Red Hat Openshift Data Foundation 4
Monthly
Command injection in NooBaa's cluster_internal_api (set_hostname_internal function) allows an authenticated attacker holding NooBaa administrative privileges on a Red Hat OpenShift Data Foundation 4 Multi-Cloud Object Gateway to execute arbitrary shell commands in the context of the NooBaa process by supplying a hostname value containing shell metacharacters. The flaw carries a CVSS 3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), and the high-privilege prerequisite means it is not reachable by unauthenticated users; realized impact is bounded by the privileges of the NooBaa pod rather than guaranteed node-level root. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
NooBaa's S3 presigned URL verification fails to reject unsigned x-amz- headers, allowing an attacker who holds a valid SigV4 presigned PUT URL to inject an x-amz-copy-source header and convert an upload into a CopyObject operation. This can lead to unauthorized copying of any data the original signer can access within the NooBaa / OpenShift Data Foundation 4 storage system. The issue affects noobaa-core and is rated 7.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N); no public exploit or active exploitation has been identified at time of analysis.
Privilege escalation in Red Hat Advanced Cluster Management's multicloud-operators-subscription controller lets a low-privileged user on a managed cluster create a Subscription with crafted annotations that the controller processes with its own elevated Service Account, deploying attacker-chosen resources into arbitrary namespaces. The flaw (CWE-863, CVSS 9.9, scope-changed) affects Red Hat ACM 2.x and Multicluster Global Hub as reported by Red Hat. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote code execution in the Argo CD repo-server component (as shipped in Red Hat OpenShift GitOps and the argoproj argo-helm chart) allows an unauthenticated attacker with network access to the repo-server to run arbitrary code and, under certain conditions, poison cached manifests to push malicious Kubernetes resources into managed clusters, enabling full cluster takeover. The root cause is missing authentication (CWE-306) on a critical internal service that the default Helm chart left network-exposed. There is no public exploit identified at time of analysis, but detailed third-party technical research (Synacktiv) and press coverage exist, and the flaw was reported unpatched at disclosure.
Medium severity vulnerability in systemd. A container privilege escalation flaw was found in certain Multi-Cloud Object Gateway Core images. This issue stems from the /etc/passwd file being created with group-writable permissions during build time. In certain conditions, an attacker who can execute commands within an affected container, even as a non-root user, can leverage their membership in the root group to modify the /etc/passwd f...
Command injection in NooBaa's cluster_internal_api (set_hostname_internal function) allows an authenticated attacker holding NooBaa administrative privileges on a Red Hat OpenShift Data Foundation 4 Multi-Cloud Object Gateway to execute arbitrary shell commands in the context of the NooBaa process by supplying a hostname value containing shell metacharacters. The flaw carries a CVSS 3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), and the high-privilege prerequisite means it is not reachable by unauthenticated users; realized impact is bounded by the privileges of the NooBaa pod rather than guaranteed node-level root. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
NooBaa's S3 presigned URL verification fails to reject unsigned x-amz- headers, allowing an attacker who holds a valid SigV4 presigned PUT URL to inject an x-amz-copy-source header and convert an upload into a CopyObject operation. This can lead to unauthorized copying of any data the original signer can access within the NooBaa / OpenShift Data Foundation 4 storage system. The issue affects noobaa-core and is rated 7.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N); no public exploit or active exploitation has been identified at time of analysis.
Privilege escalation in Red Hat Advanced Cluster Management's multicloud-operators-subscription controller lets a low-privileged user on a managed cluster create a Subscription with crafted annotations that the controller processes with its own elevated Service Account, deploying attacker-chosen resources into arbitrary namespaces. The flaw (CWE-863, CVSS 9.9, scope-changed) affects Red Hat ACM 2.x and Multicluster Global Hub as reported by Red Hat. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote code execution in the Argo CD repo-server component (as shipped in Red Hat OpenShift GitOps and the argoproj argo-helm chart) allows an unauthenticated attacker with network access to the repo-server to run arbitrary code and, under certain conditions, poison cached manifests to push malicious Kubernetes resources into managed clusters, enabling full cluster takeover. The root cause is missing authentication (CWE-306) on a critical internal service that the default Helm chart left network-exposed. There is no public exploit identified at time of analysis, but detailed third-party technical research (Synacktiv) and press coverage exist, and the flaw was reported unpatched at disclosure.
Medium severity vulnerability in systemd. A container privilege escalation flaw was found in certain Multi-Cloud Object Gateway Core images. This issue stems from the /etc/passwd file being created with group-writable permissions during build time. In certain conditions, an attacker who can execute commands within an affected container, even as a non-root user, can leverage their membership in the root group to modify the /etc/passwd f...