer overflow (out-of-bounds write) in an FTM component lets an attacker with valid low-privilege credentials submit crafted input and gain code execution in the containerized transaction platform. The vendor rates this 8.5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H), and our independent assessment concurs on high confidentiality and integrity impact while treating the scope change as unproven (S:U). Exploitation requires authentication (PR:L) and is not considered reliably repeatable on the first attempt (AC:H), and no public exploit identified at time of analysis. A vendor patch is available per IBM advisory node/7288641, so organizations running FTM on OpenShift should treat this as a priority patch action for their FTM estate.
Remote, unauthenticated attackers who can reach the application endpoints of IBM Financial Transaction Manager (FTM) for Red Hat OpenShift can perform unauthorized actions because the software fails to properly authenticate requests and subsequently omits authorization checks. Affected deployments are those running versions 4.0.6.0 through 4.0.10.0 Interim Fix 064, including Operator 4.4.6+20260807.081800 and the 4.0.6.0 Refresh build, per the EUVD version list. Impact is confined to integrity - attackers can trigger unauthorized operations or modify data, but there is no confidentiality or availability consequence per the assessed CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N), and there is no public exploit identified at time of analysis, with EPSS at only 0.60% (47th percentile) and CISA SSVC recording no observed exploitation.
Server-side request forgery (CWE-918) in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift at affected levels allows an authenticated local attacker to coerce the FTM server into issuing attacker-influenced requests, yielding disclosure of sensitive information and enabling unauthorized actions - rated CVSS 3.1 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), high confidentiality and integrity impact with no availability impact. Exploitation requires a deployed affected FTM instance plus valid low-privilege authenticated access reachable locally (the vector is local, not internet-facing, and user interaction is not required); no public exploit code has been identified at time of analysis and EPSS is 0.15% (5th percentile), while CISA SSVC records Exploitation: none and Automatable: no. This is a moderate-priority, not a drop-everything, issue: the niche financial middleware footprint, locally-scoped vector, and mandatory authentication mean an unauthenticated external attacker cannot exploit it directly against a default internet-facing posture. A vendor patch is available.
IBM Financial Transaction Manager (FTM) for Red Hat OpenShift contains a command execution flaw stemming from functionality being pulled in from an untrusted control sphere (CWE-829), so an attacker who already holds a low-privilege foothold in the OpenShift environment hosting the product can influence the untrusted source and cause arbitrary commands to run within the FTM process context. The attack is local (AV:L, PR:L, UI:N) - there is no unauthenticated or internet-facing path to the flaw - which limits exposure to environments that actually run the affected FTM build. No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV; the vendor has published a patch, and the vendor base score of 8.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) reflects a scope-change assumption that independent assessment does not confirm, so real-world severity should be treated as high-but-localized rather than remotely critical.
Privilege escalation in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift lets a remote authenticated attacker who already holds a privileged account exceed the permissions assigned to that account, with high impact across confidentiality, integrity and availability. IBM rates it 9.1 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H), a score driven mainly by the Scope-Change flag; our independent assessment preserves the full CIA impact but treats scope as unchanged, because the high starting-privilege requirement narrows the realistic attacker population to insiders or holders of compromised privileged credentials, and the deployment footprint is limited to organizations running FTM on OpenShift. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; IBM has published a vendor patch advisory.
Local credential exposure in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift allows an already-authenticated, low-privilege local user to read insufficiently protected credentials and then use them to perform unauthorized actions against the environment, yielding high confidentiality and integrity impact with no availability impact. Only deployments running FTM for Red Hat OpenShift 4.0.6.0 through 4.0.10.0 (including the 0.6.0 Refresh build with Operator 4.4.6+20260807.081800 and 4.0.10.0 Interim Fix 064) are affected. Exploitation requires local access plus a valid low-privilege identity; no public exploit code has been identified at time of analysis (EPSS 0.14%, 4th percentile), and CISA SSVC records no known exploitation.
Deserialization of untrusted data in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift lets an unauthenticated attacker who already has network reachability to the affected component from an adjacent network segment execute arbitrary code with high impact to confidentiality, integrity and availability (CVSS 3.1 base 8.8). The exposure prerequisite is meaningful: the flaw is reachable from a neighboring position such as a compromised pod, sidecar or host inside the same OpenShift cluster or VLAN, not directly from the public internet, and no authentication or user interaction is required once that path is reachable. At the time of analysis there is no public exploit code identified and no evidence of confirmed active exploitation (no CISA KEV listing); IBM has published a vendor fix via its support advisory, so the primary risk window is the interval between advisory release and patch deployment.
