Red Hat Advanced Cluster Security 4
Monthly
Red Hat Advanced Cluster Security for Kubernetes (RHACS) Central's SAML assertion consumer service (ACS) endpoint does not cache used assertion or response identifiers, so a single valid signed SAML response can be replayed to mint multiple distinct Central authentication tokens for the same mapped identity. Deployments are only exposed when Central is configured to authenticate via SAML; an attacker must first obtain a legitimately signed, unexpired SAML response - they cannot forge one - which is why the issue is rated CVSS 7.4 with high attack complexity despite requiring no privileges or user interaction. Successful replay yields full compromise of confidentiality and integrity for the impersonated identity; no public exploit code or confirmed active exploitation was identified at time of analysis, and non-SAML authentication configurations are unaffected.
Deploy-time policy bypass in Red Hat Advanced Cluster Security for Kubernetes 4 lets a user with Kubernetes Deployment-create permission spoof workload identity by setting the openshift.io/encoded-deployment-config label to "null", forcing ACS to record the workload with empty UID, name and labels and a "default" namespace. This evades ACS deploy-time policy detection and enforcement visibility and corrupts Central's persistence, violation reporting and compliance correlation. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Authenticated denial of service in Red Hat Advanced Cluster Security for Kubernetes (RHACS) 4 allows any user holding a valid API token to exhaust Central's resources. Because Central does not cap the nesting depth of queries served on its authenticated GraphQL API, a single deeply nested query can drive excessive CPU and memory consumption and take down the RHACS management plane. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV, but the low-privilege network vector makes it trivial for any token holder to trigger.
The system CA trust store shipped in Red Hat's ca-certificates RPM packages includes eMudhra root authorities that signed intermediate CA certificates protected by weak private keys, so a man-in-the-middle attacker who can intercept traffic and who can factor or guess those keys could mint certificates for arbitrary hostnames that TLS clients using the system trust store would accept (CVSS 6.8, CWE-295). Affected platforms span Red Hat Enterprise Linux 6 through 10 plus a long list of layered products such as OpenShift Container Platform 4, Satellite 6, Quay 3, Advanced Cluster Management, and the cert-manager and logging operators. Attackers need a privileged network position and a victim client that actually initiates a TLS connection validated against the system store, so this is a trust-anchoring and impersonation problem rather than a remotely reachable code-execution flaw; there is no availability impact and no public exploit code identified at time of analysis. Because individual intermediate certificates cannot be selectively distrusted across every consumer of the system store, Red Hat is removing the parent root CAs outright, which is the crux of the remediation.
A file descriptor leak in the containers/storage Go library's archive.ApplyLayer and ApplyUncompressedLayer functions causes descriptors to be left open whenever corrupt or malicious image layers or tar streams are unpacked, and repeated processing of such inputs can exhaust the hosting process's file descriptor limit. The weakness is unauthenticated in CVSS terms (PR:N) but local in scope (AV:L) and requires the victim to actually process attacker-influenced layers (UI:R), so an attacker must first get malformed image content in front of a build, pull, or sync loop. Impact is availability-only and confined to the affected process (C:N/I:N/A:L, S:U): no code execution and no data exposure; a single bad input does not cause denial of service, only sustained repetition does. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, and EPSS scoring was not supplied with the source data.
Privilege escalation in Red Hat Advanced Cluster Security 4 (StackRox Central) allows authenticated OIDC token holders to gain unauthorized role assignments through unanchored regular expression matching in the Machine-to-Machine token exchange subsystem. When administrators configure M2M role mappings, RHACS matches incoming OIDC claim values against configured patterns without regex anchors, meaning an attacker whose claim value is a superstring of a mapped pattern - for example, 'superadmin' matching a pattern intended only for 'admin' - receives elevated roles unintentionally. No public exploit code or active exploitation has been identified at this time; the CVSS AC:H rating reflects a genuine complexity barrier requiring attacker knowledge of the target's role mapping configuration.
Denial of service in claircore's Alpine APK package scanner affects Red Hat Advanced Cluster Security 4 and Red Hat Quay 3, where a low-privileged remote attacker can submit a container image containing malformed APK package-database data to trigger an out-of-bounds read (CWE-125) that panics the Go scanner. If the panic is not recovered, the Clair indexer process crashes, interrupting container vulnerability scanning workflows. No public exploit code exists and this CVE is not listed in the CISA KEV catalog, placing this at moderate priority despite network reachability.
