Red Hat
Monthly
Cross-tenant bearer-token disclosure in Red Hat Advanced Cluster Management for Kubernetes 2 (RHACM) lets an authenticated tenant abuse the GitOpsCluster controller in the multicloud-integrations component to redirect spoke-cluster credentials into a namespace they control. Because the controller acts on the tenant's behalf across trust boundaries (a confused-deputy flaw), a low-privileged user can obtain tokens that grant access to managed spoke clusters and bypass ArgoCD AppProject scoping controls. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the CVSS base score is 9.6 (Critical).
Cross-cluster remote code execution in Red Hat Advanced Cluster Management for Kubernetes 2 (multicloud-integrations / ArgoCD pull-model integration) lets a low-privileged hub tenant who can create Application CRs redirect propagation to arbitrary managed spoke clusters. Because the Application propagation controller trusts the attacker-supplied `ocm-managed-cluster` annotation without validation, an attacker forces ArgoCD on targeted spokes to sync attacker-controlled manifests, yielding code execution or privilege escalation there. CVSS 9.9 with scope change; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Incorrect authorization in FreeIPA's trust-fetch-domains command allows any authenticated, non-privileged IPA user to trigger a privileged Active Directory trust refresh using an attacker-supplied server and credentials, writing attacker-controlled trusted-domain and ID-range data into the FreeIPA LDAP directory. The flaw (CWE-863) stems from the command being gated by a read-only trust object permission rather than the required trust-administration permission, effectively bypassing the authorization boundary between read and write operations on cross-realm identity data. No public exploit has been identified and CISA has not listed this in KEV, but the scope-changed CVSS score of 8.2 and high integrity impact reflect serious potential for identity infrastructure tampering in environments running AD trusts.
Code injection in the Perl DBI module as packaged for Red Hat Enterprise Linux allows a network-accessible, low-privileged attacker to execute arbitrary code, resulting in full confidentiality, integrity, and availability compromise. This CVE is a remediation of an incomplete fix for CVE-2026-14380, specifically targeting RHEL 9.8.z and 10.2.z patch levels where the prior partial fix left an exploitable residual path. No public exploit or CISA KEV listing is identified at time of analysis, but the CWE-94 classification and RCE tag indicate high potential impact if exploitation conditions are met.
Server-Side Request Forgery in Red Hat OpenShift Container Platform 4's Dev Console webhook helpers allows authenticated users to coerce the console pod into issuing arbitrary outbound HTTP requests on their behalf. Because the console pod operates from a privileged network position within the cluster, this enables lateral movement to internal services - including the Kubernetes API server, metadata endpoints, and internal microservices - that would otherwise be unreachable from outside the cluster. No public exploit or CISA KEV listing has been identified at time of analysis, but the Scope:Changed CVSS metric reflects the cross-boundary nature of the impact.
Server-Side Request Forgery in the OpenShift Console Helm catalog proxy allows low-privileged namespace tenants to plant a malicious ProjectHelmChartRepository resource pointing to an attacker-controlled URL, causing the console pod to issue server-side fetches that bypass tenant egress restrictions. Combined with Helm catalog metadata poisoning and subsequent admin-mediated chart installation, this multi-stage attack chain enables privilege escalation within the cluster. No CISA KEV listing or public exploit code has been identified at time of analysis, though the CVSS Scope:Changed rating correctly reflects that the console pod's cross-boundary requests extend impact beyond the originating namespace.
Privilege escalation in the `openvt -u` utility allows a local low-privileged attacker to obtain passwordless root login on Red Hat Enterprise Linux 6 through 10, Red Hat Hardened Images, and Red Hat OpenShift Container Platform 4. The flaw lies in `authenticate_user()`, which resolves VT ownership via `stat("/proc/<pid>/fd/0")` - a call that follows the symlink to the underlying TTY device node rather than inspecting the owning process, causing the check to read the device node's UID rather than the process owner's UID. When a privileged user logs out and TTY device node ownership reverts to root or the getty owner while an attacker's process still holds fd 0 on that TTY, the check incorrectly authorizes a passwordless `login -f root` execution. No public exploit is identified at time of analysis and there is no CISA KEV listing, but the root-level impact makes this a high priority for environments using the affected `kbrequest`/init deployment pattern.
Privilege escalation in MRTG (Multi Router Traffic Grapher) allows a local low-privileged attacker to gain elevated file ownership on the host system. When the MRTG daemon is launched as root and then drops privileges, a CWE-59 symlink-following flaw in PID file handling lets an attacker pre-place or manipulate a symlink at the expected PID file path, causing the root process to change ownership of an arbitrary existing file to the daemon user. Affected platforms include Red Hat Enterprise Linux 6 through 10; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in Red Hat OpenShift AI's Data Science Pipelines component allows authenticated tenants to bypass authorization controls in the setDefaultServiceAccount function by submitting a crafted CreateRun request that references a more privileged ServiceAccount than they are entitled to use. Successful exploitation enables the tenant's pipeline containers to run with elevated Kubernetes RBAC permissions, resulting in cross-namespace secret disclosure and the ability to execute commands inside other tenants' pods. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Denial of service in ml-metadata (MLMD), a core metadata tracking component of Red Hat OpenShift AI (RHOAI), stems from an outdated statically-linked gRPC stack that retains known HTTP/2 resource exhaustion weaknesses. An in-cluster adversary with network reachability to the MLMD pod can crash it by sending specially crafted HTTP/2 requests, halting all ML pipeline runs within the affected namespace. No public exploit has been identified at time of analysis, and exploitation is constrained to actors already operating inside the Kubernetes cluster.
Credential derivation in Red Hat OpenShift AI's Data Science Pipelines Operator allows unauthenticated remote attackers to predict MariaDB root/user passwords and MinIO access/secret keys by exploiting a cryptographically weak PRNG (CWE-338). Any attacker who can reach the MinIO Route or MariaDB Service over the network can compute valid credentials without prior authentication, then access all pipeline artifacts and metadata stored in the system. No active exploitation is confirmed and no public exploit code has been identified at time of analysis, but the CVSS 7.5 High rating with AV:N and PR:N reflects a no-authentication-barrier condition against exposed services.
Privilege escalation in libvirt's `virFileChownFiles()` function allows a process confined to the `swtpm` system user to coerce the root-level libvirtd daemon into reassigning ownership of any arbitrary file on the host to the `swtpm` user. The attack exploits a symlink-following flaw (CWE-59) in directory traversal logic that runs with root privileges, affecting libvirt as packaged across Red Hat Enterprise Linux 6 through 10 and RHEL for Nvidia 26. No public exploit has been identified at time of analysis, but the attack complexity is low once `swtpm`-user execution is obtained.
Privilege escalation in Red Hat OpenShift AI's training-operator enables any user holding a standard Kubernetes edit or admin role in any cluster namespace to break out of namespace isolation, impersonate service accounts, access the host filesystem, and achieve remote code execution. The root cause is a design flaw: the operator aggregates training job permissions onto native Kubernetes built-in ClusterRoles, and allows unrestricted PodTemplateSpec passthrough - meaning users can submit training jobs containing arbitrary pod configurations such as hostPath mounts or elevated service account tokens. No public exploit code or CISA KEV listing was identified at time of analysis, but the low access complexity and the broad availability of edit/admin roles in typical ML platform deployments make this an urgent remediation priority.
Privilege escalation in Red Hat OpenShift AI (RHOAI) training operator overlay allows any namespace editor to manage TrainJob resources beyond their intended authorization scope. The RHOAI overlay incorrectly injects trainjobs CRUD permissions into the native Kubernetes edit ClusterRole, violating the principle of least privilege. When chained with a companion flaw (TRN-01) that permits arbitrary pod configuration within TrainJobs, a remote attacker holding namespace editor credentials could escalate to arbitrary code execution - no public exploit is identified at time of analysis, and KEV listing has not been confirmed.
Privilege escalation in odh-dashboard, the web interface for Red Hat OpenShift AI (RHOAI), allows any authenticated dashboard user to gain cluster-admin or other highly privileged roles by manipulating the roleRef field when creating RoleBindings. The system performs no server-side validation on the roleRef value supplied through the dashboard, enabling an attacker holding only a standard user account to bind themselves to arbitrary Kubernetes ClusterRoles. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, but the CVSS 8.8 score and the direct, low-complexity path to cluster-admin access make this a high-priority remediation target for any RHOAI deployment.
Privilege escalation in odh-dashboard (Red Hat OpenShift AI) allows an attacker who has obtained the dashboard's Service Account token to abuse overly broad SA permissions and elevate to cluster-administrator level. Exploitation grants full access to secrets, credentials, and keys across the entire OpenShift cluster, while also breaking multi-tenant isolation between workloads. No public exploit code has been identified at time of analysis, and this CVE is not in CISA KEV, but the CVSS score of 8.8 and cluster-wide blast radius make it a high-priority remediation target for RHOAI deployments.
Unauthenticated remote code execution affects Feast (the open-source ML feature store), where user-defined functions stored in the registry are serialized with Python's 'dill' library and deserialized without validation. In default configurations a remote attacker can store a malicious UDF and achieve unauthenticated code execution on the feature server; an authenticated attacker can bypass authorization during deserialization to run code on the registry server, enabling cross-tenant data access and lateral movement. Rated CVSS 9.9 with a scope change; no public exploit has been identified at time of analysis, and it is not listed in CISA KEV. Feast is bundled in Red Hat OpenShift AI (RHOAI), which is the reporting vendor's affected product.
Authorization bypass in Feast's materialization API endpoints within Red Hat OpenShift AI (RHOAI) permits full re-materialization of all feature views by sending a crafted request that omits the feature_views field, circumventing permission checks. The consequence is a multi-tenant Denial of Service through data corruption and significant resource exhaustion, impacting all tenants sharing the deployment. No public exploit code has been identified at time of analysis, but the bypass mechanism is straightforward - a structural omission in the request body - making independent rediscovery likely for any attacker with API access.
Feast and feast-operator ship with a default 'no_auth' security configuration, leaving the feature-server, registry-server, and offline-server endpoints completely unauthenticated and accessible to any network-reachable attacker in Red Hat OpenShift AI (RHOAI) deployments. Exploitation enables three distinct high-impact outcomes: remote code execution via injection of a malicious User-Defined Function (UDF) onto the feature-server, denial of service by forcing full re-materialization of all tenant features, and unauthorized read access to cross-tenant feature data. No public exploit code has been identified at time of analysis and CISA KEV status is not confirmed, but the trivial exploitation conditions - no authentication, no interaction, default configuration - make this a realistic priority for any RHOAI operator.
Privilege escalation in Red Hat Data Science Pipelines (DSP) allows an authenticated namespace editor to gain node-root access by submitting a crafted Argo Workflow via the V1 API path. The API server, acting as a confused deputy (CWE-266), creates pods with elevated privileges on the attacker's behalf, effectively breaking out of Kubernetes namespace isolation. Successful exploitation enables arbitrary code execution and full control over the underlying cluster node; no public exploit has been identified at time of analysis, and this is not listed in CISA KEV.
MySQL DSN parameter injection in Red Hat OpenShift AI's Data Science Pipelines Operator (DSPO) allows a namespace editor to enable the MySQL LOCAL INFILE feature via the unvalidated spec.database.customExtraParams field, enabling exfiltration of sensitive files - including Kubernetes service account tokens - from the operator pod. An attacker who exploits this can leverage the stolen token to impersonate the operator's service account and escalate privileges to cluster-admin level within the OpenShift cluster. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Overprivileged ClusterRole assignments in Red Hat OpenShift AI's Data Science Pipelines Operator (DSPO) create a cluster-wide privilege escalation path if the operator pod is compromised. The DSPO ClusterRole grants capabilities well beyond operational necessity - including pod exec and cluster-wide RBAC management - directly violating the principle of least privilege (CWE-250). Successful exploitation of a compromised DSPO pod would allow an attacker to assume full administrative control over the entire Kubernetes cluster; no public exploit or CISA KEV listing has been identified at time of analysis, but the CVSS scope-change flag (S:C) confirms the blast radius extends far beyond the initial compromise boundary.