Remote code execution in IBM FTM for Red Hat OpenShift is possible when an authenticated attacker submits a manipulated quantity value to a vulnerable feature, causing an out-of-bounds write (CWE-787) that can lead to arbitrary code execution. The CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects a network-reachable, low-complexity flaw requiring low privileges and no user interaction, with full confidentiality, integrity, and availability impact. No public exploit code or confirmed active exploitation was identified in the provided intelligence at time of analysis; a vendor patch is available via IBM support node 7288641.
Unauthenticated HTTP requests to the OpenShift console's /api/devfile/ and /api/devfile/samples/ endpoints let remote attackers trigger server-side request forgery from the console pod into internal cluster services and exhaust console memory through repeated large requests lacking a Content-Length header. Red Hat rates this 9.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L); our assessment agrees on the unauthenticated, network-reachable SSRF crossing a trust boundary but lowers confidentiality to C:L because only partial internal responses are reflected, producing a lower composite score. Clusters that expose the web console to untrusted networks are most at risk; no public exploit identified at time of analysis and no confirmed active exploitation (not in CISA KEV).
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resources by rapidly opening and immediately canceling (RST_STREAM) large numbers of streams over a single connection, a technique dubbed the 'Rapid Reset' attack. The flaw is confirmed actively exploited (CISA KEV) following large-scale weaponization observed August through October 2023, with publicly available exploit code and an EPSS score of 94.45% placing it in the 100th percentile for likelihood of exploitation. Virtually every major HTTP/2 stack - including nghttp2, Netty, Envoy, and Eclipse Jetty - is affected.
Multiple unspecified API endpoints in Jenkins before 1.650 and LTS before 1.642.2 allow remote authenticated users to execute arbitrary code via serialized data in an XML file, related to XStream and. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 90.9%.
The Fingerprints pages in Jenkins before 1.638 and LTS before 1.625.2 might allow remote attackers to obtain sensitive job and build name information via a direct request. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 27.4%.
Unauthenticated local invocation of the Business Rules Manager commands REST endpoint in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift lets an actor who already has a foothold in the hosting environment exhaust resources and halt business-rule management functions. The flaw is a missing authentication check (CWE-306) in CommandsResource.java:31; the CVSS 3.1 vector (AV:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 6.2) confirms that no credentials or user interaction are required, but also that the attack path is local and that the only impact is availability - there is no data disclosure or modification. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (not in CISA KEV); the local attack vector is the primary factor keeping this a low-to-moderate priority issue despite the 6.2 base score. A vendor patch is available per the IBM advisory.
Local privilege escalation in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift lets an attacker who already holds a low-privileged foothold inside a running FTM container - such as a compromised service account or code execution gained through a separate flaw - elevate their privileges within that container. The issue is rated CVSS 3.1 base 4.4 (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) and stems from improper privilege management (CWE-250), meaning the component runs with more authority than it needs; the scope is unchanged, so the flaw by itself does not provide a path to the host node or to other containers. No public exploit identified at time of analysis, and exploitation requires local authenticated access with no remote or unauthenticated vector.
Open redirect in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift lets an unauthenticated remote attacker craft a request with a manipulated Host header so that authenticated operators who follow an attacker-supplied link are bounced to an attacker-controlled site for credential phishing. The weakness resides in the PMP HostHeaderFilter (HostHeaderFilter.java:151) and is rated CVSS 5.4 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N), meaning there is no direct code execution, data modification, or service disruption and success depends entirely on social-engineering the operator into clicking the redirect. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV).
SQL injection in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift allows a remote authenticated attacker to read sensitive data from the underlying database, with impact confined to confidentiality (CVSS 6.5, C:H/I:N/A:N). The flaw is network-reachable with low attack complexity and no user interaction, but exploitation is gated behind a valid authenticated account (PR:L) on the FTM deployment. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor has published a fix; practical risk is tempered by the product's restricted financial-sector deployment footprint, making this a moderate-severity, real-but-not-urgent issue.
Unauthenticated remote attackers can clear active chat sessions in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift because the component handling chat sessions performs improper authorization, rated CVSS 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L). Any network-reachable deployment of the FTM chat-session feature is exposed, and exploitation requires no credentials or user interaction - but the impact is deliberately narrow: no data can be read (C:N) and the only effect is disruption of in-progress chat sessions (I:L/A:L), making this a genuinely lower-tier issue despite the MEDIUM score. No public exploit identified at time of analysis, and CISA KEV does not list this CVE.