Red Hat Advanced Cluster Security for Kubernetes (RHACS) Central's SAML assertion consumer service (ACS) endpoint does not cache used assertion or response identifiers, so a single valid signed SAML response can be replayed to mint multiple distinct Central authentication tokens for the same mapped identity. Deployments are only exposed when Central is configured to authenticate via SAML; an attacker must first obtain a legitimately signed, unexpired SAML response - they cannot forge one - which is why the issue is rated CVSS 7.4 with high attack complexity despite requiring no privileges or user interaction. Successful replay yields full compromise of confidentiality and integrity for the impersonated identity; no public exploit code or confirmed active exploitation was identified at time of analysis, and non-SAML authentication configurations are unaffected.
Deploy-time policy bypass in Red Hat Advanced Cluster Security for Kubernetes 4 lets a user with Kubernetes Deployment-create permission spoof workload identity by setting the openshift.io/encoded-deployment-config label to "null", forcing ACS to record the workload with empty UID, name and labels and a "default" namespace. This evades ACS deploy-time policy detection and enforcement visibility and corrupts Central's persistence, violation reporting and compliance correlation. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Authenticated denial of service in Red Hat Advanced Cluster Security for Kubernetes (RHACS) 4 allows any user holding a valid API token to exhaust Central's resources. Because Central does not cap the nesting depth of queries served on its authenticated GraphQL API, a single deeply nested query can drive excessive CPU and memory consumption and take down the RHACS management plane. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV, but the low-privilege network vector makes it trivial for any token holder to trigger.
The system CA trust store shipped in Red Hat's ca-certificates RPM packages includes eMudhra root authorities that signed intermediate CA certificates protected by weak private keys, so a man-in-the-middle attacker who can intercept traffic and who can factor or guess those keys could mint certificates for arbitrary hostnames that TLS clients using the system trust store would accept (CVSS 6.8, CWE-295). Affected platforms span Red Hat Enterprise Linux 6 through 10 plus a long list of layered products such as OpenShift Container Platform 4, Satellite 6, Quay 3, Advanced Cluster Management, and the cert-manager and logging operators. Attackers need a privileged network position and a victim client that actually initiates a TLS connection validated against the system store, so this is a trust-anchoring and impersonation problem rather than a remotely reachable code-execution flaw; there is no availability impact and no public exploit code identified at time of analysis. Because individual intermediate certificates cannot be selectively distrusted across every consumer of the system store, Red Hat is removing the parent root CAs outright, which is the crux of the remediation.
A file descriptor leak in the containers/storage Go library's archive.ApplyLayer and ApplyUncompressedLayer functions causes descriptors to be left open whenever corrupt or malicious image layers or tar streams are unpacked, and repeated processing of such inputs can exhaust the hosting process's file descriptor limit. The weakness is unauthenticated in CVSS terms (PR:N) but local in scope (AV:L) and requires the victim to actually process attacker-influenced layers (UI:R), so an attacker must first get malformed image content in front of a build, pull, or sync loop. Impact is availability-only and confined to the affected process (C:N/I:N/A:L, S:U): no code execution and no data exposure; a single bad input does not cause denial of service, only sustained repetition does. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, and EPSS scoring was not supplied with the source data.
Privilege escalation in Red Hat Advanced Cluster Security 4 (StackRox Central) allows authenticated OIDC token holders to gain unauthorized role assignments through unanchored regular expression matching in the Machine-to-Machine token exchange subsystem. When administrators configure M2M role mappings, RHACS matches incoming OIDC claim values against configured patterns without regex anchors, meaning an attacker whose claim value is a superstring of a mapped pattern - for example, 'superadmin' matching a pattern intended only for 'admin' - receives elevated roles unintentionally. No public exploit code or active exploitation has been identified at this time; the CVSS AC:H rating reflects a genuine complexity barrier requiring attacker knowledge of the target's role mapping configuration.
Denial of service in claircore's Alpine APK package scanner affects Red Hat Advanced Cluster Security 4 and Red Hat Quay 3, where a low-privileged remote attacker can submit a container image containing malformed APK package-database data to trigger an out-of-bounds read (CWE-125) that panics the Go scanner. If the panic is not recovered, the Clair indexer process crashes, interrupting container vulnerability scanning workflows. No public exploit code exists and this CVE is not listed in the CISA KEV catalog, placing this at moderate priority despite network reachability.