Authentication bypass in TrustyAI Service (TAS) within Red Hat OpenShift AI (RHOAI) exposes the backend API to any pod on the cluster network without requiring valid credentials. The CVSS vector (AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms that an attacker with a pod on the cluster-such as through a compromised workload or a malicious tenant pod in a multi-tenant deployment-can read, modify, delete, or poison AI model monitoring data and configurations with no additional barriers. No public exploit code or CISA KEV listing has been identified at time of analysis, but the root cause (CWE-306: Missing Authentication for Critical Function) means exploitation is trivially simple once cluster network adjacency is established.
Arbitrary code execution in Red Hat OpenShift AI's trustyai-service-operator enables authenticated cluster users to bypass pod security policies via crafted sidecar container configurations in LMEvalJob resources. The CVSS 8.1 (High) score reflects network-accessible exploitation requiring only low-privilege cluster authentication, with high confidentiality and integrity impact against the affected workload context. No public exploit code has been identified and no CISA KEV listing exists at time of analysis, but the low barrier of entry (any authenticated cluster user) elevates insider-threat and compromised-account risk for RHOAI deployments.
Authentication bypass in the Models-as-a-Service (MaaS) API component of Red Hat OpenShift AI (RHOAI) lets any pod already running in the cluster impersonate arbitrary users by forging the X-MaaS-Username and X-MaaS-Group HTTP headers, which the service trusts without independent verification. Because the MaaS API performs no first-party authentication and defers entirely to a Kuadrant AuthPolicy gateway that can be circumvented, a low-privileged workload can mint Kubernetes ServiceAccount tokens in other tenants' namespaces, revoke API keys, and exfiltrate model-access configuration - a full cross-tenant privilege escalation. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV, but the 9.9 CVSS reflects near-total impact.
The MaaS (Model-as-a-Service) Gateway component in Red Hat OpenShift AI (RHOAI) is improperly configured, enabling any low-privileged authenticated user within the platform to act as a man-in-the-middle against all model-serving traffic. Affected users can intercept, read, log, and modify requests and responses traversing the gateway, exposing highly sensitive artifacts including API access keys, user input prompts, and model outputs. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog, but the CVSS 8.8 rating with high confidentiality, integrity, and availability impact reflects the severity of unrestricted traffic access within a shared AI serving environment.
Out-of-bounds write vulnerabilities in GIMP's PSD and PAA file format parsing plugins allow remote attackers to achieve code execution with the privileges of the local user by delivering a specially crafted image file. Affected deployments include GIMP packages shipped with Red Hat Enterprise Linux 6 through 9. No public exploit code has been identified at time of analysis, and CISA SSVC classifies exploitation status as none with the attack assessed as not automatable, though technical impact is rated total given the C:H/I:H/A:H CVSS profile.
Insufficient source identity validation in Red Hat Multicluster Global Hub's manager component allows a network-adjacent attacker who has compromised a managed hub to impersonate any other hub on the shared Kafka status bus. By presenting a legitimately obtained Kafka client certificate from the compromised hub while falsifying the CloudEvent source field, the attacker can overwrite or delete compliance records, inventory data, and cluster health telemetry belonging to sibling hubs in the shared database. No public exploit has been identified at time of analysis, but the scope-changed CVSS vector (S:C) reflects that the integrity impact extends beyond the initially compromised hub to the entire multi-hub management plane.
Arbitrary code execution in GIMP's PSD import plugin allows an attacker to run code in the context of the user who opens a maliciously crafted .psd file. An unsigned integer underflow in the plugin's block_rem length variable (CWE-191) corrupts parsing of Photoshop layer resource blocks, letting attacker-controlled data be treated as trusted structures. Reported by Red Hat and tracked upstream in GNOME's GIMP tracker; SSVC lists a proof-of-concept, though it is not in CISA KEV and EPSS exploitation probability is low (0.31%).
Heap overflow in GIMP's Seattle Filmworks file loader allows an attacker who tricks a user into opening a specially crafted SFW file to write several kilobytes of attacker-controlled data beyond the intended buffer, resulting in memory corruption that can lead to arbitrary code execution or denial of service. Affected platforms confirmed via CPE data are Red Hat Enterprise Linux 6 through 9 with GIMP installed. No public exploit code has been identified and this CVE is not listed in CISA's KEV catalog, but the high CVSS 7.8 score reflects the full confidentiality, integrity, and availability impact achievable once a victim is socially engineered into opening the malicious file.
Integer overflow and underflow flaws in GStreamer's gst-plugins-ugly ASF demuxer expose systems to denial of service and limited heap data disclosure when processing attacker-controlled media files. The asfdemux plugin fails to adequately validate length and size fields inside ASF/WMV/WMA header objects, allowing arithmetic overflows to bypass bounds checks and trigger out-of-bounds heap reads. Any application or user that opens an untrusted media file through a GStreamer pipeline - browsers, media players, thumbnailers - is exposed; no public exploit or CISA KEV listing has been identified at time of analysis.
Heap out-of-bounds write in GStreamer's adpcmdec element allows a crafted WAV file containing malformed multi-channel IMA/DVI ADPCM audio to corrupt application memory, cause denial of service, or potentially achieve arbitrary code execution. Affected deployments include Red Hat Enterprise Linux 7 through 10, where the vulnerable gst-plugins-bad package is distributed. No confirmed active exploitation (not in CISA KEV) and no public proof-of-concept has been identified at time of analysis, though the CVSS score of 7.6 reflects the realistic network-deliverable, user-interaction-dependent attack path.
Command injection in dracut's die() error-handling function allows an unauthenticated attacker on the adjacent network, controlling a rogue DHCP server, to execute arbitrary commands as root during initramfs boot-failure recovery. The flaw exists because error messages written into emergency hook shell scripts under the initramfs environment are not shell-quoted, and those messages can carry attacker-controlled data sourced from the DHCP ROOT_PATH option processed by the 40network module. No public exploit code or CISA KEV listing has been identified at time of analysis, but the exploitation primitive is conceptually straightforward for anyone with DHCP server control on the local network segment.
Unbounded memory growth in GStreamer's RTP H.264 and H.265 depayloader elements allows a remote unauthenticated attacker to exhaust process memory and terminate any application consuming RTP video streams. The rtph264depay and rtph265depay elements in gst-plugins-good lack an upper bound on their internal reassembly buffer, meaning an attacker who continuously sends fragmented RTP packets while withholding the end-of-fragment marker can grow that buffer without limit. No public exploit has been identified at time of analysis, and CISA KEV listing is absent, but the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates this is trivially exploitable against any exposed GStreamer RTP pipeline.
Session hijacking via SAML assertion replay in Keycloak's SAML broker component allows adjacent-network attackers to authenticate as arbitrary users without credentials. When Keycloak is deployed as a SAML broker in IdP-Initiated flow mode, it fails to enforce the SAML OneTimeUse condition, permitting a captured assertion to be submitted multiple times. No public exploit has been identified at time of analysis, and EPSS sits at 0.14% (4th percentile), though SSVC rates technical impact as total - reflecting the full account takeover consequence if the preconditions are met.
Privilege escalation in Red Hat Build of Keycloak's Dynamic Client Registration (DCR) grants an attacker with low-privilege client registration credentials full realm administrator access by exploiting a validation bypass in the 'Allowed Protocol Mapper Types' security policy. The policy correctly validates mapper types at initial registration but fails to re-validate the mapper type during a client update when the mapper's surrounding configuration is unchanged, allowing a type-swap from a permitted mapper to a restricted high-privilege mapper (such as a HardcodedRoleMapper that injects realm-admin roles into tokens). No public exploit code has been identified and no CISA KEV listing is present, but the attack is low-complexity, fully network-exploitable, and results in complete confidentiality, integrity, and availability compromise of the Keycloak realm.
Account takeover in Keycloak (Red Hat build of Keycloak, Red Hat Single Sign-On 7) arises because the IdP-initiated SAML SSO endpoint does not verify whether an upstream identity provider is restricted to account-linking-only mode. An attacker who controls a linked upstream identity can drive that endpoint to complete a full login rather than a mere link operation, seizing complete access to the corresponding local user account. Red Hat has shipped fixes; there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.19%).
Privilege escalation in Keycloak's Dynamic Client Registration (DCR) component allows attackers with standard user accounts and limited Initial Access Tokens to forge administrative roles directly into their own access tokens. The underlying flaw is a missing claim-path validation in the default DCR policy for User Property mappers, which permits writing attacker-controlled values into sensitive internal claim locations that normally carry role and privilege assertions. Successful exploitation enables takeover of other registered OAuth clients, exfiltration of confidential client secrets, and full administrative control over the affected Keycloak realm. No confirmed active exploitation or public exploit code is identified at time of analysis.
URI normalization bypass in Keycloak's Authorization Services PathMatcher allows authenticated low-privilege users to reach administrative or restricted endpoints by appending trailing slashes or matrix parameters to request URIs. Affected deployments include Red Hat Build of Keycloak, Red Hat Single Sign-On 7, Red Hat Data Grid 8, and Red Hat JBoss EAP Expansion Pack. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, though the high CVSS confidentiality and integrity impact scores reflect meaningful privilege escalation risk in production environments.
Authentication bypass in Red Hat Build of Keycloak (and Red Hat Single Sign-On 7) lets an unauthenticated attacker forge SAML responses to hijack accounts when a SAML identity-provider's metadata was imported without explicit key-usage attributes, causing the keycloak-services identity-brokering engine to silently disable signature validation despite a signing certificate being present. Rated CVSS 9.1 with total technical impact per CISA SSVC, an attacker who knows a victim's external identifier can log in as that user. No public exploit identified at time of analysis, and EPSS is low (0.14%, 4th percentile), indicating the risk is currently theoretical/targeted rather than mass-exploited.
Memory corruption in libkcapi's one-shot asynchronous I/O path allows a local process to induce kernel writes into application-owned output buffers after an error return. Affected platforms include Red Hat Enterprise Linux 8, 9, and 10, Red Hat Hardened Images, and OpenShift Container Platform 4. An unprivileged local attacker or a compromised application can exploit this use-after-free-class condition to crash the calling process (high availability impact) or corrupt buffer contents for limited confidentiality and integrity impact. No public exploit code or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in SSSD's PAM responder allows a local low-privileged attacker to crash the SSSD process and disclose sensitive memory contents by sending a crafted protocol v1 authentication request. Affected systems span all major Red Hat Enterprise Linux releases (6 through 10) and OpenShift Container Platform 4, representing a broad footprint in enterprise Linux environments. No active exploitation is confirmed (not listed in CISA KEV), and the EPSS score of 0.14% at the 3rd percentile reflects a very low observed exploitation probability at time of analysis.
Heap-buffer-overflow vulnerabilities in GIMP's APNG file loader and DDS plug-in allow code execution when a user opens a specially crafted image file. The APNG flaw is triggered when the fcTL chunk width exceeds the IHDR width, causing pixel data to overwrite memory beyond the heap allocation; the DDS flaw stems from a bits-per-pixel mismatch in load_layer(). Both affect GIMP as packaged on Red Hat Enterprise Linux 6 through 9. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Privilege escalation in Red Hat Build of Keycloak's user creation component exposes environments running Fine-Grained Admin Permissions V2 (FGAP V2) to unauthorized group assignment by scoped sub-administrators. A sub-admin holding only user-create permissions can bypass group-level authorization checks and enroll newly created users into any group - including privileged or sensitive ones - well beyond the sub-admin's delegated scope. SSVC rates technical impact as total and no public exploit has been identified, though the EPSS score of 0.24% (15th percentile) and SSVC exploitation status of 'none' indicate low immediate exploitation likelihood.
Denial of service in gnome-remote-desktop as shipped in Red Hat Enterprise Linux 8, 9, and 10 lets an unauthenticated remote attacker exhaust server resources when the daemon runs in system mode with RDP enabled. Because the incoming connection handler bypasses the connection throttler, an attacker can open large numbers of parallel pre-authentication RDP connections, accumulating accepted sockets and pending routing-token operations until timeout and blocking legitimate RDP logins. There is no public exploit identified at time of analysis, and the flaw is specific to Red Hat's build - it does not affect the upstream project.
Information disclosure in 389 Directory Server (upstream of Red Hat Directory Server 11-13, shipped across RHEL 6-10) lets an unauthenticated remote attacker inject LDAP search filters into the CleanAllRUV replication status-check extended operation. Because the handler evaluates attacker-controlled filters against cn=config using elevated replication-plugin privileges and leaks a boolean match result, attackers can blindly enumerate sensitive configuration metadata such as replication bind DNs and password storage scheme details. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the network-reachable, no-authentication attack surface makes it a meaningful reconnaissance primitive.
Remote unauthenticated denial of service in 389 Directory Server (389-ds-base, shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) allows an attacker to crash the LDAP daemon by sending a crafted replication extended operation. The flaw is a stack buffer overflow in the RUV parsing path that triggers during payload decoding before any authorization check, so no credentials are needed. No public exploit identified at time of analysis; stack protectors constrain the outcome to a server crash rather than code execution.
Deploy-time policy bypass in Red Hat Advanced Cluster Security for Kubernetes 4 lets a user with Kubernetes Deployment-create permission spoof workload identity by setting the openshift.io/encoded-deployment-config label to "null", forcing ACS to record the workload with empty UID, name and labels and a "default" namespace. This evades ACS deploy-time policy detection and enforcement visibility and corrupts Central's persistence, violation reporting and compliance correlation. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Token exchange in Keycloak bypasses Google Workspace domain allowlist restrictions, enabling any valid Google account holder - regardless of their domain - to swap a Google OAuth token for a Keycloak realm token and gain unauthorized access. Affected deployments are those specifically configured to restrict Google-based logins to approved Workspace domains while also having token exchange enabled; both conditions must be present. No public exploit code has been identified at time of analysis, and EPSS sits at 0.20% (10th percentile), consistent with SSVC's exploitation status of 'none', though SSVC rates technical impact as 'total' given that successful exploitation delivers full realm access.
Tenant-restriction bypass in Keycloak's Microsoft identity provider integration allows attackers holding any valid Microsoft OAuth token - even from a completely unrelated Azure AD organization - to authenticate into a Keycloak realm via the token exchange feature. Affected deployments include Red Hat Build of Keycloak, Red Hat Single Sign-On 7, and Red Hat JBoss EAP Expansion Pack. With CVSS PR:L reflecting the need for a valid Microsoft credential (trivially obtained by registering a free Azure tenant), successful exploitation grants high confidentiality and integrity impact within the realm. No public exploit or active exploitation has been identified at time of analysis; EPSS sits at 0.19% (9th percentile), consistent with SSVC exploitation=none.
Local privilege escalation to root via argument injection in the APT backend of yggdrasil-worker-package-manager, the Red Hat Insights remote package-management worker shipped with Red Hat Enterprise Linux 10. Because package names are passed directly to apt-get without an argument terminator, a name beginning with a hyphen is parsed as a command-line option rather than a package, letting an attacker who can influence the package list achieve root-level remote code execution. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but an upstream source fix is already merged and released in versions 0.1.4 and 0.2.4.
Confidential Active Directory attribute disclosure in Samba's Active Directory Domain Controller allows an authenticated low-privilege domain user to read protected directory attributes by abusing how LDAP Compare requests are handled. Because Samba fails to validate user-supplied attribute names (LDAP filter injection, CWE-90) and runs the resulting internal search in a trusted context, normal ACL enforcement is bypassed; in gMSA-enabled deployments this permits extraction of msKds-RootKeyData and offline derivation of Group Managed Service Account passwords, which can escalate to full domain compromise. No public exploit identified at time of analysis and the issue is not listed in CISA KEV, but a vendor patch is available.
Remote unauthenticated denial of service in Performance Co-Pilot (PCP), the system performance monitoring toolkit shipped with Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4, allows an attacker to permanently disable a PCP daemon by triggering a signed integer overflow (CWE-190) in the __pmGetPDU() PDU-length handling routine. A crafted network packet sent during normal PDU processing or SASL authentication negotiation corrupts the read logic so that the daemon can no longer read any subsequent packets, requiring a manual restart. There is no public exploit identified at time of analysis and the flaw yields no code execution or data exposure - impact is availability-only (CVSS 7.5, A:H).
Remote unauthenticated access-control bypass in the Performance Co-Pilot (PCP) pmproxy component lets attackers reach the /store endpoint and overwrite arbitrary PMDA (Performance Metrics Domain Agent) metric values, which the reporter (Red Hat) states can escalate to arbitrary code execution and full system takeover. The flaw affects PCP as shipped across Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the network-reachable, no-authentication attack surface makes exposed pmproxy instances a meaningful risk.
Local privilege escalation in Performance Co-Pilot (PCP) on Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4 arises from the linux_sockets module exposing an unsecured internal connection. An attacker who already holds low-level code execution on the host can leverage this leaked/unprotected socket to run arbitrary commands as root. No public exploit has been identified at time of analysis and the flaw is not in CISA KEV, so exploitation would require an existing foothold rather than remote unauthenticated access.
Local privilege-relevant command injection in Performance Co-Pilot's (PCP) linux_sockets PMDA lets an authenticated user inject shell metacharacters through the network.persocket.filter metric, causing arbitrary commands to run as the PMDA user each time metrics refresh. Reported by Red Hat, it affects the pcp packages shipped across Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Robot account token disclosure in Red Hat Quay 3 allows a user assigned to the GLOBAL_READONLY_SUPER_USERS role to read the tokens of robot accounts belonging to repositories they are not a member of. Because these tokens are long-lived registry credentials, the read-only superuser can escalate a view-only role into full impersonation of any robot account, gaining whatever push/pull and repository permissions that robot holds. No public exploit identified at time of analysis; not listed in CISA KEV.
Out-of-bounds write in GNU binutils' BFD library (bfd/elf32-dlx.c) lets a crafted ELF/DLX object file corrupt memory and achieve arbitrary code execution when parsed by any BFD-consuming tool (objdump, readelf, strip, ld, nm, objcopy). Reported by Red Hat and tracked against RHEL 6-10, Hardened Images and OpenShift 4, the flaw is only reachable when binutils is compiled with the DLX backend (typically --enable-targets=all), so exposure is gated by a non-default build option. There is no public exploit identified at time of analysis (not in CISA KEV), though the researcher demonstrated code execution via a File Stream Oriented Programming (FSOP) attack on glibc FILE structures.
Privilege escalation in CRIU allows a malicious container process to spoof credentials during checkpoint, resulting in elevated capabilities upon restore. On Red Hat platforms, effective exploitation is mitigated by mandatory access controls, user namespaces, and the requirement for privileged checkpoint initiation. No public exploit identified at time of analysis.
Arbitrary command execution as root via udev property injection in sg3_utils when sg_inq --export parses a SCSI device with a crafted name string. Affects multiple Red Hat Enterprise Linux versions shipping sg3_utils. Publicly available exploit code exists as a proof-of-concept in the upstream fix; no active exploitation has been reported.
Identity header smuggling in OpenShift Container Platform 4.x allows authenticated low-privilege users to escalate privileges by injecting forged identity headers that upstream applications may trust. The oauth-proxy fails to strip underscore-variant headers, enabling WSGI and PHP frameworks to normalize them into the legitimate identity, potentially overriding the true authenticated user. No known active exploitation or public exploit code has been identified.
We need to produce a JSON with the specified fields. Let's analyze the input. CVE ID: CVE-2026-17107 Description: A flaw in cluster-proxy service-proxy component used in RHACM and MCE. The service-proxy appends impersonation group headers to proxied requests without first removing caller-supplied values, and the spoke ServiceAccount holds unrestricted impersonation permissions. An authenticated hub principal can inject an Impersonate-Group header to escalate to cluster-admin on every managed cluster. CVSS: 8.5, vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H CWE: CWE-441 (Unintended Proxy or Intermediary ('Confused Deputy')). Actually CWE-441: Unintended Proxy or Intermediary ('Confused Deputy')? Wait, description: "The software fails to properly de-identify or sanitize caller-supplied data when acting as a proxy, relay, or other intermediary." That fits. EPSS: 0.23%, percentile 14% (low). KEV: not mentioned, so no active exploitation. POC: not mentioned. Tags: Kubernetes, Red Hat, Privilege Escalation, Multicluster Engine For Kubernetes. SSVC: Exploitation: none, Automatable: no, Technical Impact: total. References: access.redhat.com security page, bugzilla, vuldb, RHSA-2026:46885 (likely an errata with fix). Also CPE: cpe:2.3:a:red_hat:multicluster_engine_for_kubernetes:*:*:*:*:*:*:*:* - all versions, so no specific version range given. It mentions RHACM and MCE. So product name: Red Hat Advanced Cluster Management for Kubernetes (RHACM) and multicluster-engine (MCE). The CPE given is for MCE. Primary product: Could be "Red Hat MCE" or "Red Hat Advanced Cluster Management". We'll pick the main one as "Red Hat Advanced Cluster Management for Kubernetes" or combine? "Red Hat Advanced Cluster Management" probably. I'll pick "Red Hat Advanced Cluster Management" as product_name, since that's the parent product. But the vulnerability is in cluster-proxy service-proxy component that is part of both. I'll use "Red Hat Advanced Cluster Management for Kubernetes (R
Denial of service in OpenPrinting libcupsfilters (as shipped in Red Hat Enterprise Linux 7 through 10) allows a network-adjacent attacker to pin a CPU at 100% by broadcasting a crafted printer advertisement. The flaw lies in cfIEEE1284NormalizeMakeModel(), which enters an infinite loop (CWE-835) when parsing an IEEE-1284 device ID whose model field is empty. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; impact is limited to availability with no data compromise.
Authentication bypass in the odh-dashboard web console of Red Hat OpenShift AI (RHOAI) lets a low-privileged actor already inside the cluster impersonate any user — including cluster administrators — by supplying an arbitrary access token to a component that was incorrectly bound to a reachable network interface. Because the impersonated identity is honored against the Kubernetes API, this escalates to arbitrary code execution, privilege escalation, and information disclosure across the cluster. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score was provided, but the CVSS 8.8 (High) rating and full C/I/A impact make it a serious internal-threat priority.
Local code execution in the Visual Studio Code Ansible (Lightspeed) extension lets a malicious project run arbitrary shell commands on a developer's machine by abusing the ansible.executionEnvironment.containerOptions and volumeMounts settings, which fail to sanitize shell separators (CWE-78). Because these are workspace-scoped settings, simply opening a booby-trapped repository can auto-trigger execution during Language Server initialization, yielding code execution as the VS Code user. No public exploit has been identified at time of analysis, and the flaw is not listed in CISA KEV; CVSS is 7.8 (High).
Arbitrary command execution in ansible-core allows an attacker who controls a collection source URI to run commands on a victim's machine when that victim executes 'ansible-galaxy collection install' against the malicious git source. The flaw lives in _extract_collection_from_git() in concrete_artifact_manager.py, which builds git clone commands without a '--' end-of-options separator, letting crafted URIs be parsed as git arguments. It is an incomplete fix for CVE-2026-11332, which patched the analogous role-install path but left the collection-install path exposed; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Privilege escalation via authentication bypass in libssh affects servers that enable GSSAPIKeyExchange, where the gssapi-keyex authentication path fails to confirm that the authenticated Kerberos principal is actually authorized for the local user account being requested. An already-authenticated client holding any valid Kerberos principal in the realm can therefore log in as an arbitrary user, including potentially privileged accounts, on Red Hat Enterprise Linux 8, 9, and 10 and Red Hat Hardened Images. No public exploit is identified at time of analysis and the issue is not listed in CISA KEV, but the CVSS of 8.8 reflects a straightforward, low-complexity abuse once a valid Kerberos credential is held.
Denial of service (and potential use-after-free) in libssh occurs when the library processes SSH data packets that arrive after a channel has been closed, causing channel data callbacks to fire against already-freed memory. Any application or system linking the affected libssh - including Red Hat Enterprise Linux 8, 9, and 10 and Red Hat Hardened Images - can be crashed by a malicious SSH peer that sends channel data at the wrong point in the connection lifecycle. There is no public exploit identified at time of analysis, EPSS is low (0.26%), and CISA SSVC scores exploitation as none, indicating a real but non-urgent memory-safety fix.
Denial of service in libssh affects clients that use automatic certificate-based public key authentication, where logic errors cause the client to loop indefinitely when configured certificates are absent or are repeatedly rejected by the SSH server. Reported by Red Hat and shipped in Red Hat Enterprise Linux 8, 9, and 10 plus Red Hat Hardened Images, the flaw lets a hostile or misconfigured server hang a connecting client and consume CPU. There is no public exploit identified at time of analysis, and EPSS is low at 0.17% (7th percentile), consistent with an availability-only, client-side bug rather than a mass-exploited issue.
Integrity-protection bypass in libssh builds compiled against the OpenSSL crypto backend, caused by incorrect AES-GCM finalization checks that fail to verify the authentication tag. An in-path (man-in-the-middle) attacker positioned on an SSH session can silently alter plaintext bytes on the wire without triggering a MAC/integrity failure, defeating a core guarantee of the SSH transport layer. There is no public exploit identified at time of analysis, EPSS risk is low (0.28%, 20th percentile), and CISA SSVC rates exploitation as 'none' though 'automatable: yes'.
Denial of service in libcupsfilters and cups-filters (the OpenPrinting image-filtering stack bundled with Red Hat Enterprise Linux 7 through 10) allows an unauthenticated attacker to abort the CUPS image filter by submitting a specially crafted PNG print job. The PNG reader instantiates a libpng decoder without registering an error-recovery handler, so a malformed image triggers libpng's default fatal-error path and terminates the filter process, killing the in-flight print job. No public exploit identified at time of analysis; this is a print-job availability issue, not a code-execution or data-exposure flaw.
Arbitrary file write in pulpcore's FilesystemExport feature allows an authenticated administrator to escape the intended export directory via directory-traversal sequences embedded in a user-controlled relative_path. Because the exported file content is also attacker-supplied (an uploaded artifact), the flaw lets a privileged user plant or overwrite arbitrary files anywhere the Pulp service user can write, enabling service compromise or broader host takeover. Rated CVSS 9.0 and reported by Red Hat, it affects pulpcore as embedded in Ansible Automation Platform 2, Satellite 6, and Red Hat Update Infrastructure 4/5; there is no public exploit identified at time of analysis.
Local privilege escalation to root in the QEMU Guest Agent (qga) affects Red Hat Enterprise Linux 6 through 10, RHEL for NVIDIA 26, and OpenShift Container Platform 4, where a local unprivileged guest user abuses the guest-ssh-add-authorized-keys command handler through symlink manipulation to seize ownership of arbitrary root-owned files. Two attack variants exist - a deterministic directory-symlink bypass and a TOCTOU file-symlink race - both requiring an external management layer such as libvirt to invoke the code path. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the CVSS 7.3 rating and clean path to full root access make it a meaningful local escalation risk in multi-tenant virtualization estates.
Out-of-bounds heap write in the freedesktop xdgmime library (bundled with GLib-based MIME detection) allows a local attacker to crash or corrupt the memory of any application that guesses content types via g_content_type_guess(). The flaw lives in _xdg_mime_magic_parse_magic_line() in xdgmimemagic.c and triggers on little-endian systems when a maliciously crafted MIME magic file placed in a user-writable XDG data location is parsed, producing a 2-byte out-of-bounds write. Red Hat rates it 7.1 (Important); no public exploit is identified at time of analysis and it is not listed in CISA KEV.
Sandbox escape in PipeWire's PulseAudio compatibility layer lets a low-privileged process inside a confined environment such as Flatpak load an attacker-controlled library and execute arbitrary code on the host user's session. The flaw (CWE-427) is present in PipeWire as shipped in Red Hat Enterprise Linux 7, 8, 9 and 10 and carries a scope-changing CVSS 3.1 score of 8.8. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Denial of service in libsolv's PGP signature verification (solv_pgpvrfy) allows remote attackers to crash automated package and repository processing by supplying a crafted Ed25519 signature. The flaw is a stack-based buffer overflow (CWE-121) triggered when the EdDSA 's' MPI is copied into a fixed 64-byte stack buffer using an attacker-controlled mismatched length. It affects the libsolv dependency solver embedded in Red Hat Enterprise Linux 7/8/9/10, OpenShift, Satellite, RHUI, openSUSE/SUSE, Ubuntu and Debian; no public exploit identified at time of analysis and it is not in CISA KEV.
Access-control bypass in Keycloak (fixed in 26.5.3) lets a disabled user account still obtain valid tokens through the JWT authorization grant preview feature. When that feature is enabled, Keycloak omits the account-enabled check during JWT authorization grant processing, so a low-privileged remote attacker who can present a valid assertion token from an external identity provider can mint a JWT for an account an administrator has explicitly disabled, regaining access to protected resources. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Out-of-bounds heap write in QEMU lets a local attacker operating inside a guest virtual machine corrupt memory in the host emulator process, enabling information disclosure, data-integrity corruption, or denial of service. The flaw stems from cpu_physical_memory_map() returning a shorter buffer length than the caller assumes, so subsequent writes spill past the allocation. Rated CVSS 7.8 (CWE-787); no public exploit identified at time of analysis, but multiple distributions (Red Hat, Ubuntu, SUSE, Debian) have shipped fixes.
Denial of service in the Feast Feature Server (the Python feature-store serving component, also shipped within Red Hat OpenShift AI/RHOAI) lets remote unauthenticated attackers exhaust host resources through its `/ws/chat` WebSocket endpoint. Because the endpoint accepts unlimited concurrent connections and unbounded message traffic, opening many simultaneous sockets drains memory, CPU, and file descriptors until legitimate clients are locked out. There is no public exploit identified at time of analysis and this is not listed in CISA KEV; the upstream fix in PR #192 caps connections, message size, and message rate.
mTLS authentication bypass in the Red Hat Ansible Automation Platform (AAP) Gateway Envoy proxy allows unauthenticated remote attackers to inject spoofed events into protected Event-Driven Ansible (EDA) event streams. The non-mTLS route to EDA event streams fails to strip the client-supplied Subject HTTP header even though the source defines requestHeadersToRemove for it, so an attacker can forge a Subject value matching a legitimate client certificate's Distinguished Name and impersonate an authenticated client. No public exploit identified at time of analysis; the issue is tracked by Red Hat (CWE-290, CVSS 8.2) but is not on CISA KEV and no EPSS score was provided.
Privilege escalation in CRI-O (the OCI container runtime used by Red Hat OpenShift Container Platform 4 and many Kubernetes clusters) lets an attacker who can set container environment variables inject a newline into the HOME variable and append arbitrary lines to /etc/passwd, enabling creation of a rootful or otherwise privileged account inside the container. It is a bypass of the incomplete fix for CVE-2022-4318, whose HOME sanitization was insufficient. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Denial of service in Red Hat OpenShift GitOps (Argo CD operator) lets a tenant who controls a namespace-scoped Argo CD instance delete a ClusterRole belonging to a cluster-scoped Argo CD instance by crafting a name collision. Because the ClusterRole reconciler skips ownership validation (CWE-862), a low-privileged tenant can disrupt a higher-privileged, cluster-wide GitOps instance across the trust boundary. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the cross-tenant scope change makes it a meaningful multi-tenancy integrity concern.
Remote denial of service in libsoup, the GNOME HTTP client/server library, allows unauthenticated attackers to crash any application using libsoup's WebSocket support by sending a single malformed control frame. The parser fails to enforce RFC 6455's 125-byte limit on PING/PONG/CLOSE control frames and mishandles the oversized payload instead of cleanly closing the connection, causing an internal processing crash. Red Hat reports the flaw across RHEL 6 through 10; no public exploit has been identified at time of analysis and no EPSS score was provided.
Denial of service in libsoup's WebSocket permessage-deflate implementation lets a remote, unauthenticated attacker crash applications by sending a small, highly compressed 'decompression bomb' that expands without bound during inflation, exhausting memory and triggering an Out-of-Memory kill. All Red Hat Enterprise Linux 6 through 10 ship the affected libsoup HTTP/WebSocket library, and client connections are especially exposed because the decompressed-size guard (max_total_message_size) is disabled by default for clients. There is no public exploit identified at time of analysis and this CVE is not listed in CISA KEV.
Remote code execution in the Argo CD repo-server component (as shipped in Red Hat OpenShift GitOps and the argoproj argo-helm chart) allows an unauthenticated attacker with network access to the repo-server to run arbitrary code and, under certain conditions, poison cached manifests to push malicious Kubernetes resources into managed clusters, enabling full cluster takeover. The root cause is missing authentication (CWE-306) on a critical internal service that the default Helm chart left network-exposed. There is no public exploit identified at time of analysis, but detailed third-party technical research (Synacktiv) and press coverage exist, and the flaw was reported unpatched at disclosure.
Privilege escalation in Red Hat OpenShift's incluster-checks diagnostic tool lets any authenticated user holding the standard 'edit' RBAC role escalate to root on the underlying cluster nodes. The tool provisions privileged debug pods with host-filesystem access inside the shared default namespace, so a low-privileged tenant can simply exec into an existing pod and break out to the host. No public exploit identified at time of analysis, and no CISA KEV listing; EPSS data was not provided in the source intelligence.
Sensitive information disclosure in Red Hat OpenShift AI's vllm-orchestrator-gateway component exposes bearer tokens and full chat payloads because the production binary writes all incoming Authorization headers and complete request bodies to persistent logs. Any user holding logging privileges can read these logs to harvest live credentials and potentially PII-laden conversation content. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Server-side request forgery in the file_type content detector of guardrails-detectors (a component shipped with Red Hat OpenShift AI/RHOAI) allows a remote attacker to submit an arbitrary XML Schema Definition (XSD) that the parser resolves without restriction, coercing the server into fetching attacker-chosen URLs or reading local files. Because the CVSS vector is AV:N/PR:N/UI:N with a changed scope and high confidentiality impact (base score 9.3), an unauthenticated attacker can pivot into internal networks and harvest secrets such as cloud provider credentials. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Denial of service in GStreamer's DTLS plugin allows a remote unauthenticated attacker to crash any application that performs a DTLS handshake (notably WebRTC/webrtcbin pipelines) by presenting a TLS certificate with an oversized Subject Distinguished Name. The Subject DN is written into a fixed 2048-byte stack buffer with no bounds checking (CWE-121), and overflowing it corrupts the stack and terminates the process. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; impact is limited to availability (process crash), with no code execution or data exposure claimed.
Heap buffer overflow in GStreamer's rfbsrc (RFB/VNC source) plugin lets a malicious VNC server crash or corrupt the memory of any client that connects to it. When the server advertises a 16bpp framebuffer and sends Hextile-encoded updates, the background-fill path writes 32-bit pixels into a 16-bit buffer, producing an out-of-bounds heap write. No public exploit identified at time of analysis; the primary confirmed impact is denial of service, with potential for further memory corruption. This is a client-side flaw requiring the victim to connect to attacker-controlled infrastructure.
Cross-tenant bearer-token disclosure in Red Hat Advanced Cluster Management for Kubernetes 2 (RHACM) lets an authenticated tenant abuse the GitOpsCluster controller in the multicloud-integrations component to redirect spoke-cluster credentials into a namespace they control. Because the controller acts on the tenant's behalf across trust boundaries (a confused-deputy flaw), a low-privileged user can obtain tokens that grant access to managed spoke clusters and bypass ArgoCD AppProject scoping controls. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the CVSS base score is 9.6 (Critical).
Cross-cluster remote code execution in Red Hat Advanced Cluster Management for Kubernetes 2 (multicloud-integrations / ArgoCD pull-model integration) lets a low-privileged hub tenant who can create Application CRs redirect propagation to arbitrary managed spoke clusters. Because the Application propagation controller trusts the attacker-supplied `ocm-managed-cluster` annotation without validation, an attacker forces ArgoCD on targeted spokes to sync attacker-controlled manifests, yielding code execution or privilege escalation there. CVSS 9.9 with scope change; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Incorrect authorization in FreeIPA's trust-fetch-domains command allows any authenticated, non-privileged IPA user to trigger a privileged Active Directory trust refresh using an attacker-supplied server and credentials, writing attacker-controlled trusted-domain and ID-range data into the FreeIPA LDAP directory. The flaw (CWE-863) stems from the command being gated by a read-only trust object permission rather than the required trust-administration permission, effectively bypassing the authorization boundary between read and write operations on cross-realm identity data. No public exploit has been identified and CISA has not listed this in KEV, but the scope-changed CVSS score of 8.2 and high integrity impact reflect serious potential for identity infrastructure tampering in environments running AD trusts.
Code injection in the Perl DBI module as packaged for Red Hat Enterprise Linux allows a network-accessible, low-privileged attacker to execute arbitrary code, resulting in full confidentiality, integrity, and availability compromise. This CVE is a remediation of an incomplete fix for CVE-2026-14380, specifically targeting RHEL 9.8.z and 10.2.z patch levels where the prior partial fix left an exploitable residual path. No public exploit or CISA KEV listing is identified at time of analysis, but the CWE-94 classification and RCE tag indicate high potential impact if exploitation conditions are met.
Server-Side Request Forgery in Red Hat OpenShift Container Platform 4's Dev Console webhook helpers allows authenticated users to coerce the console pod into issuing arbitrary outbound HTTP requests on their behalf. Because the console pod operates from a privileged network position within the cluster, this enables lateral movement to internal services - including the Kubernetes API server, metadata endpoints, and internal microservices - that would otherwise be unreachable from outside the cluster. No public exploit or CISA KEV listing has been identified at time of analysis, but the Scope:Changed CVSS metric reflects the cross-boundary nature of the impact.
Server-Side Request Forgery in the OpenShift Console Helm catalog proxy allows low-privileged namespace tenants to plant a malicious ProjectHelmChartRepository resource pointing to an attacker-controlled URL, causing the console pod to issue server-side fetches that bypass tenant egress restrictions. Combined with Helm catalog metadata poisoning and subsequent admin-mediated chart installation, this multi-stage attack chain enables privilege escalation within the cluster. No CISA KEV listing or public exploit code has been identified at time of analysis, though the CVSS Scope:Changed rating correctly reflects that the console pod's cross-boundary requests extend impact beyond the originating namespace.
Privilege escalation in the `openvt -u` utility allows a local low-privileged attacker to obtain passwordless root login on Red Hat Enterprise Linux 6 through 10, Red Hat Hardened Images, and Red Hat OpenShift Container Platform 4. The flaw lies in `authenticate_user()`, which resolves VT ownership via `stat("/proc/<pid>/fd/0")` - a call that follows the symlink to the underlying TTY device node rather than inspecting the owning process, causing the check to read the device node's UID rather than the process owner's UID. When a privileged user logs out and TTY device node ownership reverts to root or the getty owner while an attacker's process still holds fd 0 on that TTY, the check incorrectly authorizes a passwordless `login -f root` execution. No public exploit is identified at time of analysis and there is no CISA KEV listing, but the root-level impact makes this a high priority for environments using the affected `kbrequest`/init deployment pattern.
Privilege escalation in MRTG (Multi Router Traffic Grapher) allows a local low-privileged attacker to gain elevated file ownership on the host system. When the MRTG daemon is launched as root and then drops privileges, a CWE-59 symlink-following flaw in PID file handling lets an attacker pre-place or manipulate a symlink at the expected PID file path, causing the root process to change ownership of an arbitrary existing file to the daemon user. Affected platforms include Red Hat Enterprise Linux 6 through 10; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in Red Hat OpenShift AI's Data Science Pipelines component allows authenticated tenants to bypass authorization controls in the setDefaultServiceAccount function by submitting a crafted CreateRun request that references a more privileged ServiceAccount than they are entitled to use. Successful exploitation enables the tenant's pipeline containers to run with elevated Kubernetes RBAC permissions, resulting in cross-namespace secret disclosure and the ability to execute commands inside other tenants' pods. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Denial of service in ml-metadata (MLMD), a core metadata tracking component of Red Hat OpenShift AI (RHOAI), stems from an outdated statically-linked gRPC stack that retains known HTTP/2 resource exhaustion weaknesses. An in-cluster adversary with network reachability to the MLMD pod can crash it by sending specially crafted HTTP/2 requests, halting all ML pipeline runs within the affected namespace. No public exploit has been identified at time of analysis, and exploitation is constrained to actors already operating inside the Kubernetes cluster.
Credential derivation in Red Hat OpenShift AI's Data Science Pipelines Operator allows unauthenticated remote attackers to predict MariaDB root/user passwords and MinIO access/secret keys by exploiting a cryptographically weak PRNG (CWE-338). Any attacker who can reach the MinIO Route or MariaDB Service over the network can compute valid credentials without prior authentication, then access all pipeline artifacts and metadata stored in the system. No active exploitation is confirmed and no public exploit code has been identified at time of analysis, but the CVSS 7.5 High rating with AV:N and PR:N reflects a no-authentication-barrier condition against exposed services.
Privilege escalation in libvirt's `virFileChownFiles()` function allows a process confined to the `swtpm` system user to coerce the root-level libvirtd daemon into reassigning ownership of any arbitrary file on the host to the `swtpm` user. The attack exploits a symlink-following flaw (CWE-59) in directory traversal logic that runs with root privileges, affecting libvirt as packaged across Red Hat Enterprise Linux 6 through 10 and RHEL for Nvidia 26. No public exploit has been identified at time of analysis, but the attack complexity is low once `swtpm`-user execution is obtained.
Privilege escalation in Red Hat OpenShift AI's training-operator enables any user holding a standard Kubernetes edit or admin role in any cluster namespace to break out of namespace isolation, impersonate service accounts, access the host filesystem, and achieve remote code execution. The root cause is a design flaw: the operator aggregates training job permissions onto native Kubernetes built-in ClusterRoles, and allows unrestricted PodTemplateSpec passthrough - meaning users can submit training jobs containing arbitrary pod configurations such as hostPath mounts or elevated service account tokens. No public exploit code or CISA KEV listing was identified at time of analysis, but the low access complexity and the broad availability of edit/admin roles in typical ML platform deployments make this an urgent remediation priority.
Privilege escalation in Red Hat OpenShift AI (RHOAI) training operator overlay allows any namespace editor to manage TrainJob resources beyond their intended authorization scope. The RHOAI overlay incorrectly injects trainjobs CRUD permissions into the native Kubernetes edit ClusterRole, violating the principle of least privilege. When chained with a companion flaw (TRN-01) that permits arbitrary pod configuration within TrainJobs, a remote attacker holding namespace editor credentials could escalate to arbitrary code execution - no public exploit is identified at time of analysis, and KEV listing has not been confirmed.
Privilege escalation in odh-dashboard, the web interface for Red Hat OpenShift AI (RHOAI), allows any authenticated dashboard user to gain cluster-admin or other highly privileged roles by manipulating the roleRef field when creating RoleBindings. The system performs no server-side validation on the roleRef value supplied through the dashboard, enabling an attacker holding only a standard user account to bind themselves to arbitrary Kubernetes ClusterRoles. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, but the CVSS 8.8 score and the direct, low-complexity path to cluster-admin access make this a high-priority remediation target for any RHOAI deployment.
Privilege escalation in odh-dashboard (Red Hat OpenShift AI) allows an attacker who has obtained the dashboard's Service Account token to abuse overly broad SA permissions and elevate to cluster-administrator level. Exploitation grants full access to secrets, credentials, and keys across the entire OpenShift cluster, while also breaking multi-tenant isolation between workloads. No public exploit code has been identified at time of analysis, and this CVE is not in CISA KEV, but the CVSS score of 8.8 and cluster-wide blast radius make it a high-priority remediation target for RHOAI deployments.
Unauthenticated remote code execution affects Feast (the open-source ML feature store), where user-defined functions stored in the registry are serialized with Python's 'dill' library and deserialized without validation. In default configurations a remote attacker can store a malicious UDF and achieve unauthenticated code execution on the feature server; an authenticated attacker can bypass authorization during deserialization to run code on the registry server, enabling cross-tenant data access and lateral movement. Rated CVSS 9.9 with a scope change; no public exploit has been identified at time of analysis, and it is not listed in CISA KEV. Feast is bundled in Red Hat OpenShift AI (RHOAI), which is the reporting vendor's affected product.
Authorization bypass in Feast's materialization API endpoints within Red Hat OpenShift AI (RHOAI) permits full re-materialization of all feature views by sending a crafted request that omits the feature_views field, circumventing permission checks. The consequence is a multi-tenant Denial of Service through data corruption and significant resource exhaustion, impacting all tenants sharing the deployment. No public exploit code has been identified at time of analysis, but the bypass mechanism is straightforward - a structural omission in the request body - making independent rediscovery likely for any attacker with API access.
Feast and feast-operator ship with a default 'no_auth' security configuration, leaving the feature-server, registry-server, and offline-server endpoints completely unauthenticated and accessible to any network-reachable attacker in Red Hat OpenShift AI (RHOAI) deployments. Exploitation enables three distinct high-impact outcomes: remote code execution via injection of a malicious User-Defined Function (UDF) onto the feature-server, denial of service by forcing full re-materialization of all tenant features, and unauthorized read access to cross-tenant feature data. No public exploit code has been identified at time of analysis and CISA KEV status is not confirmed, but the trivial exploitation conditions - no authentication, no interaction, default configuration - make this a realistic priority for any RHOAI operator.
Privilege escalation in Red Hat Data Science Pipelines (DSP) allows an authenticated namespace editor to gain node-root access by submitting a crafted Argo Workflow via the V1 API path. The API server, acting as a confused deputy (CWE-266), creates pods with elevated privileges on the attacker's behalf, effectively breaking out of Kubernetes namespace isolation. Successful exploitation enables arbitrary code execution and full control over the underlying cluster node; no public exploit has been identified at time of analysis, and this is not listed in CISA KEV.
MySQL DSN parameter injection in Red Hat OpenShift AI's Data Science Pipelines Operator (DSPO) allows a namespace editor to enable the MySQL LOCAL INFILE feature via the unvalidated spec.database.customExtraParams field, enabling exfiltration of sensitive files - including Kubernetes service account tokens - from the operator pod. An attacker who exploits this can leverage the stolen token to impersonate the operator's service account and escalate privileges to cluster-admin level within the OpenShift cluster. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Overprivileged ClusterRole assignments in Red Hat OpenShift AI's Data Science Pipelines Operator (DSPO) create a cluster-wide privilege escalation path if the operator pod is compromised. The DSPO ClusterRole grants capabilities well beyond operational necessity - including pod exec and cluster-wide RBAC management - directly violating the principle of least privilege (CWE-250). Successful exploitation of a compromised DSPO pod would allow an attacker to assume full administrative control over the entire Kubernetes cluster; no public exploit or CISA KEV listing has been identified at time of analysis, but the CVSS scope-change flag (S:C) confirms the blast radius extends far beyond the initial compromise boundary.
Authentication bypass in TrustyAI Service (TAS) within Red Hat OpenShift AI (RHOAI) exposes the backend API to any pod on the cluster network without requiring valid credentials. The CVSS vector (AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms that an attacker with a pod on the cluster-such as through a compromised workload or a malicious tenant pod in a multi-tenant deployment-can read, modify, delete, or poison AI model monitoring data and configurations with no additional barriers. No public exploit code or CISA KEV listing has been identified at time of analysis, but the root cause (CWE-306: Missing Authentication for Critical Function) means exploitation is trivially simple once cluster network adjacency is established.
Arbitrary code execution in Red Hat OpenShift AI's trustyai-service-operator enables authenticated cluster users to bypass pod security policies via crafted sidecar container configurations in LMEvalJob resources. The CVSS 8.1 (High) score reflects network-accessible exploitation requiring only low-privilege cluster authentication, with high confidentiality and integrity impact against the affected workload context. No public exploit code has been identified and no CISA KEV listing exists at time of analysis, but the low barrier of entry (any authenticated cluster user) elevates insider-threat and compromised-account risk for RHOAI deployments.
Authentication bypass in the Models-as-a-Service (MaaS) API component of Red Hat OpenShift AI (RHOAI) lets any pod already running in the cluster impersonate arbitrary users by forging the X-MaaS-Username and X-MaaS-Group HTTP headers, which the service trusts without independent verification. Because the MaaS API performs no first-party authentication and defers entirely to a Kuadrant AuthPolicy gateway that can be circumvented, a low-privileged workload can mint Kubernetes ServiceAccount tokens in other tenants' namespaces, revoke API keys, and exfiltrate model-access configuration - a full cross-tenant privilege escalation. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV, but the 9.9 CVSS reflects near-total impact.
The MaaS (Model-as-a-Service) Gateway component in Red Hat OpenShift AI (RHOAI) is improperly configured, enabling any low-privileged authenticated user within the platform to act as a man-in-the-middle against all model-serving traffic. Affected users can intercept, read, log, and modify requests and responses traversing the gateway, exposing highly sensitive artifacts including API access keys, user input prompts, and model outputs. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog, but the CVSS 8.8 rating with high confidentiality, integrity, and availability impact reflects the severity of unrestricted traffic access within a shared AI serving environment.
Out-of-bounds write vulnerabilities in GIMP's PSD and PAA file format parsing plugins allow remote attackers to achieve code execution with the privileges of the local user by delivering a specially crafted image file. Affected deployments include GIMP packages shipped with Red Hat Enterprise Linux 6 through 9. No public exploit code has been identified at time of analysis, and CISA SSVC classifies exploitation status as none with the attack assessed as not automatable, though technical impact is rated total given the C:H/I:H/A:H CVSS profile.
Insufficient source identity validation in Red Hat Multicluster Global Hub's manager component allows a network-adjacent attacker who has compromised a managed hub to impersonate any other hub on the shared Kafka status bus. By presenting a legitimately obtained Kafka client certificate from the compromised hub while falsifying the CloudEvent source field, the attacker can overwrite or delete compliance records, inventory data, and cluster health telemetry belonging to sibling hubs in the shared database. No public exploit has been identified at time of analysis, but the scope-changed CVSS vector (S:C) reflects that the integrity impact extends beyond the initially compromised hub to the entire multi-hub management plane.
Arbitrary code execution in GIMP's PSD import plugin allows an attacker to run code in the context of the user who opens a maliciously crafted .psd file. An unsigned integer underflow in the plugin's block_rem length variable (CWE-191) corrupts parsing of Photoshop layer resource blocks, letting attacker-controlled data be treated as trusted structures. Reported by Red Hat and tracked upstream in GNOME's GIMP tracker; SSVC lists a proof-of-concept, though it is not in CISA KEV and EPSS exploitation probability is low (0.31%).
Heap overflow in GIMP's Seattle Filmworks file loader allows an attacker who tricks a user into opening a specially crafted SFW file to write several kilobytes of attacker-controlled data beyond the intended buffer, resulting in memory corruption that can lead to arbitrary code execution or denial of service. Affected platforms confirmed via CPE data are Red Hat Enterprise Linux 6 through 9 with GIMP installed. No public exploit code has been identified and this CVE is not listed in CISA's KEV catalog, but the high CVSS 7.8 score reflects the full confidentiality, integrity, and availability impact achievable once a victim is socially engineered into opening the malicious file.
Integer overflow and underflow flaws in GStreamer's gst-plugins-ugly ASF demuxer expose systems to denial of service and limited heap data disclosure when processing attacker-controlled media files. The asfdemux plugin fails to adequately validate length and size fields inside ASF/WMV/WMA header objects, allowing arithmetic overflows to bypass bounds checks and trigger out-of-bounds heap reads. Any application or user that opens an untrusted media file through a GStreamer pipeline - browsers, media players, thumbnailers - is exposed; no public exploit or CISA KEV listing has been identified at time of analysis.
Heap out-of-bounds write in GStreamer's adpcmdec element allows a crafted WAV file containing malformed multi-channel IMA/DVI ADPCM audio to corrupt application memory, cause denial of service, or potentially achieve arbitrary code execution. Affected deployments include Red Hat Enterprise Linux 7 through 10, where the vulnerable gst-plugins-bad package is distributed. No confirmed active exploitation (not in CISA KEV) and no public proof-of-concept has been identified at time of analysis, though the CVSS score of 7.6 reflects the realistic network-deliverable, user-interaction-dependent attack path.
Command injection in dracut's die() error-handling function allows an unauthenticated attacker on the adjacent network, controlling a rogue DHCP server, to execute arbitrary commands as root during initramfs boot-failure recovery. The flaw exists because error messages written into emergency hook shell scripts under the initramfs environment are not shell-quoted, and those messages can carry attacker-controlled data sourced from the DHCP ROOT_PATH option processed by the 40network module. No public exploit code or CISA KEV listing has been identified at time of analysis, but the exploitation primitive is conceptually straightforward for anyone with DHCP server control on the local network segment.
Unbounded memory growth in GStreamer's RTP H.264 and H.265 depayloader elements allows a remote unauthenticated attacker to exhaust process memory and terminate any application consuming RTP video streams. The rtph264depay and rtph265depay elements in gst-plugins-good lack an upper bound on their internal reassembly buffer, meaning an attacker who continuously sends fragmented RTP packets while withholding the end-of-fragment marker can grow that buffer without limit. No public exploit has been identified at time of analysis, and CISA KEV listing is absent, but the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates this is trivially exploitable against any exposed GStreamer RTP pipeline.
Session hijacking via SAML assertion replay in Keycloak's SAML broker component allows adjacent-network attackers to authenticate as arbitrary users without credentials. When Keycloak is deployed as a SAML broker in IdP-Initiated flow mode, it fails to enforce the SAML OneTimeUse condition, permitting a captured assertion to be submitted multiple times. No public exploit has been identified at time of analysis, and EPSS sits at 0.14% (4th percentile), though SSVC rates technical impact as total - reflecting the full account takeover consequence if the preconditions are met.
Privilege escalation in Red Hat Build of Keycloak's Dynamic Client Registration (DCR) grants an attacker with low-privilege client registration credentials full realm administrator access by exploiting a validation bypass in the 'Allowed Protocol Mapper Types' security policy. The policy correctly validates mapper types at initial registration but fails to re-validate the mapper type during a client update when the mapper's surrounding configuration is unchanged, allowing a type-swap from a permitted mapper to a restricted high-privilege mapper (such as a HardcodedRoleMapper that injects realm-admin roles into tokens). No public exploit code has been identified and no CISA KEV listing is present, but the attack is low-complexity, fully network-exploitable, and results in complete confidentiality, integrity, and availability compromise of the Keycloak realm.
Account takeover in Keycloak (Red Hat build of Keycloak, Red Hat Single Sign-On 7) arises because the IdP-initiated SAML SSO endpoint does not verify whether an upstream identity provider is restricted to account-linking-only mode. An attacker who controls a linked upstream identity can drive that endpoint to complete a full login rather than a mere link operation, seizing complete access to the corresponding local user account. Red Hat has shipped fixes; there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.19%).
Privilege escalation in Keycloak's Dynamic Client Registration (DCR) component allows attackers with standard user accounts and limited Initial Access Tokens to forge administrative roles directly into their own access tokens. The underlying flaw is a missing claim-path validation in the default DCR policy for User Property mappers, which permits writing attacker-controlled values into sensitive internal claim locations that normally carry role and privilege assertions. Successful exploitation enables takeover of other registered OAuth clients, exfiltration of confidential client secrets, and full administrative control over the affected Keycloak realm. No confirmed active exploitation or public exploit code is identified at time of analysis.
URI normalization bypass in Keycloak's Authorization Services PathMatcher allows authenticated low-privilege users to reach administrative or restricted endpoints by appending trailing slashes or matrix parameters to request URIs. Affected deployments include Red Hat Build of Keycloak, Red Hat Single Sign-On 7, Red Hat Data Grid 8, and Red Hat JBoss EAP Expansion Pack. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, though the high CVSS confidentiality and integrity impact scores reflect meaningful privilege escalation risk in production environments.
Authentication bypass in Red Hat Build of Keycloak (and Red Hat Single Sign-On 7) lets an unauthenticated attacker forge SAML responses to hijack accounts when a SAML identity-provider's metadata was imported without explicit key-usage attributes, causing the keycloak-services identity-brokering engine to silently disable signature validation despite a signing certificate being present. Rated CVSS 9.1 with total technical impact per CISA SSVC, an attacker who knows a victim's external identifier can log in as that user. No public exploit identified at time of analysis, and EPSS is low (0.14%, 4th percentile), indicating the risk is currently theoretical/targeted rather than mass-exploited.
Memory corruption in libkcapi's one-shot asynchronous I/O path allows a local process to induce kernel writes into application-owned output buffers after an error return. Affected platforms include Red Hat Enterprise Linux 8, 9, and 10, Red Hat Hardened Images, and OpenShift Container Platform 4. An unprivileged local attacker or a compromised application can exploit this use-after-free-class condition to crash the calling process (high availability impact) or corrupt buffer contents for limited confidentiality and integrity impact. No public exploit code or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in SSSD's PAM responder allows a local low-privileged attacker to crash the SSSD process and disclose sensitive memory contents by sending a crafted protocol v1 authentication request. Affected systems span all major Red Hat Enterprise Linux releases (6 through 10) and OpenShift Container Platform 4, representing a broad footprint in enterprise Linux environments. No active exploitation is confirmed (not listed in CISA KEV), and the EPSS score of 0.14% at the 3rd percentile reflects a very low observed exploitation probability at time of analysis.
Heap-buffer-overflow vulnerabilities in GIMP's APNG file loader and DDS plug-in allow code execution when a user opens a specially crafted image file. The APNG flaw is triggered when the fcTL chunk width exceeds the IHDR width, causing pixel data to overwrite memory beyond the heap allocation; the DDS flaw stems from a bits-per-pixel mismatch in load_layer(). Both affect GIMP as packaged on Red Hat Enterprise Linux 6 through 9. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Privilege escalation in Red Hat Build of Keycloak's user creation component exposes environments running Fine-Grained Admin Permissions V2 (FGAP V2) to unauthorized group assignment by scoped sub-administrators. A sub-admin holding only user-create permissions can bypass group-level authorization checks and enroll newly created users into any group - including privileged or sensitive ones - well beyond the sub-admin's delegated scope. SSVC rates technical impact as total and no public exploit has been identified, though the EPSS score of 0.24% (15th percentile) and SSVC exploitation status of 'none' indicate low immediate exploitation likelihood.
Denial of service in gnome-remote-desktop as shipped in Red Hat Enterprise Linux 8, 9, and 10 lets an unauthenticated remote attacker exhaust server resources when the daemon runs in system mode with RDP enabled. Because the incoming connection handler bypasses the connection throttler, an attacker can open large numbers of parallel pre-authentication RDP connections, accumulating accepted sockets and pending routing-token operations until timeout and blocking legitimate RDP logins. There is no public exploit identified at time of analysis, and the flaw is specific to Red Hat's build - it does not affect the upstream project.
Information disclosure in 389 Directory Server (upstream of Red Hat Directory Server 11-13, shipped across RHEL 6-10) lets an unauthenticated remote attacker inject LDAP search filters into the CleanAllRUV replication status-check extended operation. Because the handler evaluates attacker-controlled filters against cn=config using elevated replication-plugin privileges and leaks a boolean match result, attackers can blindly enumerate sensitive configuration metadata such as replication bind DNs and password storage scheme details. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the network-reachable, no-authentication attack surface makes it a meaningful reconnaissance primitive.
Remote unauthenticated denial of service in 389 Directory Server (389-ds-base, shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) allows an attacker to crash the LDAP daemon by sending a crafted replication extended operation. The flaw is a stack buffer overflow in the RUV parsing path that triggers during payload decoding before any authorization check, so no credentials are needed. No public exploit identified at time of analysis; stack protectors constrain the outcome to a server crash rather than code execution.
Deploy-time policy bypass in Red Hat Advanced Cluster Security for Kubernetes 4 lets a user with Kubernetes Deployment-create permission spoof workload identity by setting the openshift.io/encoded-deployment-config label to "null", forcing ACS to record the workload with empty UID, name and labels and a "default" namespace. This evades ACS deploy-time policy detection and enforcement visibility and corrupts Central's persistence, violation reporting and compliance correlation. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Token exchange in Keycloak bypasses Google Workspace domain allowlist restrictions, enabling any valid Google account holder - regardless of their domain - to swap a Google OAuth token for a Keycloak realm token and gain unauthorized access. Affected deployments are those specifically configured to restrict Google-based logins to approved Workspace domains while also having token exchange enabled; both conditions must be present. No public exploit code has been identified at time of analysis, and EPSS sits at 0.20% (10th percentile), consistent with SSVC's exploitation status of 'none', though SSVC rates technical impact as 'total' given that successful exploitation delivers full realm access.
Tenant-restriction bypass in Keycloak's Microsoft identity provider integration allows attackers holding any valid Microsoft OAuth token - even from a completely unrelated Azure AD organization - to authenticate into a Keycloak realm via the token exchange feature. Affected deployments include Red Hat Build of Keycloak, Red Hat Single Sign-On 7, and Red Hat JBoss EAP Expansion Pack. With CVSS PR:L reflecting the need for a valid Microsoft credential (trivially obtained by registering a free Azure tenant), successful exploitation grants high confidentiality and integrity impact within the realm. No public exploit or active exploitation has been identified at time of analysis; EPSS sits at 0.19% (9th percentile), consistent with SSVC exploitation=none.
Local privilege escalation to root via argument injection in the APT backend of yggdrasil-worker-package-manager, the Red Hat Insights remote package-management worker shipped with Red Hat Enterprise Linux 10. Because package names are passed directly to apt-get without an argument terminator, a name beginning with a hyphen is parsed as a command-line option rather than a package, letting an attacker who can influence the package list achieve root-level remote code execution. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but an upstream source fix is already merged and released in versions 0.1.4 and 0.2.4.
Confidential Active Directory attribute disclosure in Samba's Active Directory Domain Controller allows an authenticated low-privilege domain user to read protected directory attributes by abusing how LDAP Compare requests are handled. Because Samba fails to validate user-supplied attribute names (LDAP filter injection, CWE-90) and runs the resulting internal search in a trusted context, normal ACL enforcement is bypassed; in gMSA-enabled deployments this permits extraction of msKds-RootKeyData and offline derivation of Group Managed Service Account passwords, which can escalate to full domain compromise. No public exploit identified at time of analysis and the issue is not listed in CISA KEV, but a vendor patch is available.
Remote unauthenticated denial of service in Performance Co-Pilot (PCP), the system performance monitoring toolkit shipped with Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4, allows an attacker to permanently disable a PCP daemon by triggering a signed integer overflow (CWE-190) in the __pmGetPDU() PDU-length handling routine. A crafted network packet sent during normal PDU processing or SASL authentication negotiation corrupts the read logic so that the daemon can no longer read any subsequent packets, requiring a manual restart. There is no public exploit identified at time of analysis and the flaw yields no code execution or data exposure - impact is availability-only (CVSS 7.5, A:H).
Remote unauthenticated access-control bypass in the Performance Co-Pilot (PCP) pmproxy component lets attackers reach the /store endpoint and overwrite arbitrary PMDA (Performance Metrics Domain Agent) metric values, which the reporter (Red Hat) states can escalate to arbitrary code execution and full system takeover. The flaw affects PCP as shipped across Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the network-reachable, no-authentication attack surface makes exposed pmproxy instances a meaningful risk.
Local privilege escalation in Performance Co-Pilot (PCP) on Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4 arises from the linux_sockets module exposing an unsecured internal connection. An attacker who already holds low-level code execution on the host can leverage this leaked/unprotected socket to run arbitrary commands as root. No public exploit has been identified at time of analysis and the flaw is not in CISA KEV, so exploitation would require an existing foothold rather than remote unauthenticated access.
Local privilege-relevant command injection in Performance Co-Pilot's (PCP) linux_sockets PMDA lets an authenticated user inject shell metacharacters through the network.persocket.filter metric, causing arbitrary commands to run as the PMDA user each time metrics refresh. Reported by Red Hat, it affects the pcp packages shipped across Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Robot account token disclosure in Red Hat Quay 3 allows a user assigned to the GLOBAL_READONLY_SUPER_USERS role to read the tokens of robot accounts belonging to repositories they are not a member of. Because these tokens are long-lived registry credentials, the read-only superuser can escalate a view-only role into full impersonation of any robot account, gaining whatever push/pull and repository permissions that robot holds. No public exploit identified at time of analysis; not listed in CISA KEV.
Out-of-bounds write in GNU binutils' BFD library (bfd/elf32-dlx.c) lets a crafted ELF/DLX object file corrupt memory and achieve arbitrary code execution when parsed by any BFD-consuming tool (objdump, readelf, strip, ld, nm, objcopy). Reported by Red Hat and tracked against RHEL 6-10, Hardened Images and OpenShift 4, the flaw is only reachable when binutils is compiled with the DLX backend (typically --enable-targets=all), so exposure is gated by a non-default build option. There is no public exploit identified at time of analysis (not in CISA KEV), though the researcher demonstrated code execution via a File Stream Oriented Programming (FSOP) attack on glibc FILE structures.
Privilege escalation in CRIU allows a malicious container process to spoof credentials during checkpoint, resulting in elevated capabilities upon restore. On Red Hat platforms, effective exploitation is mitigated by mandatory access controls, user namespaces, and the requirement for privileged checkpoint initiation. No public exploit identified at time of analysis.
Arbitrary command execution as root via udev property injection in sg3_utils when sg_inq --export parses a SCSI device with a crafted name string. Affects multiple Red Hat Enterprise Linux versions shipping sg3_utils. Publicly available exploit code exists as a proof-of-concept in the upstream fix; no active exploitation has been reported.
Identity header smuggling in OpenShift Container Platform 4.x allows authenticated low-privilege users to escalate privileges by injecting forged identity headers that upstream applications may trust. The oauth-proxy fails to strip underscore-variant headers, enabling WSGI and PHP frameworks to normalize them into the legitimate identity, potentially overriding the true authenticated user. No known active exploitation or public exploit code has been identified.
We need to produce a JSON with the specified fields. Let's analyze the input. CVE ID: CVE-2026-17107 Description: A flaw in cluster-proxy service-proxy component used in RHACM and MCE. The service-proxy appends impersonation group headers to proxied requests without first removing caller-supplied values, and the spoke ServiceAccount holds unrestricted impersonation permissions. An authenticated hub principal can inject an Impersonate-Group header to escalate to cluster-admin on every managed cluster. CVSS: 8.5, vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H CWE: CWE-441 (Unintended Proxy or Intermediary ('Confused Deputy')). Actually CWE-441: Unintended Proxy or Intermediary ('Confused Deputy')? Wait, description: "The software fails to properly de-identify or sanitize caller-supplied data when acting as a proxy, relay, or other intermediary." That fits. EPSS: 0.23%, percentile 14% (low). KEV: not mentioned, so no active exploitation. POC: not mentioned. Tags: Kubernetes, Red Hat, Privilege Escalation, Multicluster Engine For Kubernetes. SSVC: Exploitation: none, Automatable: no, Technical Impact: total. References: access.redhat.com security page, bugzilla, vuldb, RHSA-2026:46885 (likely an errata with fix). Also CPE: cpe:2.3:a:red_hat:multicluster_engine_for_kubernetes:*:*:*:*:*:*:*:* - all versions, so no specific version range given. It mentions RHACM and MCE. So product name: Red Hat Advanced Cluster Management for Kubernetes (RHACM) and multicluster-engine (MCE). The CPE given is for MCE. Primary product: Could be "Red Hat MCE" or "Red Hat Advanced Cluster Management". We'll pick the main one as "Red Hat Advanced Cluster Management for Kubernetes" or combine? "Red Hat Advanced Cluster Management" probably. I'll pick "Red Hat Advanced Cluster Management" as product_name, since that's the parent product. But the vulnerability is in cluster-proxy service-proxy component that is part of both. I'll use "Red Hat Advanced Cluster Management for Kubernetes (R
Denial of service in OpenPrinting libcupsfilters (as shipped in Red Hat Enterprise Linux 7 through 10) allows a network-adjacent attacker to pin a CPU at 100% by broadcasting a crafted printer advertisement. The flaw lies in cfIEEE1284NormalizeMakeModel(), which enters an infinite loop (CWE-835) when parsing an IEEE-1284 device ID whose model field is empty. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; impact is limited to availability with no data compromise.
Authentication bypass in the odh-dashboard web console of Red Hat OpenShift AI (RHOAI) lets a low-privileged actor already inside the cluster impersonate any user — including cluster administrators — by supplying an arbitrary access token to a component that was incorrectly bound to a reachable network interface. Because the impersonated identity is honored against the Kubernetes API, this escalates to arbitrary code execution, privilege escalation, and information disclosure across the cluster. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score was provided, but the CVSS 8.8 (High) rating and full C/I/A impact make it a serious internal-threat priority.
Local code execution in the Visual Studio Code Ansible (Lightspeed) extension lets a malicious project run arbitrary shell commands on a developer's machine by abusing the ansible.executionEnvironment.containerOptions and volumeMounts settings, which fail to sanitize shell separators (CWE-78). Because these are workspace-scoped settings, simply opening a booby-trapped repository can auto-trigger execution during Language Server initialization, yielding code execution as the VS Code user. No public exploit has been identified at time of analysis, and the flaw is not listed in CISA KEV; CVSS is 7.8 (High).
Arbitrary command execution in ansible-core allows an attacker who controls a collection source URI to run commands on a victim's machine when that victim executes 'ansible-galaxy collection install' against the malicious git source. The flaw lives in _extract_collection_from_git() in concrete_artifact_manager.py, which builds git clone commands without a '--' end-of-options separator, letting crafted URIs be parsed as git arguments. It is an incomplete fix for CVE-2026-11332, which patched the analogous role-install path but left the collection-install path exposed; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Privilege escalation via authentication bypass in libssh affects servers that enable GSSAPIKeyExchange, where the gssapi-keyex authentication path fails to confirm that the authenticated Kerberos principal is actually authorized for the local user account being requested. An already-authenticated client holding any valid Kerberos principal in the realm can therefore log in as an arbitrary user, including potentially privileged accounts, on Red Hat Enterprise Linux 8, 9, and 10 and Red Hat Hardened Images. No public exploit is identified at time of analysis and the issue is not listed in CISA KEV, but the CVSS of 8.8 reflects a straightforward, low-complexity abuse once a valid Kerberos credential is held.
Denial of service (and potential use-after-free) in libssh occurs when the library processes SSH data packets that arrive after a channel has been closed, causing channel data callbacks to fire against already-freed memory. Any application or system linking the affected libssh - including Red Hat Enterprise Linux 8, 9, and 10 and Red Hat Hardened Images - can be crashed by a malicious SSH peer that sends channel data at the wrong point in the connection lifecycle. There is no public exploit identified at time of analysis, EPSS is low (0.26%), and CISA SSVC scores exploitation as none, indicating a real but non-urgent memory-safety fix.
Denial of service in libssh affects clients that use automatic certificate-based public key authentication, where logic errors cause the client to loop indefinitely when configured certificates are absent or are repeatedly rejected by the SSH server. Reported by Red Hat and shipped in Red Hat Enterprise Linux 8, 9, and 10 plus Red Hat Hardened Images, the flaw lets a hostile or misconfigured server hang a connecting client and consume CPU. There is no public exploit identified at time of analysis, and EPSS is low at 0.17% (7th percentile), consistent with an availability-only, client-side bug rather than a mass-exploited issue.
Integrity-protection bypass in libssh builds compiled against the OpenSSL crypto backend, caused by incorrect AES-GCM finalization checks that fail to verify the authentication tag. An in-path (man-in-the-middle) attacker positioned on an SSH session can silently alter plaintext bytes on the wire without triggering a MAC/integrity failure, defeating a core guarantee of the SSH transport layer. There is no public exploit identified at time of analysis, EPSS risk is low (0.28%, 20th percentile), and CISA SSVC rates exploitation as 'none' though 'automatable: yes'.
Denial of service in libcupsfilters and cups-filters (the OpenPrinting image-filtering stack bundled with Red Hat Enterprise Linux 7 through 10) allows an unauthenticated attacker to abort the CUPS image filter by submitting a specially crafted PNG print job. The PNG reader instantiates a libpng decoder without registering an error-recovery handler, so a malformed image triggers libpng's default fatal-error path and terminates the filter process, killing the in-flight print job. No public exploit identified at time of analysis; this is a print-job availability issue, not a code-execution or data-exposure flaw.
Arbitrary file write in pulpcore's FilesystemExport feature allows an authenticated administrator to escape the intended export directory via directory-traversal sequences embedded in a user-controlled relative_path. Because the exported file content is also attacker-supplied (an uploaded artifact), the flaw lets a privileged user plant or overwrite arbitrary files anywhere the Pulp service user can write, enabling service compromise or broader host takeover. Rated CVSS 9.0 and reported by Red Hat, it affects pulpcore as embedded in Ansible Automation Platform 2, Satellite 6, and Red Hat Update Infrastructure 4/5; there is no public exploit identified at time of analysis.
Local privilege escalation to root in the QEMU Guest Agent (qga) affects Red Hat Enterprise Linux 6 through 10, RHEL for NVIDIA 26, and OpenShift Container Platform 4, where a local unprivileged guest user abuses the guest-ssh-add-authorized-keys command handler through symlink manipulation to seize ownership of arbitrary root-owned files. Two attack variants exist - a deterministic directory-symlink bypass and a TOCTOU file-symlink race - both requiring an external management layer such as libvirt to invoke the code path. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the CVSS 7.3 rating and clean path to full root access make it a meaningful local escalation risk in multi-tenant virtualization estates.
Out-of-bounds heap write in the freedesktop xdgmime library (bundled with GLib-based MIME detection) allows a local attacker to crash or corrupt the memory of any application that guesses content types via g_content_type_guess(). The flaw lives in _xdg_mime_magic_parse_magic_line() in xdgmimemagic.c and triggers on little-endian systems when a maliciously crafted MIME magic file placed in a user-writable XDG data location is parsed, producing a 2-byte out-of-bounds write. Red Hat rates it 7.1 (Important); no public exploit is identified at time of analysis and it is not listed in CISA KEV.
Sandbox escape in PipeWire's PulseAudio compatibility layer lets a low-privileged process inside a confined environment such as Flatpak load an attacker-controlled library and execute arbitrary code on the host user's session. The flaw (CWE-427) is present in PipeWire as shipped in Red Hat Enterprise Linux 7, 8, 9 and 10 and carries a scope-changing CVSS 3.1 score of 8.8. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Denial of service in libsolv's PGP signature verification (solv_pgpvrfy) allows remote attackers to crash automated package and repository processing by supplying a crafted Ed25519 signature. The flaw is a stack-based buffer overflow (CWE-121) triggered when the EdDSA 's' MPI is copied into a fixed 64-byte stack buffer using an attacker-controlled mismatched length. It affects the libsolv dependency solver embedded in Red Hat Enterprise Linux 7/8/9/10, OpenShift, Satellite, RHUI, openSUSE/SUSE, Ubuntu and Debian; no public exploit identified at time of analysis and it is not in CISA KEV.
Access-control bypass in Keycloak (fixed in 26.5.3) lets a disabled user account still obtain valid tokens through the JWT authorization grant preview feature. When that feature is enabled, Keycloak omits the account-enabled check during JWT authorization grant processing, so a low-privileged remote attacker who can present a valid assertion token from an external identity provider can mint a JWT for an account an administrator has explicitly disabled, regaining access to protected resources. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Out-of-bounds heap write in QEMU lets a local attacker operating inside a guest virtual machine corrupt memory in the host emulator process, enabling information disclosure, data-integrity corruption, or denial of service. The flaw stems from cpu_physical_memory_map() returning a shorter buffer length than the caller assumes, so subsequent writes spill past the allocation. Rated CVSS 7.8 (CWE-787); no public exploit identified at time of analysis, but multiple distributions (Red Hat, Ubuntu, SUSE, Debian) have shipped fixes.
Denial of service in the Feast Feature Server (the Python feature-store serving component, also shipped within Red Hat OpenShift AI/RHOAI) lets remote unauthenticated attackers exhaust host resources through its `/ws/chat` WebSocket endpoint. Because the endpoint accepts unlimited concurrent connections and unbounded message traffic, opening many simultaneous sockets drains memory, CPU, and file descriptors until legitimate clients are locked out. There is no public exploit identified at time of analysis and this is not listed in CISA KEV; the upstream fix in PR #192 caps connections, message size, and message rate.
mTLS authentication bypass in the Red Hat Ansible Automation Platform (AAP) Gateway Envoy proxy allows unauthenticated remote attackers to inject spoofed events into protected Event-Driven Ansible (EDA) event streams. The non-mTLS route to EDA event streams fails to strip the client-supplied Subject HTTP header even though the source defines requestHeadersToRemove for it, so an attacker can forge a Subject value matching a legitimate client certificate's Distinguished Name and impersonate an authenticated client. No public exploit identified at time of analysis; the issue is tracked by Red Hat (CWE-290, CVSS 8.2) but is not on CISA KEV and no EPSS score was provided.
Privilege escalation in CRI-O (the OCI container runtime used by Red Hat OpenShift Container Platform 4 and many Kubernetes clusters) lets an attacker who can set container environment variables inject a newline into the HOME variable and append arbitrary lines to /etc/passwd, enabling creation of a rootful or otherwise privileged account inside the container. It is a bypass of the incomplete fix for CVE-2022-4318, whose HOME sanitization was insufficient. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Denial of service in Red Hat OpenShift GitOps (Argo CD operator) lets a tenant who controls a namespace-scoped Argo CD instance delete a ClusterRole belonging to a cluster-scoped Argo CD instance by crafting a name collision. Because the ClusterRole reconciler skips ownership validation (CWE-862), a low-privileged tenant can disrupt a higher-privileged, cluster-wide GitOps instance across the trust boundary. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the cross-tenant scope change makes it a meaningful multi-tenancy integrity concern.
Remote denial of service in libsoup, the GNOME HTTP client/server library, allows unauthenticated attackers to crash any application using libsoup's WebSocket support by sending a single malformed control frame. The parser fails to enforce RFC 6455's 125-byte limit on PING/PONG/CLOSE control frames and mishandles the oversized payload instead of cleanly closing the connection, causing an internal processing crash. Red Hat reports the flaw across RHEL 6 through 10; no public exploit has been identified at time of analysis and no EPSS score was provided.
Denial of service in libsoup's WebSocket permessage-deflate implementation lets a remote, unauthenticated attacker crash applications by sending a small, highly compressed 'decompression bomb' that expands without bound during inflation, exhausting memory and triggering an Out-of-Memory kill. All Red Hat Enterprise Linux 6 through 10 ship the affected libsoup HTTP/WebSocket library, and client connections are especially exposed because the decompressed-size guard (max_total_message_size) is disabled by default for clients. There is no public exploit identified at time of analysis and this CVE is not listed in CISA KEV.
Remote code execution in the Argo CD repo-server component (as shipped in Red Hat OpenShift GitOps and the argoproj argo-helm chart) allows an unauthenticated attacker with network access to the repo-server to run arbitrary code and, under certain conditions, poison cached manifests to push malicious Kubernetes resources into managed clusters, enabling full cluster takeover. The root cause is missing authentication (CWE-306) on a critical internal service that the default Helm chart left network-exposed. There is no public exploit identified at time of analysis, but detailed third-party technical research (Synacktiv) and press coverage exist, and the flaw was reported unpatched at disclosure.
Privilege escalation in Red Hat OpenShift's incluster-checks diagnostic tool lets any authenticated user holding the standard 'edit' RBAC role escalate to root on the underlying cluster nodes. The tool provisions privileged debug pods with host-filesystem access inside the shared default namespace, so a low-privileged tenant can simply exec into an existing pod and break out to the host. No public exploit identified at time of analysis, and no CISA KEV listing; EPSS data was not provided in the source intelligence.
Sensitive information disclosure in Red Hat OpenShift AI's vllm-orchestrator-gateway component exposes bearer tokens and full chat payloads because the production binary writes all incoming Authorization headers and complete request bodies to persistent logs. Any user holding logging privileges can read these logs to harvest live credentials and potentially PII-laden conversation content. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Server-side request forgery in the file_type content detector of guardrails-detectors (a component shipped with Red Hat OpenShift AI/RHOAI) allows a remote attacker to submit an arbitrary XML Schema Definition (XSD) that the parser resolves without restriction, coercing the server into fetching attacker-chosen URLs or reading local files. Because the CVSS vector is AV:N/PR:N/UI:N with a changed scope and high confidentiality impact (base score 9.3), an unauthenticated attacker can pivot into internal networks and harvest secrets such as cloud provider credentials. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Denial of service in GStreamer's DTLS plugin allows a remote unauthenticated attacker to crash any application that performs a DTLS handshake (notably WebRTC/webrtcbin pipelines) by presenting a TLS certificate with an oversized Subject Distinguished Name. The Subject DN is written into a fixed 2048-byte stack buffer with no bounds checking (CWE-121), and overflowing it corrupts the stack and terminates the process. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; impact is limited to availability (process crash), with no code execution or data exposure claimed.
Heap buffer overflow in GStreamer's rfbsrc (RFB/VNC source) plugin lets a malicious VNC server crash or corrupt the memory of any client that connects to it. When the server advertises a 16bpp framebuffer and sends Hextile-encoded updates, the background-fill path writes 32-bit pixels into a 16-bit buffer, producing an out-of-bounds heap write. No public exploit identified at time of analysis; the primary confirmed impact is denial of service, with potential for further memory corruption. This is a client-side flaw requiring the victim to connect to attacker-controlled infrastructure.