Improper enforcement of mutual TLS client-certificate verification in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift can let an unauthenticated remote attacker who already holds a position on the network path obtain sensitive information from the service. The flaw (CWE-295) is rated CVSS 3.1 3.7 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N), meaning exploitation is remotely reachable yet constrained by high attack complexity and yields only limited confidentiality impact with no integrity or availability effect. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (not in CISA KEV); the overall risk is genuinely low-priority despite remote reachability, and a vendor patch is available.
Authenticated remote users of IBM Financial Transaction Manager (FTM) for Red Hat OpenShift can forge entries in the transaction audit log by supplying a crafted HTTP header that the application fails to validate properly. Successful abuse requires only valid low-privilege credentials (CVSS 3.1 base 4.3, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), so the practical consequence is limited to the integrity of the audit trail - no data disclosure, no service disruption, and no unauthenticated attack path. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score provided; combined with the narrow, specialized deployment footprint of the platform, this is a genuinely low-priority issue whose signals are consistent rather than conflicting.
Improper authorization controls in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift let an authenticated, low-privilege user forge identities and act as another user across the network, bypassing the platform's security checks. Only integrity is affected - an attacker can perform unauthorized actions under a spoofed identity, but there is no exposure of confidential data and no denial-of-service impact, and a valid account on the FTM instance is a prerequisite (PR:L, so the flaw is not exploitable pre-authentication). No public exploit has been identified at time of analysis and the issue is not listed in CISA KEV; with a CVSS base of 6.5 and a narrow deployment footprint in financial transaction environments, it is a genuine but moderate-priority issue.
Resource exhaustion in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift allows unauthenticated attackers on an adjacent network segment to force a denial-of-service condition by driving endpoint behavior that allocates resources without limits or throttling (CWE-770). The assigned CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 6.5) confines the attack surface to callers who can already reach a vulnerable FTM endpoint from the same network segment or cluster network, and limits the outcome to availability loss - service crash or hang - with no confidentiality or integrity impact. No public exploit code has been identified at time of analysis, the issue is not listed in CISA KEV, and IBM has published a vendor advisory with remediation guidance, making this a mid-severity availability issue rather than an urgent priority.
Authenticated path traversal in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift lets a remote attacker holding a valid FTM account manipulate file paths in a file-handling operation so that files are written or modified outside the intended directory. Because the flaw requires authentication and yields only limited integrity and availability impact - with no confidentiality exposure and no user interaction - it scores 5.4 and represents a medium-severity, low-priority issue rather than a high-urgency one. A vendor patch is available via IBM support node 7288641, and no public exploit code has been identified at time of analysis (no CISA KEV listing).
IBM Financial Transaction Manager (FTM) for Red Hat OpenShift ships with missing server-side authorization checks on payment-mutation functions, letting a low-privileged authenticated user invoke actions reserved for higher-privileged roles. The flaw is network-reachable and low-complexity (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, 6.5 Medium), with the damage confined to integrity - unauthorized modification or execution of payment transactions - and no confidentiality or availability impact. Exploitation requires a valid FTM for Red Hat OpenShift account (PR:L) plus reachability of the affected payment endpoints; no public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor has published a fix.
Cross-site scripting in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift allows a remote, unauthenticated attacker to inject HTML/JavaScript that executes in the browser of a logged-in FTM operator, because HTML input is not properly neutralized (CWE-79). Exploitation requires the victim to load attacker-controlled content while holding an authenticated FTM session, so a successful attack is gated on user interaction and is confined to the victim's browser context rather than the FTM host itself. IBM has published a vendor advisory with fix guidance, no public exploit code and no confirmed active exploitation were identified at time of analysis, and EPSS data was not provided; the independent assessment rates this as CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, a lower integrity impact than the 8.2 base score supplied with the CVE, and the deployment is narrowed by FTM's specialized financial-transaction-processing footprint on OpenShift.
Local attackers with a low-privileged account on the host or container running IBM Financial Transaction Manager (FTM) for Red Hat OpenShift can read insufficiently protected credentials, potentially enabling lateral movement or further compromise. No public exploit was identified at time of analysis, and exploitation requires an existing local foothold-remote or unauthenticated access is not possible. Despite the MEDIUM 6.5 base score, this is a genuinely LOW-priority issue because it only affects confidentiality and benefits an attacker post-compromise.
IBM Financial Transaction Manager (FTM) for Red Hat OpenShift contains an XML external entity (XXE) flaw that lets an authenticated, low-privilege user who can reach an XML-accepting endpoint coerce the application's XML parser into resolving attacker-supplied external entity references, resulting in disclosure of sensitive information such as local files or internal service responses. Per the CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C) the attack is network-reachable but requires a valid low-privilege account and an application code path that parses untrusted XML with external entity/DTD resolution left enabled, and our independent assessment scores the impact as confidentiality-only (C:H/I:N/A:N) rather than the vendor's mixed confidentiality/integrity rating. Exploitation is gated by authentication and by the presence of a suitable XML-processing entry point, and no public exploit identified at time of analysis; a vendor patch is available, which together keep this a mid-severity, configuration-dependent information-disclosure issue rather than an urgent priority.
BMCtest's test harness starts an Ironic bare-metal provisioning service without authentication or TLS, letting an attacker on the adjacent network modify node and provisioning state through the unauthenticated Ironic API for as long as the test is running. Exploitation is heavily constrained by a timing race: the unprotected Ironic instance exists only during an active bmctest run, and the attacker must reach the API before the harness tears it down, which is why the CVSS vector carries AC:H and the overall score is only 5.3 (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N, integrity-only impact). No public exploit identified at time of analysis, and the independent assessment rates this as a genuinely low-priority issue despite the CWE-306 missing-authentication framing.
Integer overflow in GLib's GIO escape_byte_string() function enables heap buffer overflow and denial-of-service when processing malicious filesystem attribute values over the network. The vulnerability affects GLib across GNOME, Red Hat Enterprise Linux 7-10, and OpenShift 4.0+, requiring only unauthenticated network access and user interaction. EPSS score of 0.07% (percentile 22) indicates low exploitation probability despite CVSS 6.5, suggesting the attack requires specific file/attribute handling conditions; no public exploit or active exploitation (CISA KEV) confirmed at analysis time.
A flaw was found in grub2. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
A flaw was found in rsync which could be triggered when rsync compares file checksums. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 19.1%.
A flaw was found in the decompression function of registry-support. Rated high severity (CVSS 8.0), this vulnerability is remotely exploitable, no authentication required. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.
A flaw was found in github.com/openshift/apiserver-library-go, used in OpenShift 4.12 and 4.11, that contains an issue that can allow low-privileged users to set the seccomp profile for pods they. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Birthday attack against 64-bit block ciphers flaw (CVE-2016-2183) was reported for the health checks port (9979) on etcd grpc-proxy component. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Openshift 4.9 does not use HTTP Strict Transport Security (HSTS) which may allow man-in-the-middle (MITM) attacks. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
A flaw was found in Openshift. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The response header has not enabled X-FRAME-OPTIONS, Which helps prevents against Clickjacking attack.. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A credentials leak was found in the OpenShift Container Platform. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
It was found in OpenShift, before version 4.8, that the generated certificate for the in-cluster Service CA, incorrectly included additional certificates. Rated medium severity (CVSS 4.6), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
A content spoofing vulnerability was found in the openshift/console 3.11 and 4.x. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
A vulnerability was found in Red Hat Ceph Storage 4 and Red Hat Openshift Container Storage 4.2 where, A nonce reuse vulnerability was discovered in the secure mode of the messenger v2 protocol,. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable, no authentication required.
A vulnerability was found in all openshift/mediawiki 4.x.x versions prior to 4.3.0, where an insecure modification vulnerability in the /etc/passwd file was found in the openshift/mediawiki. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
A vulnerability was found in all openshift/postgresql-apb 4.x.x versions prior to 4.3.0, where an insecure modification vulnerability in the /etc/passwd file was found in the container. Rated high severity (CVSS 7.0). No vendor patch available.
A vulnerability was found in OpenShift builds, versions 4.1 up to 4.3. Rated medium severity (CVSS 5.3), this vulnerability is no authentication required. No vendor patch available.
On version 1.9.0, If DEBUG logging is enable, F5 Container Ingress Service (CIS) for Kubernetes and Red Hat OpenShift (k8s-bigip-ctlr) log files may contain BIG-IP secrets such as SSL Private Keys. Rated medium severity (CVSS 4.4), this vulnerability is low attack complexity. No vendor patch available.
A vulnerability exists in the garbage collection mechanism of atomic-openshift. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A flaw was discovered in the HPACK decoder of HAProxy, before 1.8.14, that is used for HTTP/2. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A flaw was found in ansible. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
In atomic-openshift before version 3.10.9 a malicious network-policy configuration can cause Openshift Routing to crash when using ovs-networkpolicy plugin. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expose STOMP over WebSocket endpoints with a simple, in-memory. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
A flaw was found in source-to-image function as shipped with Openshift Enterprise 3.x. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
The DPDK vhost-user interface does not check to verify that all the requested guest physical range is mapped and contiguous when performing Guest Physical Addresses to Host Virtual Addresses. Rated medium severity (CVSS 6.1), this vulnerability is no authentication required. No vendor patch available.
Red Hat OpenShift Enterprise version 3.7 is vulnerable to access control override for container network filesystems. Rated high severity (CVSS 7.1). No vendor patch available.
Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Application Platform 6.x, 5.x, and 4.3.x; Fuse 6.x; Fuse Service. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Epss exploitation probability 71.5%.
selinux-policy as packaged in Red Hat OpenShift 2 allows attackers to obtain process listing information via a privilege escalation attack. Rated low severity (CVSS 3.3), this vulnerability is low attack complexity. No vendor patch available.
Kubernetes in OpenShift3 allows remote authenticated users to use the private images of other users should they know the name of said image. Rated low severity (CVSS 3.1), this vulnerability is remotely exploitable.
libffi requests an executable stack allowing attackers to more easily trigger arbitrary code execution by overwriting the stack. Rated high severity (CVSS 7.0). No vendor patch available.
Red Hat OpenShift Enterprise 2 does not include the HTTPOnly flag in a Set-Cookie header for the GEARID cookie, which makes it easier for remote attackers to obtain potentially sensitive information. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The sandboxing code in libarchive 3.2.0 and earlier mishandles hardlink archive entries of non-zero data size, which might allow remote attackers to write to arbitrary files via a crafted archive. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Integer overflow in the _gd2GetHeader function in gd_gd2.c in the GD Graphics Library (aka libgd) before 2.2.3, as used in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8, allows remote. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 16.2%.
The API server in Kubernetes, as used in Red Hat OpenShift Enterprise 3.2, in a multi tenant environment allows remote authenticated users with knowledge of other project names to obtain sensitive. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
openshift-node in OpenShift Origin 1.1.6 and earlier improperly stores router credentials as envvars in the pod when the --credentials option is used, which allows local users to obtain sensitive. Rated medium severity (CVSS 5.1), this vulnerability is no authentication required.
Buffer overflow in lib/flow.c in ovs-vswitchd in Open vSwitch 2.2.x and 2.3.x before 2.3.3 and 2.4.x before 2.4.1 allows remote attackers to execute arbitrary code via crafted MPLS packets, as. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Red Hat OpenShift Enterprise 3.2 does not properly restrict access to STI builds, which allows remote authenticated users to access the Docker socket and gain privileges via vectors related to. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
HAproxy in Red Hat OpenShift Enterprise 3.2 and OpenShift Origin allows local users to obtain the internal IP address of a pod by reading the "OPENSHIFT_[namespace]_SERVERID" cookie. Rated low severity (CVSS 3.3), this vulnerability is low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
Red Hat OpenShift Enterprise 3.2, when multi-tenant SDN is enabled and a build is run in a namespace that would normally be isolated from pods in other namespaces, allows remote authenticated users. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Red Hat OpenShift Enterprise 3.2 and 3.1 do not properly validate the origin of a request when anonymous access is granted to a service/proxy or pod/proxy API for a specific pod, which allows remote. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable. No vendor patch available.
Red Hat OpenShift Enterprise 3.2 and OpenShift Origin allow remote authenticated users to execute commands with root privileges by changing the root password in an sti builder image. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
Red Hat OpenShift Enterprise 3.2 allows remote authenticated users to read log files from another namespace by using the same name as a previously deleted namespace when creating a new namespace. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Red Hat OpenShift Enterprise 3.1 uses world-readable permissions on the /etc/origin/master/master-config.yaml configuration file, which allows local users to obtain Active Directory credentials by. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
The API URL computer/(master)/api/xml in Jenkins before 2.3 and LTS before 1.651.2 allows remote authenticated users with extended read permission for the master node to obtain sensitive information. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
Multiple open redirect vulnerabilities in Jenkins before 2.3 and LTS before 1.651.2 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity.