Red Hat
Monthly
Macro injection in rpmbuild's tarball mode allows arbitrary code execution on systems running Red Hat Enterprise Linux 6 through 10, Red Hat Hardened Images, and OpenShift Container Platform 4. When rpmbuild processes a tarball in tarball mode, specially crafted tar member names are interpreted as RPM macros, enabling an attacker who can distribute a malicious tarball to achieve full RCE in the context of the user running the build. No public exploit or active exploitation has been identified at time of analysis, but the social-engineering requirement is realistic in open-source build pipeline contexts where developers routinely fetch and build third-party source tarballs.
Use-after-free memory corruption in WebKitGTK exposes Red Hat Enterprise Linux 6 through 9 systems to potential arbitrary code execution when users process attacker-controlled web content. The flaw (CWE-416) stems from improper memory management in the web engine's content rendering pipeline, where a freed heap allocation is subsequently accessed, enabling heap corruption. No public exploit code or CISA KEV listing has been identified at time of analysis; operational urgency derives from the CVSS 8.8 score, the broad RHEL deployment footprint, and the well-understood exploitability of use-after-free conditions in browser engines.
Unauthorized ManagedCluster deletion in Red Hat Multicluster Engine (MCE) allows any tenant with standard ClusterClaim permissions to destroy clusters belonging to other tenants or the hub itself, including the hub's local-cluster. The clusterclaims-controller fails to verify ownership before acting on the spec.namespace field, meaning a low-privileged tenant can target arbitrary ManagedClusters by crafting that field and then deleting the ClusterClaim. No public exploit or CISA KEV listing exists at time of analysis, but the attack requires only standard tenant credentials and no special configuration, making it a realistic insider or compromised-tenant threat.
Credential exfiltration in RHACM's multicloud-operators-subscription component allows an authenticated tenant with HelmRelease create permissions to bypass Kubernetes namespace isolation by manipulating the `secretRef.Namespace` field, causing the HelmRelease controller to fetch Secrets from arbitrary namespaces and transmit them to an attacker-controlled Helm repository. The CVSS S:C (scope changed) metric confirms this breaks the namespace boundary that Kubernetes multi-tenancy depends on, enabling low-privileged lateral movement across namespace security domains. No public exploit or CISA KEV active exploitation listing is confirmed at time of analysis; however, the attack is mechanically straightforward for any cluster account holding the requisite RBAC permission.
Privilege escalation and cluster-wide arbitrary resource deployment affects the multicloud-operators-subscription component of Red Hat Advanced Cluster Management for Kubernetes 2. A low-privileged tenant permitted to create HelmRelease custom resources can abuse the HelmRelease controller, which renders and applies Helm chart templates using its own elevated ServiceAccount, to deploy arbitrary resources anywhere in the cluster and bypass namespace/RBAC boundaries. Rated CVSS 9.9 with a scope change; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Improper access control in Lighthouse - the cross-cluster service-discovery component of Submariner shipped with Red Hat Advanced Cluster Management for Kubernetes 2 - lets an attacker who has compromised a spoke cluster inject unauthorized EndpointSlices and ServiceImports into arbitrary namespaces on peer clusters. Because the destination namespace is taken from an attacker-controlled label/annotation on the broker object, resources can be planted into privileged namespaces such as kube-system and openshift-*, enabling privilege escalation and lateral cluster compromise. Rated CVSS 9.9 with a scope change; no public exploit identified at time of analysis.
Cross-cluster MITM attacks are enabled in Red Hat Advanced Cluster Management for Kubernetes 2.x via the lighthouse service discovery component, which fails to validate IP addresses advertised in EndpointSlice objects. An attacker controlling a compromised spoke cluster can inject arbitrary IP addresses into EndpointSlices, causing lighthouse DNS resolution across all connected clusters to redirect legitimate cross-cluster service traffic to attacker-controlled endpoints. The CVSS Scope:Changed metric confirms that impact propagates beyond the compromised spoke cluster to the hub and peer clusters, enabling unauthorized interception and manipulation of inter-cluster communications. No public exploit code or CISA KEV listing has been identified at time of analysis.
Subnet validation failure in Submariner, the cross-cluster networking component shipped with Red Hat Advanced Cluster Management for Kubernetes 2, lets a malicious spoke cluster advertise arbitrary network ranges so that peer clusters route traffic destined for those ranges through the attacker's tunnel. Exploitation requires an attacker who already controls a joined, trusted spoke in the mesh and a deployment where Submariner inter-cluster connectivity is enabled with multiple peer clusters (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N, CWE-20), making this a conditional, post-trust-boundary issue rather than a drive-by internet threat. Successful abuse yields unauthorized information disclosure and network disruption across the mesh; no public exploit code and no confirmed active exploitation were identified at time of analysis, and EPSS is a low 0.29% (21st percentile).
Confidential Containers isolation in Kata Containers can be subverted by a malicious host operator via insufficient path validation in genpolicy's CreateContainer mount and storage rule enforcement. Affected deployments include Red Hat OpenShift Container Platform 4 running Kata Containers with genpolicy enabled for Confidential Containers guest protection. An operator-level attacker can mount arbitrary container-rootfs paths over sensitive host locations or inject attacker-controlled content into the guest, breaking the core confidentiality and integrity guarantees that Confidential Containers are designed to provide. No public exploit or CISA KEV listing has been identified at time of analysis.
WildFly Elytron's password hashing and verification subsystem silently normalizes Unicode input via NFKC before hashing, collapsing fullwidth characters (e.g., U+FF21 'Ａ') to their ASCII equivalents (e.g., 'A'). This allows an unauthenticated remote attacker to authenticate against accounts whose owners believed their passwords contained unique non-ASCII characters by submitting a standard ASCII-only dictionary - the normalization makes the stored hash indistinguishable from its ASCII equivalent. Affected deployments span Red Hat JBoss EAP 7 and 8, Red Hat Build of Keycloak, Red Hat Data Grid 8, and several other Red Hat middleware products that share the Elytron security layer. No public exploit code or CISA KEV listing has been identified at time of analysis.
FreeIPA's Kerberos Ticket Granting Service fails to verify Privilege Attribute Certificate (PAC) signatures when processing cross-realm tickets from a trusted Active Directory domain, allowing any authenticated AD user to impersonate arbitrary FreeIPA principals. This grants unauthorized elevated access to FreeIPA services including the web portal, SMB server, and LDAP directory. No active exploitation is confirmed (not in CISA KEV; SSVC Exploitation: none), though SSVC rates technical impact as total and CVSS scores 8.1 - the gap reflects the non-default trust configuration prerequisite that limits real-world exposure.
Memory exhaustion in FreeIPA's `/ipa/i18n_messages` endpoint allows a remote, unauthenticated attacker to crash identity services by sending an arbitrarily large HTTP request body. All RHEL-bundled FreeIPA deployments across RHEL 6 through RHEL 10 are affected per Red Hat CPE data. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, but the attack requires no authentication and no special configuration, making every internet-exposed FreeIPA instance a plausible target.
Privilege escalation in FreeIPA allows an attacker with high LDAP write privileges to create a rogue service principal that impersonates a privileged existing one, bypassing the uniqueness constraint enforced by the 389-ds directory server. The flaw arises because 389-ds fails to recognize equivalent representations of the same Kerberos principal name (CWE-706), enabling the creation of a shadow principal that Kerberos treats as legitimate. If exploited, an attacker can acquire valid Kerberos service tickets for sensitive services, with full domain compromise as the realistic worst-case outcome. No public exploit exists and CISA KEV does not list this CVE, though SSVC rates the technical impact as total.
FreeIPA's migration endpoint on Red Hat Enterprise Linux 6 through 10 is exploitable by remote unauthenticated attackers who send oversized HTTP POST requests to `/ipa/migration/migration.py`, causing the server to buffer arbitrarily large request bodies fully into memory. This resource exhaustion (CWE-770) leads to degraded performance, memory pressure, and potential service disruption of the identity management service. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Local privilege escalation and denial of service in libvirt's NodeGetFreePages RPC handler allows an unprivileged local user to corrupt the root libvirtd daemon's heap memory through a crafted integer overflow. The CWE-190 flaw causes an undersized buffer allocation that is subsequently overwritten with real NUMA node data, enabling heap buffer overflow in a root-owned process. No public exploit code or CISA KEV listing exists at time of analysis, but the CVSS 7.8 score (AV:L/AC:L/PR:L) and full C/I/A impact make this a genuine priority on multi-tenant RHEL virtualization hosts.
The acm-operator-bundle build pipeline within Red Hat Advanced Cluster Management for Kubernetes 2 fetches and executes a remote script without any cryptographic integrity or authenticity verification (CWE-829), exposing privileged build credentials - including GitHub access tokens and container registry passwords - to attacker-controlled code. An adversary able to compromise the remote script host or intercept the fetch in transit can inject arbitrary code that runs inside the privileged build environment and poisons the resulting operator bundle, extending the blast radius to downstream Kubernetes clusters that consume it (CVSS S:C). No public exploit code has been identified and CISA has not listed this in the Known Exploited Vulnerabilities catalog, but the credential-theft and supply-chain propagation potential make this a high-priority finding for organizations actively running ACM 2.x build pipelines.
Supply chain code injection in Red Hat Multicluster Engine for Kubernetes (mce-operator-bundle) enables arbitrary code execution during the software build process. The build pipeline fetches and executes scripts from a remote repository without commit pinning or cryptographic signature verification, meaning any actor with write access to that upstream repository can inject malicious payloads that execute at build time. The consequence extends beyond the build system itself (CVSS S:C) to the distributed artifacts, potentially delivering compromised software to all downstream consumers of the operator bundle. No public exploit code exists and no CISA KEV listing is present at time of analysis.
Privilege escalation in Red Hat Advanced Cluster Management for Kubernetes 2 stems from the search-v2-operator being bound to a ClusterRole with cluster-administrator-equivalent permissions - including user impersonation, RBAC write, Certificate Signing Request approval, and ManifestWork management. An attacker who gains control of the operator's service account (a low-privileged cluster foothold) can leverage these excessive grants to take over the entire hub cluster and its managed clusters. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the CVSS 9.9 rating reflects the near-total loss of cluster control if the operator identity is abused.
Authentication and authorization bypass in the cluster-proxy-addon component of Red Hat's Multicluster Engine for Kubernetes (MCE) lets an unauthenticated attacker who can reach the user-facing proxy route manipulate URL path segments to proxy requests to arbitrary services on any managed cluster. Because the flaw is a server-side request forgery (CWE-918) with a changed CVSS scope, a request to the hub's exposed route pivots into internal services on downstream clusters that were never meant to be externally reachable, enabling information disclosure and potential further compromise. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; the CVSS base score is 9.3 (critical).
Memory exhaustion denial of service in cockpit-ws affects Red Hat Enterprise Linux 7 through 10 and Red Hat OpenShift Dev Spaces, exploitable by any remote unauthenticated attacker. The login page request handler leaks a heap allocation on every HTTP request that includes a CockpitLang cookie, with no authentication or special privilege required. Sustained request flooding with this cookie will exhaust host memory, crashing the cockpit-ws service and potentially destabilizing the underlying host; no public exploit or active exploitation has been identified at time of analysis.
Account takeover in Red Hat Build of Keycloak allows an unauthenticated attacker to abuse the reset-credentials flow in the keycloak-services component to complete a password reset for any user without ever clicking the emailed verification link, letting them directly set new credentials. Because the mandatory email-ownership check can be bypassed, the flaw yields full control of arbitrary accounts (CVSS 9.1). No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Excessive ClusterRole permissions on the managed-serviceaccount addon-manager pod in Red Hat Advanced Cluster Management for Kubernetes 2 allow a compromised addon-manager to read secrets across every namespace and approve arbitrary Certificate Signing Requests, resulting in cluster-wide information disclosure and privilege escalation. The CVSS scope-change (S:C) reflects that a single compromised pod can affect the entire Kubernetes cluster, not just the addon namespace. No public exploit code or active exploitation via CISA KEV has been confirmed at time of analysis.
Credential exfiltration via SSRF in AWX's GitHub webhook status callback affects Red Hat Ansible Automation Platform 2: an attacker holding admin role on a webhook-enabled job template can forge a signed GitHub pull request webhook with an arbitrary statuses_url, causing AWX to POST authenticated status updates - including the configured Git Personal Access Token in the Authorization header - to an attacker-controlled or internal endpoint. The Changed scope (S:C) in the CVSS 7.7 vector reflects that the leaked PAT extends attacker reach beyond AWX to connected Git repositories and any internal services reachable via SSRF. No public exploit identified at time of analysis, and no CISA KEV listing exists.
Server-side request forgery in the Red Hat Ansible Automation Platform 2 Controller's HashiCorp Vault credential plugin lets an authenticated user with credential-creation rights force the controller pod to leak its own Kubernetes service account token. When a HashiCorp Vault Secret Lookup credential configured for kubernetes_role authentication is tested, the kubernetes_auth() routine in awx_plugins/credentials/hashivault.py transmits the pod token to an attacker-supplied URL. With that token the attacker gains Kubernetes API access to control-plane namespaces, enabling full pod CRUD and secret reads including database credentials and the Django SECRET_KEY. No public exploit identified at time of analysis, and the flaw is not on the CISA KEV list.
Privilege escalation in Red Hat Multicluster Engine for Kubernetes (MCE) lets a privileged service account on a managed spoke cluster submit a forged Certificate Signing Request that the managedcluster-import-controller auto-approves, yielding administrative credentials on the central hub cluster. The controller's auto-approval path neither inspects the CSR signer name nor decodes the PEM-encoded x509 request, so an attacker who already controls a spoke can pivot to full control of the hub and, by extension, every cluster it manages. No public exploit identified at time of analysis; EPSS is low (0.22%, 12th percentile) and CISA SSVC records no observed exploitation.
Command and SQL injection in Red Hat Advanced Cluster Management for Kubernetes 2 (acm-search-v2-rhel9) lets a privileged tenant escalate to arbitrary code execution inside the cluster's PostgreSQL pod. An authenticated hub administrator or Search Custom Resource editor can supply an unsanitized WORK_MEM value that is passed into both a bash script and an SQL query, breaking out of the intended data plane. No public exploit is identified at time of analysis and the flaw is not on CISA KEV, but the CVSS 9.1 rating reflects full confidentiality, integrity, and availability loss with a scope change.
Privilege escalation in Red Hat Advanced Cluster Management for Kubernetes 2 allows any attacker with local pod execution under the `search-serviceaccount` service account to impersonate `system:masters` and gain full cluster-admin control. The `search-serviceaccount` RBAC bindings grant cluster-wide `impersonate` permissions on users and groups - a grossly over-privileged configuration that collapses the entire cluster's security boundary if any pod running under this account is compromised. No public exploit has been identified at time of analysis and this CVE is not in CISA KEV, but the CVSS scope change (S:C) and full CIA triad impact (C:H/I:H/A:H) accurately reflect the catastrophic blast radius of successful exploitation.
Privilege escalation in Red Hat Advanced Cluster Management's multicloud-operators-subscription controller lets a low-privileged user on a managed cluster create a Subscription with crafted annotations that the controller processes with its own elevated Service Account, deploying attacker-chosen resources into arbitrary namespaces. The flaw (CWE-863, CVSS 9.9, scope-changed) affects Red Hat ACM 2.x and Multicluster Global Hub as reported by Red Hat. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Server-Side Request Forgery in Red Hat Quay's build API allows an authenticated user with repository write access to pivot into internal network segments via the Quay builder service. Exploitation requires FEATURE_BUILD_SUPPORT to be enabled and the attacker to hold at least write-level repository permissions. The CVSS vector (PR:L, C:H) reflects a meaningful but bounded threat: internal network reconnaissance and sensitive data disclosure are achievable, though no public exploit exists and EPSS sits at 0.13% (3rd percentile), indicating no observed widespread exploitation at time of analysis.
Red Hat Quay 3's exported action logs download endpoint fails to enforce authorization, permitting any network-accessible party who holds a valid file ID to retrieve full audit log exports without authenticating. The file IDs, while complex and not publicly guessable, are transmitted in plaintext via email notifications and webhook callbacks - creating a realistic interception pathway for adversaries with network positioning. No active exploitation or public POC has been identified; EPSS at 0.31% (23rd percentile) reflects low automated exploitation probability, though targeted disclosure remains credible wherever log export notifications traverse unencrypted channels.
Red Hat Quay's Stripe billing webhook handler at /webhooks/stripe processes inbound JSON payloads without verifying the Stripe-Signature HMAC header, enabling any network-reachable unauthenticated attacker to forge billing events. Successful exploitation resets the targeted namespace's build quota to its configured maximum and dispatches unsolicited billing notification emails to namespace administrators. No public exploit has been identified and EPSS is 0.14% (4th percentile), but the zero-prerequisite attack path makes exploitation trivially scriptable by any attacker with HTTP access to the endpoint.
Red Hat Quay 3 and Red Hat OpenShift Update Service expose an unauthenticated security scanner notification endpoint when the SECURITY_SCANNER_V4_PSK (pre-shared key) is absent, enabling remote unauthenticated attackers to flood the notification queue and inject path traversal characters into outbound Clair API URL paths. The primary impact is worker resource exhaustion leading to denial of service, with a secondary low-integrity impact from blind path manipulation against the configured Clair vulnerability scanner host. No public exploit identified at time of analysis, and EPSS of 0.26% (17th percentile) indicates low current exploitation probability.
Unauthorized cross-tenant cluster takeover in Red Hat Multicluster Engine (MCE) for Kubernetes allows an authenticated tenant to force a managed cluster into another tenant's ManagedClusterSet by manipulating ClusterClaim labels. The clusterclaims-controller processes these label changes without enforcing tenant ownership boundaries, enabling the attacker to then inject policies and workloads into clusters they do not own. No public exploit code or CISA KEV listing has been identified at time of analysis, but the scope-changing nature (S:C) and high confidentiality impact make this a serious multi-tenancy isolation failure.
Memory exhaustion in Red Hat Advanced Cluster Management for Kubernetes 2's search-v2-api component allows unauthenticated remote attackers to crash the search-api pod by submitting HTTP requests with unique random bearer tokens. Each unique token creates a permanent, uncleaned entry in the unbounded tokenReviews cache; sustained submission accumulates entries until the pod exhausts available memory and is killed. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivial, unauthenticated exploitability with no prerequisites. No public exploit has been identified and the vulnerability is not listed in the CISA KEV catalog, though the low attack complexity makes automated exploitation straightforward.
Cross-cluster remote code execution in Red Hat Advanced Cluster Management for Kubernetes 2 (acm-search-v2-rhel9 search collector) allows a hub-cluster administrator holding patch access to the Search Custom Resource to abuse the unvalidated Collector.ImageOverride field to push an attacker-chosen container image to every managed cluster in the fleet. Because the override is trusted and propagated hub-to-spoke, a single malicious CR edit yields command execution across all connected clusters, with the CVSS scope-change flag reflecting the jump from the hub trust boundary into separate managed-cluster security authorities. No public exploit identified at time of analysis, and this CVE is not listed in CISA KEV.
Container image injection in Red Hat Advanced Cluster Management for Kubernetes 2 (RHACM 2) allows a low-privileged authenticated user with specific administrative permissions on a managed cluster to exploit the search-v2-operator component's improper configuration handling, overriding container image settings and deploying arbitrary images across the managed cluster. The CVSS 8.5 score reflects a scope-changed impact (S:C) where the breach crosses from the search operator into the broader managed cluster workload environment, enabling a supply chain-style compromise of running containers. No public exploit code or CISA KEV listing has been identified at time of analysis, limiting near-term opportunistic risk, though the insider or compromised-privileged-account threat model remains credible given the PR:L access requirement.
Unauthenticated remote crash of rsyslogd is possible through a flaw in the optional imptcp input module, where a crafted input sequence during oversize-frame recovery produces an invalid internal message length and terminates the logging daemon. Systems running Red Hat Enterprise Linux 6 through 10 are affected only when imptcp is explicitly loaded with a non-default frame delimiting mode; the default imptcp framing and the separate imtcp module are explicitly confirmed unaffected. No public exploit code and no CISA KEV listing have been identified at time of analysis; CVSS scores this at 7.5 High solely on the basis of network-accessible, unauthenticated availability impact.
Symlink following in KubeVirt's virt-handler migration proxy enables a low-privileged Kubernetes user holding namespace edit and pods/exec permissions to achieve full node compromise by redirecting a migration Unix socket to the host CRI-O container runtime socket. Because virt-handler runs as root within the host mount namespace and resolves socket paths through /proc/<pid>/root/ using net.Dial() without symlink validation, an attacker-controlled symlink placed in a qemu-writable directory causes virt-handler to transparently proxy arbitrary bytes into the container runtime, yielding complete control over the underlying Kubernetes node. No public exploit has been identified at time of analysis, but the scope change from container to host and the full CIA triad impact make this a critical remediation priority for all OpenShift Virtualization 4 deployments.
Privilege escalation in Red Hat Advanced Cluster Management for Kubernetes 2 lets a namespace-scoped tenant abuse the multicloud-operators-subscription controller as a confused deputy: by crafting Subscription Custom Resources, a namespace-admin causes the controller's highly privileged ServiceAccount to deploy attacker-chosen cluster-scoped resources. This breaks tenant isolation and can yield cluster-wide privilege escalation and arbitrary code execution. Rated CVSS 9.9 (scope-changing), with no public exploit identified at time of analysis and no active exploitation reported (not in CISA KEV).
Privilege escalation and arbitrary code execution in Red Hat's multicluster engine (MCE) for Kubernetes lets a low-privileged tenant holding create or update rights on ClusterCurator resources hijack the cluster-curator-controller's service account. Because the CreateJob() function unmarshals the attacker-supplied spec.install.overrideJob raw extension without validation, the injected Job runs with the controller's elevated permissions, enabling cluster-wide secret access and full compromise. Rated CVSS 9.9 by Red Hat; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Privilege escalation in Red Hat's multicluster engine for Kubernetes (MCE) lets a namespace-scoped authenticated user gain cluster-wide control by abusing the cluster-curator-controller. By creating a ClusterCurator custom resource with a specific, attacker-chosen naming convention, the user tricks the controller into minting a cluster-scoped ClusterRoleBinding on their behalf, breaking the namespace isolation boundary. There is no public exploit identified at time of analysis, but the CVSS 9.9 rating reflects that a low-privileged tenant can obtain secrets access, manage cluster actions, and destroy hosted clusters or node pools.
Unauthorized cross-tenant Secret and ConfigMap access in the multicloud-operators-channel component of Red Hat Advanced Cluster Management for Kubernetes 2 allows a compromised managed-cluster agent to read all Secrets and ConfigMaps within any Channel namespace on the hub cluster. The Changed scope (S:C) in the CVSS vector confirms that exploitation pivots from a managed cluster context into the hub, exposing Git and Helm repository credentials belonging to other tenants. No public exploit has been identified at time of analysis, but the network-reachable, low-privilege vector makes this a high-priority finding in any multi-tenant RHACM deployment.
Secret exfiltration across Kubernetes namespace boundaries in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management for Kubernetes 2 allows an authenticated namespace administrator to read Kubernetes Secrets from arbitrary namespaces outside their own authorization domain. By setting Channel.Spec.SecretRef.Namespace to a target namespace, the attacker causes the subscription controller to autonomously copy sensitive Secret contents into a namespace the attacker controls, violating the Kubernetes namespace isolation model. No public exploit code has been identified at time of analysis, but the scope-changed CVSS vector (S:C, C:H) and the sensitivity of Kubernetes Secret payloads - which frequently contain credentials, API tokens, and TLS private keys - make this a high-priority finding in any multi-tenant RHACM deployment.
Cross-tenant bearer-token disclosure in Red Hat Advanced Cluster Management for Kubernetes 2 (RHACM) lets an authenticated tenant abuse the GitOpsCluster controller in the multicloud-integrations component to redirect spoke-cluster credentials into a namespace they control. Because the controller acts on the tenant's behalf across trust boundaries (a confused-deputy flaw), a low-privileged user can obtain tokens that grant access to managed spoke clusters and bypass ArgoCD AppProject scoping controls. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the CVSS base score is 9.6 (Critical).
Cross-cluster remote code execution in Red Hat Advanced Cluster Management for Kubernetes 2 (multicloud-integrations / ArgoCD pull-model integration) lets a low-privileged hub tenant who can create Application CRs redirect propagation to arbitrary managed spoke clusters. Because the Application propagation controller trusts the attacker-supplied `ocm-managed-cluster` annotation without validation, an attacker forces ArgoCD on targeted spokes to sync attacker-controlled manifests, yielding code execution or privilege escalation there. CVSS 9.9 with scope change; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Incorrect authorization in FreeIPA's trust-fetch-domains command allows any authenticated, non-privileged IPA user to trigger a privileged Active Directory trust refresh using an attacker-supplied server and credentials, writing attacker-controlled trusted-domain and ID-range data into the FreeIPA LDAP directory. The flaw (CWE-863) stems from the command being gated by a read-only trust object permission rather than the required trust-administration permission, effectively bypassing the authorization boundary between read and write operations on cross-realm identity data. No public exploit has been identified and CISA has not listed this in KEV, but the scope-changed CVSS score of 8.2 and high integrity impact reflect serious potential for identity infrastructure tampering in environments running AD trusts.
Code injection in the Perl DBI module as packaged for Red Hat Enterprise Linux allows a network-accessible, low-privileged attacker to execute arbitrary code, resulting in full confidentiality, integrity, and availability compromise. This CVE is a remediation of an incomplete fix for CVE-2026-14380, specifically targeting RHEL 9.8.z and 10.2.z patch levels where the prior partial fix left an exploitable residual path. No public exploit or CISA KEV listing is identified at time of analysis, but the CWE-94 classification and RCE tag indicate high potential impact if exploitation conditions are met.
Server-Side Request Forgery in Red Hat OpenShift Container Platform 4's Dev Console webhook helpers allows authenticated users to coerce the console pod into issuing arbitrary outbound HTTP requests on their behalf. Because the console pod operates from a privileged network position within the cluster, this enables lateral movement to internal services - including the Kubernetes API server, metadata endpoints, and internal microservices - that would otherwise be unreachable from outside the cluster. No public exploit or CISA KEV listing has been identified at time of analysis, but the Scope:Changed CVSS metric reflects the cross-boundary nature of the impact.
Server-Side Request Forgery in the OpenShift Console Helm catalog proxy allows low-privileged namespace tenants to plant a malicious ProjectHelmChartRepository resource pointing to an attacker-controlled URL, causing the console pod to issue server-side fetches that bypass tenant egress restrictions. Combined with Helm catalog metadata poisoning and subsequent admin-mediated chart installation, this multi-stage attack chain enables privilege escalation within the cluster. No CISA KEV listing or public exploit code has been identified at time of analysis, though the CVSS Scope:Changed rating correctly reflects that the console pod's cross-boundary requests extend impact beyond the originating namespace.
Privilege escalation in the `openvt -u` utility allows a local low-privileged attacker to obtain passwordless root login on Red Hat Enterprise Linux 6 through 10, Red Hat Hardened Images, and Red Hat OpenShift Container Platform 4. The flaw lies in `authenticate_user()`, which resolves VT ownership via `stat("/proc/<pid>/fd/0")` - a call that follows the symlink to the underlying TTY device node rather than inspecting the owning process, causing the check to read the device node's UID rather than the process owner's UID. When a privileged user logs out and TTY device node ownership reverts to root or the getty owner while an attacker's process still holds fd 0 on that TTY, the check incorrectly authorizes a passwordless `login -f root` execution. No public exploit is identified at time of analysis and there is no CISA KEV listing, but the root-level impact makes this a high priority for environments using the affected `kbrequest`/init deployment pattern.
Privilege escalation in MRTG (Multi Router Traffic Grapher) allows a local low-privileged attacker to gain elevated file ownership on the host system. When the MRTG daemon is launched as root and then drops privileges, a CWE-59 symlink-following flaw in PID file handling lets an attacker pre-place or manipulate a symlink at the expected PID file path, causing the root process to change ownership of an arbitrary existing file to the daemon user. Affected platforms include Red Hat Enterprise Linux 6 through 10; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in Red Hat OpenShift AI's Data Science Pipelines component allows authenticated tenants to bypass authorization controls in the setDefaultServiceAccount function by submitting a crafted CreateRun request that references a more privileged ServiceAccount than they are entitled to use. Successful exploitation enables the tenant's pipeline containers to run with elevated Kubernetes RBAC permissions, resulting in cross-namespace secret disclosure and the ability to execute commands inside other tenants' pods. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Denial of service in ml-metadata (MLMD), a core metadata tracking component of Red Hat OpenShift AI (RHOAI), stems from an outdated statically-linked gRPC stack that retains known HTTP/2 resource exhaustion weaknesses. An in-cluster adversary with network reachability to the MLMD pod can crash it by sending specially crafted HTTP/2 requests, halting all ML pipeline runs within the affected namespace. No public exploit has been identified at time of analysis, and exploitation is constrained to actors already operating inside the Kubernetes cluster.
Credential derivation in Red Hat OpenShift AI's Data Science Pipelines Operator allows unauthenticated remote attackers to predict MariaDB root/user passwords and MinIO access/secret keys by exploiting a cryptographically weak PRNG (CWE-338). Any attacker who can reach the MinIO Route or MariaDB Service over the network can compute valid credentials without prior authentication, then access all pipeline artifacts and metadata stored in the system. No active exploitation is confirmed and no public exploit code has been identified at time of analysis, but the CVSS 7.5 High rating with AV:N and PR:N reflects a no-authentication-barrier condition against exposed services.
Privilege escalation in libvirt's `virFileChownFiles()` function allows a process confined to the `swtpm` system user to coerce the root-level libvirtd daemon into reassigning ownership of any arbitrary file on the host to the `swtpm` user. The attack exploits a symlink-following flaw (CWE-59) in directory traversal logic that runs with root privileges, affecting libvirt as packaged across Red Hat Enterprise Linux 6 through 10 and RHEL for Nvidia 26. No public exploit has been identified at time of analysis, but the attack complexity is low once `swtpm`-user execution is obtained.
Privilege escalation in Red Hat OpenShift AI's training-operator enables any user holding a standard Kubernetes edit or admin role in any cluster namespace to break out of namespace isolation, impersonate service accounts, access the host filesystem, and achieve remote code execution. The root cause is a design flaw: the operator aggregates training job permissions onto native Kubernetes built-in ClusterRoles, and allows unrestricted PodTemplateSpec passthrough - meaning users can submit training jobs containing arbitrary pod configurations such as hostPath mounts or elevated service account tokens. No public exploit code or CISA KEV listing was identified at time of analysis, but the low access complexity and the broad availability of edit/admin roles in typical ML platform deployments make this an urgent remediation priority.
Privilege escalation in Red Hat OpenShift AI (RHOAI) training operator overlay allows any namespace editor to manage TrainJob resources beyond their intended authorization scope. The RHOAI overlay incorrectly injects trainjobs CRUD permissions into the native Kubernetes edit ClusterRole, violating the principle of least privilege. When chained with a companion flaw (TRN-01) that permits arbitrary pod configuration within TrainJobs, a remote attacker holding namespace editor credentials could escalate to arbitrary code execution - no public exploit is identified at time of analysis, and KEV listing has not been confirmed.
Privilege escalation in odh-dashboard, the web interface for Red Hat OpenShift AI (RHOAI), allows any authenticated dashboard user to gain cluster-admin or other highly privileged roles by manipulating the roleRef field when creating RoleBindings. The system performs no server-side validation on the roleRef value supplied through the dashboard, enabling an attacker holding only a standard user account to bind themselves to arbitrary Kubernetes ClusterRoles. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, but the CVSS 8.8 score and the direct, low-complexity path to cluster-admin access make this a high-priority remediation target for any RHOAI deployment.
Privilege escalation in odh-dashboard (Red Hat OpenShift AI) allows an attacker who has obtained the dashboard's Service Account token to abuse overly broad SA permissions and elevate to cluster-administrator level. Exploitation grants full access to secrets, credentials, and keys across the entire OpenShift cluster, while also breaking multi-tenant isolation between workloads. No public exploit code has been identified at time of analysis, and this CVE is not in CISA KEV, but the CVSS score of 8.8 and cluster-wide blast radius make it a high-priority remediation target for RHOAI deployments.
Unauthenticated remote code execution affects Feast (the open-source ML feature store), where user-defined functions stored in the registry are serialized with Python's 'dill' library and deserialized without validation. In default configurations a remote attacker can store a malicious UDF and achieve unauthenticated code execution on the feature server; an authenticated attacker can bypass authorization during deserialization to run code on the registry server, enabling cross-tenant data access and lateral movement. Rated CVSS 9.9 with a scope change; no public exploit has been identified at time of analysis, and it is not listed in CISA KEV. Feast is bundled in Red Hat OpenShift AI (RHOAI), which is the reporting vendor's affected product.
Authorization bypass in Feast's materialization API endpoints within Red Hat OpenShift AI (RHOAI) permits full re-materialization of all feature views by sending a crafted request that omits the feature_views field, circumventing permission checks. The consequence is a multi-tenant Denial of Service through data corruption and significant resource exhaustion, impacting all tenants sharing the deployment. No public exploit code has been identified at time of analysis, but the bypass mechanism is straightforward - a structural omission in the request body - making independent rediscovery likely for any attacker with API access.
Feast and feast-operator ship with a default 'no_auth' security configuration, leaving the feature-server, registry-server, and offline-server endpoints completely unauthenticated and accessible to any network-reachable attacker in Red Hat OpenShift AI (RHOAI) deployments. Exploitation enables three distinct high-impact outcomes: remote code execution via injection of a malicious User-Defined Function (UDF) onto the feature-server, denial of service by forcing full re-materialization of all tenant features, and unauthorized read access to cross-tenant feature data. No public exploit code has been identified at time of analysis and CISA KEV status is not confirmed, but the trivial exploitation conditions - no authentication, no interaction, default configuration - make this a realistic priority for any RHOAI operator.
Privilege escalation in Red Hat Data Science Pipelines (DSP) allows an authenticated namespace editor to gain node-root access by submitting a crafted Argo Workflow via the V1 API path. The API server, acting as a confused deputy (CWE-266), creates pods with elevated privileges on the attacker's behalf, effectively breaking out of Kubernetes namespace isolation. Successful exploitation enables arbitrary code execution and full control over the underlying cluster node; no public exploit has been identified at time of analysis, and this is not listed in CISA KEV.
MySQL DSN parameter injection in Red Hat OpenShift AI's Data Science Pipelines Operator (DSPO) allows a namespace editor to enable the MySQL LOCAL INFILE feature via the unvalidated spec.database.customExtraParams field, enabling exfiltration of sensitive files - including Kubernetes service account tokens - from the operator pod. An attacker who exploits this can leverage the stolen token to impersonate the operator's service account and escalate privileges to cluster-admin level within the OpenShift cluster. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Overprivileged ClusterRole assignments in Red Hat OpenShift AI's Data Science Pipelines Operator (DSPO) create a cluster-wide privilege escalation path if the operator pod is compromised. The DSPO ClusterRole grants capabilities well beyond operational necessity - including pod exec and cluster-wide RBAC management - directly violating the principle of least privilege (CWE-250). Successful exploitation of a compromised DSPO pod would allow an attacker to assume full administrative control over the entire Kubernetes cluster; no public exploit or CISA KEV listing has been identified at time of analysis, but the CVSS scope-change flag (S:C) confirms the blast radius extends far beyond the initial compromise boundary.
Authentication bypass in TrustyAI Service (TAS) within Red Hat OpenShift AI (RHOAI) exposes the backend API to any pod on the cluster network without requiring valid credentials. The CVSS vector (AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms that an attacker with a pod on the cluster-such as through a compromised workload or a malicious tenant pod in a multi-tenant deployment-can read, modify, delete, or poison AI model monitoring data and configurations with no additional barriers. No public exploit code or CISA KEV listing has been identified at time of analysis, but the root cause (CWE-306: Missing Authentication for Critical Function) means exploitation is trivially simple once cluster network adjacency is established.
Arbitrary code execution in Red Hat OpenShift AI's trustyai-service-operator enables authenticated cluster users to bypass pod security policies via crafted sidecar container configurations in LMEvalJob resources. The CVSS 8.1 (High) score reflects network-accessible exploitation requiring only low-privilege cluster authentication, with high confidentiality and integrity impact against the affected workload context. No public exploit code has been identified and no CISA KEV listing exists at time of analysis, but the low barrier of entry (any authenticated cluster user) elevates insider-threat and compromised-account risk for RHOAI deployments.
Authentication bypass in the Models-as-a-Service (MaaS) API component of Red Hat OpenShift AI (RHOAI) lets any pod already running in the cluster impersonate arbitrary users by forging the X-MaaS-Username and X-MaaS-Group HTTP headers, which the service trusts without independent verification. Because the MaaS API performs no first-party authentication and defers entirely to a Kuadrant AuthPolicy gateway that can be circumvented, a low-privileged workload can mint Kubernetes ServiceAccount tokens in other tenants' namespaces, revoke API keys, and exfiltrate model-access configuration - a full cross-tenant privilege escalation. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV, but the 9.9 CVSS reflects near-total impact.
The MaaS (Model-as-a-Service) Gateway component in Red Hat OpenShift AI (RHOAI) is improperly configured, enabling any low-privileged authenticated user within the platform to act as a man-in-the-middle against all model-serving traffic. Affected users can intercept, read, log, and modify requests and responses traversing the gateway, exposing highly sensitive artifacts including API access keys, user input prompts, and model outputs. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog, but the CVSS 8.8 rating with high confidentiality, integrity, and availability impact reflects the severity of unrestricted traffic access within a shared AI serving environment.
Out-of-bounds write vulnerabilities in GIMP's PSD and PAA file format parsing plugins allow remote attackers to achieve code execution with the privileges of the local user by delivering a specially crafted image file. Affected deployments include GIMP packages shipped with Red Hat Enterprise Linux 6 through 9. No public exploit code has been identified at time of analysis, and CISA SSVC classifies exploitation status as none with the attack assessed as not automatable, though technical impact is rated total given the C:H/I:H/A:H CVSS profile.
Insufficient source identity validation in Red Hat Multicluster Global Hub's manager component allows a network-adjacent attacker who has compromised a managed hub to impersonate any other hub on the shared Kafka status bus. By presenting a legitimately obtained Kafka client certificate from the compromised hub while falsifying the CloudEvent source field, the attacker can overwrite or delete compliance records, inventory data, and cluster health telemetry belonging to sibling hubs in the shared database. No public exploit has been identified at time of analysis, but the scope-changed CVSS vector (S:C) reflects that the integrity impact extends beyond the initially compromised hub to the entire multi-hub management plane.
Arbitrary code execution in GIMP's PSD import plugin allows an attacker to run code in the context of the user who opens a maliciously crafted .psd file. An unsigned integer underflow in the plugin's block_rem length variable (CWE-191) corrupts parsing of Photoshop layer resource blocks, letting attacker-controlled data be treated as trusted structures. Reported by Red Hat and tracked upstream in GNOME's GIMP tracker; SSVC lists a proof-of-concept, though it is not in CISA KEV and EPSS exploitation probability is low (0.31%).
Heap overflow in GIMP's Seattle Filmworks file loader allows an attacker who tricks a user into opening a specially crafted SFW file to write several kilobytes of attacker-controlled data beyond the intended buffer, resulting in memory corruption that can lead to arbitrary code execution or denial of service. Affected platforms confirmed via CPE data are Red Hat Enterprise Linux 6 through 9 with GIMP installed. No public exploit code has been identified and this CVE is not listed in CISA's KEV catalog, but the high CVSS 7.8 score reflects the full confidentiality, integrity, and availability impact achievable once a victim is socially engineered into opening the malicious file.
Integer overflow and underflow flaws in GStreamer's gst-plugins-ugly ASF demuxer expose systems to denial of service and limited heap data disclosure when processing attacker-controlled media files. The asfdemux plugin fails to adequately validate length and size fields inside ASF/WMV/WMA header objects, allowing arithmetic overflows to bypass bounds checks and trigger out-of-bounds heap reads. Any application or user that opens an untrusted media file through a GStreamer pipeline - browsers, media players, thumbnailers - is exposed; no public exploit or CISA KEV listing has been identified at time of analysis.
Heap out-of-bounds write in GStreamer's adpcmdec element allows a crafted WAV file containing malformed multi-channel IMA/DVI ADPCM audio to corrupt application memory, cause denial of service, or potentially achieve arbitrary code execution. Affected deployments include Red Hat Enterprise Linux 7 through 10, where the vulnerable gst-plugins-bad package is distributed. No confirmed active exploitation (not in CISA KEV) and no public proof-of-concept has been identified at time of analysis, though the CVSS score of 7.6 reflects the realistic network-deliverable, user-interaction-dependent attack path.
Command injection in dracut's die() error-handling function allows an unauthenticated attacker on the adjacent network, controlling a rogue DHCP server, to execute arbitrary commands as root during initramfs boot-failure recovery. The flaw exists because error messages written into emergency hook shell scripts under the initramfs environment are not shell-quoted, and those messages can carry attacker-controlled data sourced from the DHCP ROOT_PATH option processed by the 40network module. No public exploit code or CISA KEV listing has been identified at time of analysis, but the exploitation primitive is conceptually straightforward for anyone with DHCP server control on the local network segment.
Unbounded memory growth in GStreamer's RTP H.264 and H.265 depayloader elements allows a remote unauthenticated attacker to exhaust process memory and terminate any application consuming RTP video streams. The rtph264depay and rtph265depay elements in gst-plugins-good lack an upper bound on their internal reassembly buffer, meaning an attacker who continuously sends fragmented RTP packets while withholding the end-of-fragment marker can grow that buffer without limit. No public exploit has been identified at time of analysis, and CISA KEV listing is absent, but the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates this is trivially exploitable against any exposed GStreamer RTP pipeline.
Session hijacking via SAML assertion replay in Keycloak's SAML broker component allows adjacent-network attackers to authenticate as arbitrary users without credentials. When Keycloak is deployed as a SAML broker in IdP-Initiated flow mode, it fails to enforce the SAML OneTimeUse condition, permitting a captured assertion to be submitted multiple times. No public exploit has been identified at time of analysis, and EPSS sits at 0.14% (4th percentile), though SSVC rates technical impact as total - reflecting the full account takeover consequence if the preconditions are met.
Privilege escalation in Red Hat Build of Keycloak's Dynamic Client Registration (DCR) grants an attacker with low-privilege client registration credentials full realm administrator access by exploiting a validation bypass in the 'Allowed Protocol Mapper Types' security policy. The policy correctly validates mapper types at initial registration but fails to re-validate the mapper type during a client update when the mapper's surrounding configuration is unchanged, allowing a type-swap from a permitted mapper to a restricted high-privilege mapper (such as a HardcodedRoleMapper that injects realm-admin roles into tokens). No public exploit code has been identified and no CISA KEV listing is present, but the attack is low-complexity, fully network-exploitable, and results in complete confidentiality, integrity, and availability compromise of the Keycloak realm.
Account takeover in Keycloak (Red Hat build of Keycloak, Red Hat Single Sign-On 7) arises because the IdP-initiated SAML SSO endpoint does not verify whether an upstream identity provider is restricted to account-linking-only mode. An attacker who controls a linked upstream identity can drive that endpoint to complete a full login rather than a mere link operation, seizing complete access to the corresponding local user account. Red Hat has shipped fixes; there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.19%).
Privilege escalation in Keycloak's Dynamic Client Registration (DCR) component allows attackers with standard user accounts and limited Initial Access Tokens to forge administrative roles directly into their own access tokens. The underlying flaw is a missing claim-path validation in the default DCR policy for User Property mappers, which permits writing attacker-controlled values into sensitive internal claim locations that normally carry role and privilege assertions. Successful exploitation enables takeover of other registered OAuth clients, exfiltration of confidential client secrets, and full administrative control over the affected Keycloak realm. No confirmed active exploitation or public exploit code is identified at time of analysis.
URI normalization bypass in Keycloak's Authorization Services PathMatcher allows authenticated low-privilege users to reach administrative or restricted endpoints by appending trailing slashes or matrix parameters to request URIs. Affected deployments include Red Hat Build of Keycloak, Red Hat Single Sign-On 7, Red Hat Data Grid 8, and Red Hat JBoss EAP Expansion Pack. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, though the high CVSS confidentiality and integrity impact scores reflect meaningful privilege escalation risk in production environments.
Authentication bypass in Red Hat Build of Keycloak (and Red Hat Single Sign-On 7) lets an unauthenticated attacker forge SAML responses to hijack accounts when a SAML identity-provider's metadata was imported without explicit key-usage attributes, causing the keycloak-services identity-brokering engine to silently disable signature validation despite a signing certificate being present. Rated CVSS 9.1 with total technical impact per CISA SSVC, an attacker who knows a victim's external identifier can log in as that user. No public exploit identified at time of analysis, and EPSS is low (0.14%, 4th percentile), indicating the risk is currently theoretical/targeted rather than mass-exploited.
Memory corruption in libkcapi's one-shot asynchronous I/O path allows a local process to induce kernel writes into application-owned output buffers after an error return. Affected platforms include Red Hat Enterprise Linux 8, 9, and 10, Red Hat Hardened Images, and OpenShift Container Platform 4. An unprivileged local attacker or a compromised application can exploit this use-after-free-class condition to crash the calling process (high availability impact) or corrupt buffer contents for limited confidentiality and integrity impact. No public exploit code or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in SSSD's PAM responder allows a local low-privileged attacker to crash the SSSD process and disclose sensitive memory contents by sending a crafted protocol v1 authentication request. Affected systems span all major Red Hat Enterprise Linux releases (6 through 10) and OpenShift Container Platform 4, representing a broad footprint in enterprise Linux environments. No active exploitation is confirmed (not listed in CISA KEV), and the EPSS score of 0.14% at the 3rd percentile reflects a very low observed exploitation probability at time of analysis.
Heap-based buffer overflows in GIMP's APNG and DDS image loaders let an attacker corrupt heap memory - and potentially achieve code execution - when a victim opens a specially crafted image file. The APNG path is triggered when the fcTL frame width exceeds the IHDR image width, so pixel data is written past the end of a heap allocation, while the DDS path involves a bits-per-pixel mismatch inside the load_layer() function. Exploitation is local and gated by user interaction (CVSS:3.1/AV:L/AC:L/PR:N/UI:R, 7.8 High), no public exploit code has been identified at time of analysis, and EPSS is very low at 0.13% (3rd percentile); Red Hat has shipped patched packages via RHSA-2026:73768 and RHSA-2026:50817.
Privilege escalation in Red Hat Build of Keycloak's user creation component exposes environments running Fine-Grained Admin Permissions V2 (FGAP V2) to unauthorized group assignment by scoped sub-administrators. A sub-admin holding only user-create permissions can bypass group-level authorization checks and enroll newly created users into any group - including privileged or sensitive ones - well beyond the sub-admin's delegated scope. SSVC rates technical impact as total and no public exploit has been identified, though the EPSS score of 0.24% (15th percentile) and SSVC exploitation status of 'none' indicate low immediate exploitation likelihood.
Denial of service in gnome-remote-desktop as shipped in Red Hat Enterprise Linux 8, 9, and 10 lets an unauthenticated remote attacker exhaust server resources when the daemon runs in system mode with RDP enabled. Because the incoming connection handler bypasses the connection throttler, an attacker can open large numbers of parallel pre-authentication RDP connections, accumulating accepted sockets and pending routing-token operations until timeout and blocking legitimate RDP logins. There is no public exploit identified at time of analysis, and the flaw is specific to Red Hat's build - it does not affect the upstream project.
Information disclosure in 389 Directory Server (upstream of Red Hat Directory Server 11-13, shipped across RHEL 6-10) lets an unauthenticated remote attacker inject LDAP search filters into the CleanAllRUV replication status-check extended operation. Because the handler evaluates attacker-controlled filters against cn=config using elevated replication-plugin privileges and leaks a boolean match result, attackers can blindly enumerate sensitive configuration metadata such as replication bind DNs and password storage scheme details. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the network-reachable, no-authentication attack surface makes it a meaningful reconnaissance primitive.
Remote unauthenticated denial of service in 389 Directory Server (389-ds-base, shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) allows an attacker to crash the LDAP daemon by sending a crafted replication extended operation. The flaw is a stack buffer overflow in the RUV parsing path that triggers during payload decoding before any authorization check, so no credentials are needed. No public exploit identified at time of analysis; stack protectors constrain the outcome to a server crash rather than code execution.
Macro injection in rpmbuild's tarball mode allows arbitrary code execution on systems running Red Hat Enterprise Linux 6 through 10, Red Hat Hardened Images, and OpenShift Container Platform 4. When rpmbuild processes a tarball in tarball mode, specially crafted tar member names are interpreted as RPM macros, enabling an attacker who can distribute a malicious tarball to achieve full RCE in the context of the user running the build. No public exploit or active exploitation has been identified at time of analysis, but the social-engineering requirement is realistic in open-source build pipeline contexts where developers routinely fetch and build third-party source tarballs.
Use-after-free memory corruption in WebKitGTK exposes Red Hat Enterprise Linux 6 through 9 systems to potential arbitrary code execution when users process attacker-controlled web content. The flaw (CWE-416) stems from improper memory management in the web engine's content rendering pipeline, where a freed heap allocation is subsequently accessed, enabling heap corruption. No public exploit code or CISA KEV listing has been identified at time of analysis; operational urgency derives from the CVSS 8.8 score, the broad RHEL deployment footprint, and the well-understood exploitability of use-after-free conditions in browser engines.
Unauthorized ManagedCluster deletion in Red Hat Multicluster Engine (MCE) allows any tenant with standard ClusterClaim permissions to destroy clusters belonging to other tenants or the hub itself, including the hub's local-cluster. The clusterclaims-controller fails to verify ownership before acting on the spec.namespace field, meaning a low-privileged tenant can target arbitrary ManagedClusters by crafting that field and then deleting the ClusterClaim. No public exploit or CISA KEV listing exists at time of analysis, but the attack requires only standard tenant credentials and no special configuration, making it a realistic insider or compromised-tenant threat.
Credential exfiltration in RHACM's multicloud-operators-subscription component allows an authenticated tenant with HelmRelease create permissions to bypass Kubernetes namespace isolation by manipulating the `secretRef.Namespace` field, causing the HelmRelease controller to fetch Secrets from arbitrary namespaces and transmit them to an attacker-controlled Helm repository. The CVSS S:C (scope changed) metric confirms this breaks the namespace boundary that Kubernetes multi-tenancy depends on, enabling low-privileged lateral movement across namespace security domains. No public exploit or CISA KEV active exploitation listing is confirmed at time of analysis; however, the attack is mechanically straightforward for any cluster account holding the requisite RBAC permission.
Privilege escalation and cluster-wide arbitrary resource deployment affects the multicloud-operators-subscription component of Red Hat Advanced Cluster Management for Kubernetes 2. A low-privileged tenant permitted to create HelmRelease custom resources can abuse the HelmRelease controller, which renders and applies Helm chart templates using its own elevated ServiceAccount, to deploy arbitrary resources anywhere in the cluster and bypass namespace/RBAC boundaries. Rated CVSS 9.9 with a scope change; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Improper access control in Lighthouse - the cross-cluster service-discovery component of Submariner shipped with Red Hat Advanced Cluster Management for Kubernetes 2 - lets an attacker who has compromised a spoke cluster inject unauthorized EndpointSlices and ServiceImports into arbitrary namespaces on peer clusters. Because the destination namespace is taken from an attacker-controlled label/annotation on the broker object, resources can be planted into privileged namespaces such as kube-system and openshift-*, enabling privilege escalation and lateral cluster compromise. Rated CVSS 9.9 with a scope change; no public exploit identified at time of analysis.
Cross-cluster MITM attacks are enabled in Red Hat Advanced Cluster Management for Kubernetes 2.x via the lighthouse service discovery component, which fails to validate IP addresses advertised in EndpointSlice objects. An attacker controlling a compromised spoke cluster can inject arbitrary IP addresses into EndpointSlices, causing lighthouse DNS resolution across all connected clusters to redirect legitimate cross-cluster service traffic to attacker-controlled endpoints. The CVSS Scope:Changed metric confirms that impact propagates beyond the compromised spoke cluster to the hub and peer clusters, enabling unauthorized interception and manipulation of inter-cluster communications. No public exploit code or CISA KEV listing has been identified at time of analysis.
Subnet validation failure in Submariner, the cross-cluster networking component shipped with Red Hat Advanced Cluster Management for Kubernetes 2, lets a malicious spoke cluster advertise arbitrary network ranges so that peer clusters route traffic destined for those ranges through the attacker's tunnel. Exploitation requires an attacker who already controls a joined, trusted spoke in the mesh and a deployment where Submariner inter-cluster connectivity is enabled with multiple peer clusters (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N, CWE-20), making this a conditional, post-trust-boundary issue rather than a drive-by internet threat. Successful abuse yields unauthorized information disclosure and network disruption across the mesh; no public exploit code and no confirmed active exploitation were identified at time of analysis, and EPSS is a low 0.29% (21st percentile).
Confidential Containers isolation in Kata Containers can be subverted by a malicious host operator via insufficient path validation in genpolicy's CreateContainer mount and storage rule enforcement. Affected deployments include Red Hat OpenShift Container Platform 4 running Kata Containers with genpolicy enabled for Confidential Containers guest protection. An operator-level attacker can mount arbitrary container-rootfs paths over sensitive host locations or inject attacker-controlled content into the guest, breaking the core confidentiality and integrity guarantees that Confidential Containers are designed to provide. No public exploit or CISA KEV listing has been identified at time of analysis.
WildFly Elytron's password hashing and verification subsystem silently normalizes Unicode input via NFKC before hashing, collapsing fullwidth characters (e.g., U+FF21 'Ａ') to their ASCII equivalents (e.g., 'A'). This allows an unauthenticated remote attacker to authenticate against accounts whose owners believed their passwords contained unique non-ASCII characters by submitting a standard ASCII-only dictionary - the normalization makes the stored hash indistinguishable from its ASCII equivalent. Affected deployments span Red Hat JBoss EAP 7 and 8, Red Hat Build of Keycloak, Red Hat Data Grid 8, and several other Red Hat middleware products that share the Elytron security layer. No public exploit code or CISA KEV listing has been identified at time of analysis.
FreeIPA's Kerberos Ticket Granting Service fails to verify Privilege Attribute Certificate (PAC) signatures when processing cross-realm tickets from a trusted Active Directory domain, allowing any authenticated AD user to impersonate arbitrary FreeIPA principals. This grants unauthorized elevated access to FreeIPA services including the web portal, SMB server, and LDAP directory. No active exploitation is confirmed (not in CISA KEV; SSVC Exploitation: none), though SSVC rates technical impact as total and CVSS scores 8.1 - the gap reflects the non-default trust configuration prerequisite that limits real-world exposure.
Memory exhaustion in FreeIPA's `/ipa/i18n_messages` endpoint allows a remote, unauthenticated attacker to crash identity services by sending an arbitrarily large HTTP request body. All RHEL-bundled FreeIPA deployments across RHEL 6 through RHEL 10 are affected per Red Hat CPE data. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, but the attack requires no authentication and no special configuration, making every internet-exposed FreeIPA instance a plausible target.
Privilege escalation in FreeIPA allows an attacker with high LDAP write privileges to create a rogue service principal that impersonates a privileged existing one, bypassing the uniqueness constraint enforced by the 389-ds directory server. The flaw arises because 389-ds fails to recognize equivalent representations of the same Kerberos principal name (CWE-706), enabling the creation of a shadow principal that Kerberos treats as legitimate. If exploited, an attacker can acquire valid Kerberos service tickets for sensitive services, with full domain compromise as the realistic worst-case outcome. No public exploit exists and CISA KEV does not list this CVE, though SSVC rates the technical impact as total.
FreeIPA's migration endpoint on Red Hat Enterprise Linux 6 through 10 is exploitable by remote unauthenticated attackers who send oversized HTTP POST requests to `/ipa/migration/migration.py`, causing the server to buffer arbitrarily large request bodies fully into memory. This resource exhaustion (CWE-770) leads to degraded performance, memory pressure, and potential service disruption of the identity management service. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Local privilege escalation and denial of service in libvirt's NodeGetFreePages RPC handler allows an unprivileged local user to corrupt the root libvirtd daemon's heap memory through a crafted integer overflow. The CWE-190 flaw causes an undersized buffer allocation that is subsequently overwritten with real NUMA node data, enabling heap buffer overflow in a root-owned process. No public exploit code or CISA KEV listing exists at time of analysis, but the CVSS 7.8 score (AV:L/AC:L/PR:L) and full C/I/A impact make this a genuine priority on multi-tenant RHEL virtualization hosts.
The acm-operator-bundle build pipeline within Red Hat Advanced Cluster Management for Kubernetes 2 fetches and executes a remote script without any cryptographic integrity or authenticity verification (CWE-829), exposing privileged build credentials - including GitHub access tokens and container registry passwords - to attacker-controlled code. An adversary able to compromise the remote script host or intercept the fetch in transit can inject arbitrary code that runs inside the privileged build environment and poisons the resulting operator bundle, extending the blast radius to downstream Kubernetes clusters that consume it (CVSS S:C). No public exploit code has been identified and CISA has not listed this in the Known Exploited Vulnerabilities catalog, but the credential-theft and supply-chain propagation potential make this a high-priority finding for organizations actively running ACM 2.x build pipelines.
Supply chain code injection in Red Hat Multicluster Engine for Kubernetes (mce-operator-bundle) enables arbitrary code execution during the software build process. The build pipeline fetches and executes scripts from a remote repository without commit pinning or cryptographic signature verification, meaning any actor with write access to that upstream repository can inject malicious payloads that execute at build time. The consequence extends beyond the build system itself (CVSS S:C) to the distributed artifacts, potentially delivering compromised software to all downstream consumers of the operator bundle. No public exploit code exists and no CISA KEV listing is present at time of analysis.
Privilege escalation in Red Hat Advanced Cluster Management for Kubernetes 2 stems from the search-v2-operator being bound to a ClusterRole with cluster-administrator-equivalent permissions - including user impersonation, RBAC write, Certificate Signing Request approval, and ManifestWork management. An attacker who gains control of the operator's service account (a low-privileged cluster foothold) can leverage these excessive grants to take over the entire hub cluster and its managed clusters. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the CVSS 9.9 rating reflects the near-total loss of cluster control if the operator identity is abused.
Authentication and authorization bypass in the cluster-proxy-addon component of Red Hat's Multicluster Engine for Kubernetes (MCE) lets an unauthenticated attacker who can reach the user-facing proxy route manipulate URL path segments to proxy requests to arbitrary services on any managed cluster. Because the flaw is a server-side request forgery (CWE-918) with a changed CVSS scope, a request to the hub's exposed route pivots into internal services on downstream clusters that were never meant to be externally reachable, enabling information disclosure and potential further compromise. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; the CVSS base score is 9.3 (critical).
Memory exhaustion denial of service in cockpit-ws affects Red Hat Enterprise Linux 7 through 10 and Red Hat OpenShift Dev Spaces, exploitable by any remote unauthenticated attacker. The login page request handler leaks a heap allocation on every HTTP request that includes a CockpitLang cookie, with no authentication or special privilege required. Sustained request flooding with this cookie will exhaust host memory, crashing the cockpit-ws service and potentially destabilizing the underlying host; no public exploit or active exploitation has been identified at time of analysis.
Account takeover in Red Hat Build of Keycloak allows an unauthenticated attacker to abuse the reset-credentials flow in the keycloak-services component to complete a password reset for any user without ever clicking the emailed verification link, letting them directly set new credentials. Because the mandatory email-ownership check can be bypassed, the flaw yields full control of arbitrary accounts (CVSS 9.1). No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Excessive ClusterRole permissions on the managed-serviceaccount addon-manager pod in Red Hat Advanced Cluster Management for Kubernetes 2 allow a compromised addon-manager to read secrets across every namespace and approve arbitrary Certificate Signing Requests, resulting in cluster-wide information disclosure and privilege escalation. The CVSS scope-change (S:C) reflects that a single compromised pod can affect the entire Kubernetes cluster, not just the addon namespace. No public exploit code or active exploitation via CISA KEV has been confirmed at time of analysis.
Credential exfiltration via SSRF in AWX's GitHub webhook status callback affects Red Hat Ansible Automation Platform 2: an attacker holding admin role on a webhook-enabled job template can forge a signed GitHub pull request webhook with an arbitrary statuses_url, causing AWX to POST authenticated status updates - including the configured Git Personal Access Token in the Authorization header - to an attacker-controlled or internal endpoint. The Changed scope (S:C) in the CVSS 7.7 vector reflects that the leaked PAT extends attacker reach beyond AWX to connected Git repositories and any internal services reachable via SSRF. No public exploit identified at time of analysis, and no CISA KEV listing exists.
Server-side request forgery in the Red Hat Ansible Automation Platform 2 Controller's HashiCorp Vault credential plugin lets an authenticated user with credential-creation rights force the controller pod to leak its own Kubernetes service account token. When a HashiCorp Vault Secret Lookup credential configured for kubernetes_role authentication is tested, the kubernetes_auth() routine in awx_plugins/credentials/hashivault.py transmits the pod token to an attacker-supplied URL. With that token the attacker gains Kubernetes API access to control-plane namespaces, enabling full pod CRUD and secret reads including database credentials and the Django SECRET_KEY. No public exploit identified at time of analysis, and the flaw is not on the CISA KEV list.
Privilege escalation in Red Hat Multicluster Engine for Kubernetes (MCE) lets a privileged service account on a managed spoke cluster submit a forged Certificate Signing Request that the managedcluster-import-controller auto-approves, yielding administrative credentials on the central hub cluster. The controller's auto-approval path neither inspects the CSR signer name nor decodes the PEM-encoded x509 request, so an attacker who already controls a spoke can pivot to full control of the hub and, by extension, every cluster it manages. No public exploit identified at time of analysis; EPSS is low (0.22%, 12th percentile) and CISA SSVC records no observed exploitation.
Command and SQL injection in Red Hat Advanced Cluster Management for Kubernetes 2 (acm-search-v2-rhel9) lets a privileged tenant escalate to arbitrary code execution inside the cluster's PostgreSQL pod. An authenticated hub administrator or Search Custom Resource editor can supply an unsanitized WORK_MEM value that is passed into both a bash script and an SQL query, breaking out of the intended data plane. No public exploit is identified at time of analysis and the flaw is not on CISA KEV, but the CVSS 9.1 rating reflects full confidentiality, integrity, and availability loss with a scope change.
Privilege escalation in Red Hat Advanced Cluster Management for Kubernetes 2 allows any attacker with local pod execution under the `search-serviceaccount` service account to impersonate `system:masters` and gain full cluster-admin control. The `search-serviceaccount` RBAC bindings grant cluster-wide `impersonate` permissions on users and groups - a grossly over-privileged configuration that collapses the entire cluster's security boundary if any pod running under this account is compromised. No public exploit has been identified at time of analysis and this CVE is not in CISA KEV, but the CVSS scope change (S:C) and full CIA triad impact (C:H/I:H/A:H) accurately reflect the catastrophic blast radius of successful exploitation.
Privilege escalation in Red Hat Advanced Cluster Management's multicloud-operators-subscription controller lets a low-privileged user on a managed cluster create a Subscription with crafted annotations that the controller processes with its own elevated Service Account, deploying attacker-chosen resources into arbitrary namespaces. The flaw (CWE-863, CVSS 9.9, scope-changed) affects Red Hat ACM 2.x and Multicluster Global Hub as reported by Red Hat. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Server-Side Request Forgery in Red Hat Quay's build API allows an authenticated user with repository write access to pivot into internal network segments via the Quay builder service. Exploitation requires FEATURE_BUILD_SUPPORT to be enabled and the attacker to hold at least write-level repository permissions. The CVSS vector (PR:L, C:H) reflects a meaningful but bounded threat: internal network reconnaissance and sensitive data disclosure are achievable, though no public exploit exists and EPSS sits at 0.13% (3rd percentile), indicating no observed widespread exploitation at time of analysis.
Red Hat Quay 3's exported action logs download endpoint fails to enforce authorization, permitting any network-accessible party who holds a valid file ID to retrieve full audit log exports without authenticating. The file IDs, while complex and not publicly guessable, are transmitted in plaintext via email notifications and webhook callbacks - creating a realistic interception pathway for adversaries with network positioning. No active exploitation or public POC has been identified; EPSS at 0.31% (23rd percentile) reflects low automated exploitation probability, though targeted disclosure remains credible wherever log export notifications traverse unencrypted channels.
Red Hat Quay's Stripe billing webhook handler at /webhooks/stripe processes inbound JSON payloads without verifying the Stripe-Signature HMAC header, enabling any network-reachable unauthenticated attacker to forge billing events. Successful exploitation resets the targeted namespace's build quota to its configured maximum and dispatches unsolicited billing notification emails to namespace administrators. No public exploit has been identified and EPSS is 0.14% (4th percentile), but the zero-prerequisite attack path makes exploitation trivially scriptable by any attacker with HTTP access to the endpoint.
Red Hat Quay 3 and Red Hat OpenShift Update Service expose an unauthenticated security scanner notification endpoint when the SECURITY_SCANNER_V4_PSK (pre-shared key) is absent, enabling remote unauthenticated attackers to flood the notification queue and inject path traversal characters into outbound Clair API URL paths. The primary impact is worker resource exhaustion leading to denial of service, with a secondary low-integrity impact from blind path manipulation against the configured Clair vulnerability scanner host. No public exploit identified at time of analysis, and EPSS of 0.26% (17th percentile) indicates low current exploitation probability.
Unauthorized cross-tenant cluster takeover in Red Hat Multicluster Engine (MCE) for Kubernetes allows an authenticated tenant to force a managed cluster into another tenant's ManagedClusterSet by manipulating ClusterClaim labels. The clusterclaims-controller processes these label changes without enforcing tenant ownership boundaries, enabling the attacker to then inject policies and workloads into clusters they do not own. No public exploit code or CISA KEV listing has been identified at time of analysis, but the scope-changing nature (S:C) and high confidentiality impact make this a serious multi-tenancy isolation failure.
Memory exhaustion in Red Hat Advanced Cluster Management for Kubernetes 2's search-v2-api component allows unauthenticated remote attackers to crash the search-api pod by submitting HTTP requests with unique random bearer tokens. Each unique token creates a permanent, uncleaned entry in the unbounded tokenReviews cache; sustained submission accumulates entries until the pod exhausts available memory and is killed. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivial, unauthenticated exploitability with no prerequisites. No public exploit has been identified and the vulnerability is not listed in the CISA KEV catalog, though the low attack complexity makes automated exploitation straightforward.
Cross-cluster remote code execution in Red Hat Advanced Cluster Management for Kubernetes 2 (acm-search-v2-rhel9 search collector) allows a hub-cluster administrator holding patch access to the Search Custom Resource to abuse the unvalidated Collector.ImageOverride field to push an attacker-chosen container image to every managed cluster in the fleet. Because the override is trusted and propagated hub-to-spoke, a single malicious CR edit yields command execution across all connected clusters, with the CVSS scope-change flag reflecting the jump from the hub trust boundary into separate managed-cluster security authorities. No public exploit identified at time of analysis, and this CVE is not listed in CISA KEV.
Container image injection in Red Hat Advanced Cluster Management for Kubernetes 2 (RHACM 2) allows a low-privileged authenticated user with specific administrative permissions on a managed cluster to exploit the search-v2-operator component's improper configuration handling, overriding container image settings and deploying arbitrary images across the managed cluster. The CVSS 8.5 score reflects a scope-changed impact (S:C) where the breach crosses from the search operator into the broader managed cluster workload environment, enabling a supply chain-style compromise of running containers. No public exploit code or CISA KEV listing has been identified at time of analysis, limiting near-term opportunistic risk, though the insider or compromised-privileged-account threat model remains credible given the PR:L access requirement.
Unauthenticated remote crash of rsyslogd is possible through a flaw in the optional imptcp input module, where a crafted input sequence during oversize-frame recovery produces an invalid internal message length and terminates the logging daemon. Systems running Red Hat Enterprise Linux 6 through 10 are affected only when imptcp is explicitly loaded with a non-default frame delimiting mode; the default imptcp framing and the separate imtcp module are explicitly confirmed unaffected. No public exploit code and no CISA KEV listing have been identified at time of analysis; CVSS scores this at 7.5 High solely on the basis of network-accessible, unauthenticated availability impact.
Symlink following in KubeVirt's virt-handler migration proxy enables a low-privileged Kubernetes user holding namespace edit and pods/exec permissions to achieve full node compromise by redirecting a migration Unix socket to the host CRI-O container runtime socket. Because virt-handler runs as root within the host mount namespace and resolves socket paths through /proc/<pid>/root/ using net.Dial() without symlink validation, an attacker-controlled symlink placed in a qemu-writable directory causes virt-handler to transparently proxy arbitrary bytes into the container runtime, yielding complete control over the underlying Kubernetes node. No public exploit has been identified at time of analysis, but the scope change from container to host and the full CIA triad impact make this a critical remediation priority for all OpenShift Virtualization 4 deployments.
Privilege escalation in Red Hat Advanced Cluster Management for Kubernetes 2 lets a namespace-scoped tenant abuse the multicloud-operators-subscription controller as a confused deputy: by crafting Subscription Custom Resources, a namespace-admin causes the controller's highly privileged ServiceAccount to deploy attacker-chosen cluster-scoped resources. This breaks tenant isolation and can yield cluster-wide privilege escalation and arbitrary code execution. Rated CVSS 9.9 (scope-changing), with no public exploit identified at time of analysis and no active exploitation reported (not in CISA KEV).
Privilege escalation and arbitrary code execution in Red Hat's multicluster engine (MCE) for Kubernetes lets a low-privileged tenant holding create or update rights on ClusterCurator resources hijack the cluster-curator-controller's service account. Because the CreateJob() function unmarshals the attacker-supplied spec.install.overrideJob raw extension without validation, the injected Job runs with the controller's elevated permissions, enabling cluster-wide secret access and full compromise. Rated CVSS 9.9 by Red Hat; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Privilege escalation in Red Hat's multicluster engine for Kubernetes (MCE) lets a namespace-scoped authenticated user gain cluster-wide control by abusing the cluster-curator-controller. By creating a ClusterCurator custom resource with a specific, attacker-chosen naming convention, the user tricks the controller into minting a cluster-scoped ClusterRoleBinding on their behalf, breaking the namespace isolation boundary. There is no public exploit identified at time of analysis, but the CVSS 9.9 rating reflects that a low-privileged tenant can obtain secrets access, manage cluster actions, and destroy hosted clusters or node pools.
Unauthorized cross-tenant Secret and ConfigMap access in the multicloud-operators-channel component of Red Hat Advanced Cluster Management for Kubernetes 2 allows a compromised managed-cluster agent to read all Secrets and ConfigMaps within any Channel namespace on the hub cluster. The Changed scope (S:C) in the CVSS vector confirms that exploitation pivots from a managed cluster context into the hub, exposing Git and Helm repository credentials belonging to other tenants. No public exploit has been identified at time of analysis, but the network-reachable, low-privilege vector makes this a high-priority finding in any multi-tenant RHACM deployment.
Secret exfiltration across Kubernetes namespace boundaries in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management for Kubernetes 2 allows an authenticated namespace administrator to read Kubernetes Secrets from arbitrary namespaces outside their own authorization domain. By setting Channel.Spec.SecretRef.Namespace to a target namespace, the attacker causes the subscription controller to autonomously copy sensitive Secret contents into a namespace the attacker controls, violating the Kubernetes namespace isolation model. No public exploit code has been identified at time of analysis, but the scope-changed CVSS vector (S:C, C:H) and the sensitivity of Kubernetes Secret payloads - which frequently contain credentials, API tokens, and TLS private keys - make this a high-priority finding in any multi-tenant RHACM deployment.
Cross-tenant bearer-token disclosure in Red Hat Advanced Cluster Management for Kubernetes 2 (RHACM) lets an authenticated tenant abuse the GitOpsCluster controller in the multicloud-integrations component to redirect spoke-cluster credentials into a namespace they control. Because the controller acts on the tenant's behalf across trust boundaries (a confused-deputy flaw), a low-privileged user can obtain tokens that grant access to managed spoke clusters and bypass ArgoCD AppProject scoping controls. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the CVSS base score is 9.6 (Critical).
Cross-cluster remote code execution in Red Hat Advanced Cluster Management for Kubernetes 2 (multicloud-integrations / ArgoCD pull-model integration) lets a low-privileged hub tenant who can create Application CRs redirect propagation to arbitrary managed spoke clusters. Because the Application propagation controller trusts the attacker-supplied `ocm-managed-cluster` annotation without validation, an attacker forces ArgoCD on targeted spokes to sync attacker-controlled manifests, yielding code execution or privilege escalation there. CVSS 9.9 with scope change; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Incorrect authorization in FreeIPA's trust-fetch-domains command allows any authenticated, non-privileged IPA user to trigger a privileged Active Directory trust refresh using an attacker-supplied server and credentials, writing attacker-controlled trusted-domain and ID-range data into the FreeIPA LDAP directory. The flaw (CWE-863) stems from the command being gated by a read-only trust object permission rather than the required trust-administration permission, effectively bypassing the authorization boundary between read and write operations on cross-realm identity data. No public exploit has been identified and CISA has not listed this in KEV, but the scope-changed CVSS score of 8.2 and high integrity impact reflect serious potential for identity infrastructure tampering in environments running AD trusts.
Code injection in the Perl DBI module as packaged for Red Hat Enterprise Linux allows a network-accessible, low-privileged attacker to execute arbitrary code, resulting in full confidentiality, integrity, and availability compromise. This CVE is a remediation of an incomplete fix for CVE-2026-14380, specifically targeting RHEL 9.8.z and 10.2.z patch levels where the prior partial fix left an exploitable residual path. No public exploit or CISA KEV listing is identified at time of analysis, but the CWE-94 classification and RCE tag indicate high potential impact if exploitation conditions are met.
Server-Side Request Forgery in Red Hat OpenShift Container Platform 4's Dev Console webhook helpers allows authenticated users to coerce the console pod into issuing arbitrary outbound HTTP requests on their behalf. Because the console pod operates from a privileged network position within the cluster, this enables lateral movement to internal services - including the Kubernetes API server, metadata endpoints, and internal microservices - that would otherwise be unreachable from outside the cluster. No public exploit or CISA KEV listing has been identified at time of analysis, but the Scope:Changed CVSS metric reflects the cross-boundary nature of the impact.
Server-Side Request Forgery in the OpenShift Console Helm catalog proxy allows low-privileged namespace tenants to plant a malicious ProjectHelmChartRepository resource pointing to an attacker-controlled URL, causing the console pod to issue server-side fetches that bypass tenant egress restrictions. Combined with Helm catalog metadata poisoning and subsequent admin-mediated chart installation, this multi-stage attack chain enables privilege escalation within the cluster. No CISA KEV listing or public exploit code has been identified at time of analysis, though the CVSS Scope:Changed rating correctly reflects that the console pod's cross-boundary requests extend impact beyond the originating namespace.
Privilege escalation in the `openvt -u` utility allows a local low-privileged attacker to obtain passwordless root login on Red Hat Enterprise Linux 6 through 10, Red Hat Hardened Images, and Red Hat OpenShift Container Platform 4. The flaw lies in `authenticate_user()`, which resolves VT ownership via `stat("/proc/<pid>/fd/0")` - a call that follows the symlink to the underlying TTY device node rather than inspecting the owning process, causing the check to read the device node's UID rather than the process owner's UID. When a privileged user logs out and TTY device node ownership reverts to root or the getty owner while an attacker's process still holds fd 0 on that TTY, the check incorrectly authorizes a passwordless `login -f root` execution. No public exploit is identified at time of analysis and there is no CISA KEV listing, but the root-level impact makes this a high priority for environments using the affected `kbrequest`/init deployment pattern.
Privilege escalation in MRTG (Multi Router Traffic Grapher) allows a local low-privileged attacker to gain elevated file ownership on the host system. When the MRTG daemon is launched as root and then drops privileges, a CWE-59 symlink-following flaw in PID file handling lets an attacker pre-place or manipulate a symlink at the expected PID file path, causing the root process to change ownership of an arbitrary existing file to the daemon user. Affected platforms include Red Hat Enterprise Linux 6 through 10; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in Red Hat OpenShift AI's Data Science Pipelines component allows authenticated tenants to bypass authorization controls in the setDefaultServiceAccount function by submitting a crafted CreateRun request that references a more privileged ServiceAccount than they are entitled to use. Successful exploitation enables the tenant's pipeline containers to run with elevated Kubernetes RBAC permissions, resulting in cross-namespace secret disclosure and the ability to execute commands inside other tenants' pods. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Denial of service in ml-metadata (MLMD), a core metadata tracking component of Red Hat OpenShift AI (RHOAI), stems from an outdated statically-linked gRPC stack that retains known HTTP/2 resource exhaustion weaknesses. An in-cluster adversary with network reachability to the MLMD pod can crash it by sending specially crafted HTTP/2 requests, halting all ML pipeline runs within the affected namespace. No public exploit has been identified at time of analysis, and exploitation is constrained to actors already operating inside the Kubernetes cluster.
Credential derivation in Red Hat OpenShift AI's Data Science Pipelines Operator allows unauthenticated remote attackers to predict MariaDB root/user passwords and MinIO access/secret keys by exploiting a cryptographically weak PRNG (CWE-338). Any attacker who can reach the MinIO Route or MariaDB Service over the network can compute valid credentials without prior authentication, then access all pipeline artifacts and metadata stored in the system. No active exploitation is confirmed and no public exploit code has been identified at time of analysis, but the CVSS 7.5 High rating with AV:N and PR:N reflects a no-authentication-barrier condition against exposed services.
Privilege escalation in libvirt's `virFileChownFiles()` function allows a process confined to the `swtpm` system user to coerce the root-level libvirtd daemon into reassigning ownership of any arbitrary file on the host to the `swtpm` user. The attack exploits a symlink-following flaw (CWE-59) in directory traversal logic that runs with root privileges, affecting libvirt as packaged across Red Hat Enterprise Linux 6 through 10 and RHEL for Nvidia 26. No public exploit has been identified at time of analysis, but the attack complexity is low once `swtpm`-user execution is obtained.
Privilege escalation in Red Hat OpenShift AI's training-operator enables any user holding a standard Kubernetes edit or admin role in any cluster namespace to break out of namespace isolation, impersonate service accounts, access the host filesystem, and achieve remote code execution. The root cause is a design flaw: the operator aggregates training job permissions onto native Kubernetes built-in ClusterRoles, and allows unrestricted PodTemplateSpec passthrough - meaning users can submit training jobs containing arbitrary pod configurations such as hostPath mounts or elevated service account tokens. No public exploit code or CISA KEV listing was identified at time of analysis, but the low access complexity and the broad availability of edit/admin roles in typical ML platform deployments make this an urgent remediation priority.
Privilege escalation in Red Hat OpenShift AI (RHOAI) training operator overlay allows any namespace editor to manage TrainJob resources beyond their intended authorization scope. The RHOAI overlay incorrectly injects trainjobs CRUD permissions into the native Kubernetes edit ClusterRole, violating the principle of least privilege. When chained with a companion flaw (TRN-01) that permits arbitrary pod configuration within TrainJobs, a remote attacker holding namespace editor credentials could escalate to arbitrary code execution - no public exploit is identified at time of analysis, and KEV listing has not been confirmed.
Privilege escalation in odh-dashboard, the web interface for Red Hat OpenShift AI (RHOAI), allows any authenticated dashboard user to gain cluster-admin or other highly privileged roles by manipulating the roleRef field when creating RoleBindings. The system performs no server-side validation on the roleRef value supplied through the dashboard, enabling an attacker holding only a standard user account to bind themselves to arbitrary Kubernetes ClusterRoles. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, but the CVSS 8.8 score and the direct, low-complexity path to cluster-admin access make this a high-priority remediation target for any RHOAI deployment.
Privilege escalation in odh-dashboard (Red Hat OpenShift AI) allows an attacker who has obtained the dashboard's Service Account token to abuse overly broad SA permissions and elevate to cluster-administrator level. Exploitation grants full access to secrets, credentials, and keys across the entire OpenShift cluster, while also breaking multi-tenant isolation between workloads. No public exploit code has been identified at time of analysis, and this CVE is not in CISA KEV, but the CVSS score of 8.8 and cluster-wide blast radius make it a high-priority remediation target for RHOAI deployments.
Unauthenticated remote code execution affects Feast (the open-source ML feature store), where user-defined functions stored in the registry are serialized with Python's 'dill' library and deserialized without validation. In default configurations a remote attacker can store a malicious UDF and achieve unauthenticated code execution on the feature server; an authenticated attacker can bypass authorization during deserialization to run code on the registry server, enabling cross-tenant data access and lateral movement. Rated CVSS 9.9 with a scope change; no public exploit has been identified at time of analysis, and it is not listed in CISA KEV. Feast is bundled in Red Hat OpenShift AI (RHOAI), which is the reporting vendor's affected product.
Authorization bypass in Feast's materialization API endpoints within Red Hat OpenShift AI (RHOAI) permits full re-materialization of all feature views by sending a crafted request that omits the feature_views field, circumventing permission checks. The consequence is a multi-tenant Denial of Service through data corruption and significant resource exhaustion, impacting all tenants sharing the deployment. No public exploit code has been identified at time of analysis, but the bypass mechanism is straightforward - a structural omission in the request body - making independent rediscovery likely for any attacker with API access.
Feast and feast-operator ship with a default 'no_auth' security configuration, leaving the feature-server, registry-server, and offline-server endpoints completely unauthenticated and accessible to any network-reachable attacker in Red Hat OpenShift AI (RHOAI) deployments. Exploitation enables three distinct high-impact outcomes: remote code execution via injection of a malicious User-Defined Function (UDF) onto the feature-server, denial of service by forcing full re-materialization of all tenant features, and unauthorized read access to cross-tenant feature data. No public exploit code has been identified at time of analysis and CISA KEV status is not confirmed, but the trivial exploitation conditions - no authentication, no interaction, default configuration - make this a realistic priority for any RHOAI operator.
Privilege escalation in Red Hat Data Science Pipelines (DSP) allows an authenticated namespace editor to gain node-root access by submitting a crafted Argo Workflow via the V1 API path. The API server, acting as a confused deputy (CWE-266), creates pods with elevated privileges on the attacker's behalf, effectively breaking out of Kubernetes namespace isolation. Successful exploitation enables arbitrary code execution and full control over the underlying cluster node; no public exploit has been identified at time of analysis, and this is not listed in CISA KEV.
MySQL DSN parameter injection in Red Hat OpenShift AI's Data Science Pipelines Operator (DSPO) allows a namespace editor to enable the MySQL LOCAL INFILE feature via the unvalidated spec.database.customExtraParams field, enabling exfiltration of sensitive files - including Kubernetes service account tokens - from the operator pod. An attacker who exploits this can leverage the stolen token to impersonate the operator's service account and escalate privileges to cluster-admin level within the OpenShift cluster. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Overprivileged ClusterRole assignments in Red Hat OpenShift AI's Data Science Pipelines Operator (DSPO) create a cluster-wide privilege escalation path if the operator pod is compromised. The DSPO ClusterRole grants capabilities well beyond operational necessity - including pod exec and cluster-wide RBAC management - directly violating the principle of least privilege (CWE-250). Successful exploitation of a compromised DSPO pod would allow an attacker to assume full administrative control over the entire Kubernetes cluster; no public exploit or CISA KEV listing has been identified at time of analysis, but the CVSS scope-change flag (S:C) confirms the blast radius extends far beyond the initial compromise boundary.
Authentication bypass in TrustyAI Service (TAS) within Red Hat OpenShift AI (RHOAI) exposes the backend API to any pod on the cluster network without requiring valid credentials. The CVSS vector (AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms that an attacker with a pod on the cluster-such as through a compromised workload or a malicious tenant pod in a multi-tenant deployment-can read, modify, delete, or poison AI model monitoring data and configurations with no additional barriers. No public exploit code or CISA KEV listing has been identified at time of analysis, but the root cause (CWE-306: Missing Authentication for Critical Function) means exploitation is trivially simple once cluster network adjacency is established.
Arbitrary code execution in Red Hat OpenShift AI's trustyai-service-operator enables authenticated cluster users to bypass pod security policies via crafted sidecar container configurations in LMEvalJob resources. The CVSS 8.1 (High) score reflects network-accessible exploitation requiring only low-privilege cluster authentication, with high confidentiality and integrity impact against the affected workload context. No public exploit code has been identified and no CISA KEV listing exists at time of analysis, but the low barrier of entry (any authenticated cluster user) elevates insider-threat and compromised-account risk for RHOAI deployments.
Authentication bypass in the Models-as-a-Service (MaaS) API component of Red Hat OpenShift AI (RHOAI) lets any pod already running in the cluster impersonate arbitrary users by forging the X-MaaS-Username and X-MaaS-Group HTTP headers, which the service trusts without independent verification. Because the MaaS API performs no first-party authentication and defers entirely to a Kuadrant AuthPolicy gateway that can be circumvented, a low-privileged workload can mint Kubernetes ServiceAccount tokens in other tenants' namespaces, revoke API keys, and exfiltrate model-access configuration - a full cross-tenant privilege escalation. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV, but the 9.9 CVSS reflects near-total impact.
The MaaS (Model-as-a-Service) Gateway component in Red Hat OpenShift AI (RHOAI) is improperly configured, enabling any low-privileged authenticated user within the platform to act as a man-in-the-middle against all model-serving traffic. Affected users can intercept, read, log, and modify requests and responses traversing the gateway, exposing highly sensitive artifacts including API access keys, user input prompts, and model outputs. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog, but the CVSS 8.8 rating with high confidentiality, integrity, and availability impact reflects the severity of unrestricted traffic access within a shared AI serving environment.
Out-of-bounds write vulnerabilities in GIMP's PSD and PAA file format parsing plugins allow remote attackers to achieve code execution with the privileges of the local user by delivering a specially crafted image file. Affected deployments include GIMP packages shipped with Red Hat Enterprise Linux 6 through 9. No public exploit code has been identified at time of analysis, and CISA SSVC classifies exploitation status as none with the attack assessed as not automatable, though technical impact is rated total given the C:H/I:H/A:H CVSS profile.
Insufficient source identity validation in Red Hat Multicluster Global Hub's manager component allows a network-adjacent attacker who has compromised a managed hub to impersonate any other hub on the shared Kafka status bus. By presenting a legitimately obtained Kafka client certificate from the compromised hub while falsifying the CloudEvent source field, the attacker can overwrite or delete compliance records, inventory data, and cluster health telemetry belonging to sibling hubs in the shared database. No public exploit has been identified at time of analysis, but the scope-changed CVSS vector (S:C) reflects that the integrity impact extends beyond the initially compromised hub to the entire multi-hub management plane.
Arbitrary code execution in GIMP's PSD import plugin allows an attacker to run code in the context of the user who opens a maliciously crafted .psd file. An unsigned integer underflow in the plugin's block_rem length variable (CWE-191) corrupts parsing of Photoshop layer resource blocks, letting attacker-controlled data be treated as trusted structures. Reported by Red Hat and tracked upstream in GNOME's GIMP tracker; SSVC lists a proof-of-concept, though it is not in CISA KEV and EPSS exploitation probability is low (0.31%).
Heap overflow in GIMP's Seattle Filmworks file loader allows an attacker who tricks a user into opening a specially crafted SFW file to write several kilobytes of attacker-controlled data beyond the intended buffer, resulting in memory corruption that can lead to arbitrary code execution or denial of service. Affected platforms confirmed via CPE data are Red Hat Enterprise Linux 6 through 9 with GIMP installed. No public exploit code has been identified and this CVE is not listed in CISA's KEV catalog, but the high CVSS 7.8 score reflects the full confidentiality, integrity, and availability impact achievable once a victim is socially engineered into opening the malicious file.
Integer overflow and underflow flaws in GStreamer's gst-plugins-ugly ASF demuxer expose systems to denial of service and limited heap data disclosure when processing attacker-controlled media files. The asfdemux plugin fails to adequately validate length and size fields inside ASF/WMV/WMA header objects, allowing arithmetic overflows to bypass bounds checks and trigger out-of-bounds heap reads. Any application or user that opens an untrusted media file through a GStreamer pipeline - browsers, media players, thumbnailers - is exposed; no public exploit or CISA KEV listing has been identified at time of analysis.
Heap out-of-bounds write in GStreamer's adpcmdec element allows a crafted WAV file containing malformed multi-channel IMA/DVI ADPCM audio to corrupt application memory, cause denial of service, or potentially achieve arbitrary code execution. Affected deployments include Red Hat Enterprise Linux 7 through 10, where the vulnerable gst-plugins-bad package is distributed. No confirmed active exploitation (not in CISA KEV) and no public proof-of-concept has been identified at time of analysis, though the CVSS score of 7.6 reflects the realistic network-deliverable, user-interaction-dependent attack path.
Command injection in dracut's die() error-handling function allows an unauthenticated attacker on the adjacent network, controlling a rogue DHCP server, to execute arbitrary commands as root during initramfs boot-failure recovery. The flaw exists because error messages written into emergency hook shell scripts under the initramfs environment are not shell-quoted, and those messages can carry attacker-controlled data sourced from the DHCP ROOT_PATH option processed by the 40network module. No public exploit code or CISA KEV listing has been identified at time of analysis, but the exploitation primitive is conceptually straightforward for anyone with DHCP server control on the local network segment.
Unbounded memory growth in GStreamer's RTP H.264 and H.265 depayloader elements allows a remote unauthenticated attacker to exhaust process memory and terminate any application consuming RTP video streams. The rtph264depay and rtph265depay elements in gst-plugins-good lack an upper bound on their internal reassembly buffer, meaning an attacker who continuously sends fragmented RTP packets while withholding the end-of-fragment marker can grow that buffer without limit. No public exploit has been identified at time of analysis, and CISA KEV listing is absent, but the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates this is trivially exploitable against any exposed GStreamer RTP pipeline.
Session hijacking via SAML assertion replay in Keycloak's SAML broker component allows adjacent-network attackers to authenticate as arbitrary users without credentials. When Keycloak is deployed as a SAML broker in IdP-Initiated flow mode, it fails to enforce the SAML OneTimeUse condition, permitting a captured assertion to be submitted multiple times. No public exploit has been identified at time of analysis, and EPSS sits at 0.14% (4th percentile), though SSVC rates technical impact as total - reflecting the full account takeover consequence if the preconditions are met.
Privilege escalation in Red Hat Build of Keycloak's Dynamic Client Registration (DCR) grants an attacker with low-privilege client registration credentials full realm administrator access by exploiting a validation bypass in the 'Allowed Protocol Mapper Types' security policy. The policy correctly validates mapper types at initial registration but fails to re-validate the mapper type during a client update when the mapper's surrounding configuration is unchanged, allowing a type-swap from a permitted mapper to a restricted high-privilege mapper (such as a HardcodedRoleMapper that injects realm-admin roles into tokens). No public exploit code has been identified and no CISA KEV listing is present, but the attack is low-complexity, fully network-exploitable, and results in complete confidentiality, integrity, and availability compromise of the Keycloak realm.
Account takeover in Keycloak (Red Hat build of Keycloak, Red Hat Single Sign-On 7) arises because the IdP-initiated SAML SSO endpoint does not verify whether an upstream identity provider is restricted to account-linking-only mode. An attacker who controls a linked upstream identity can drive that endpoint to complete a full login rather than a mere link operation, seizing complete access to the corresponding local user account. Red Hat has shipped fixes; there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.19%).
Privilege escalation in Keycloak's Dynamic Client Registration (DCR) component allows attackers with standard user accounts and limited Initial Access Tokens to forge administrative roles directly into their own access tokens. The underlying flaw is a missing claim-path validation in the default DCR policy for User Property mappers, which permits writing attacker-controlled values into sensitive internal claim locations that normally carry role and privilege assertions. Successful exploitation enables takeover of other registered OAuth clients, exfiltration of confidential client secrets, and full administrative control over the affected Keycloak realm. No confirmed active exploitation or public exploit code is identified at time of analysis.
URI normalization bypass in Keycloak's Authorization Services PathMatcher allows authenticated low-privilege users to reach administrative or restricted endpoints by appending trailing slashes or matrix parameters to request URIs. Affected deployments include Red Hat Build of Keycloak, Red Hat Single Sign-On 7, Red Hat Data Grid 8, and Red Hat JBoss EAP Expansion Pack. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, though the high CVSS confidentiality and integrity impact scores reflect meaningful privilege escalation risk in production environments.
Authentication bypass in Red Hat Build of Keycloak (and Red Hat Single Sign-On 7) lets an unauthenticated attacker forge SAML responses to hijack accounts when a SAML identity-provider's metadata was imported without explicit key-usage attributes, causing the keycloak-services identity-brokering engine to silently disable signature validation despite a signing certificate being present. Rated CVSS 9.1 with total technical impact per CISA SSVC, an attacker who knows a victim's external identifier can log in as that user. No public exploit identified at time of analysis, and EPSS is low (0.14%, 4th percentile), indicating the risk is currently theoretical/targeted rather than mass-exploited.
Memory corruption in libkcapi's one-shot asynchronous I/O path allows a local process to induce kernel writes into application-owned output buffers after an error return. Affected platforms include Red Hat Enterprise Linux 8, 9, and 10, Red Hat Hardened Images, and OpenShift Container Platform 4. An unprivileged local attacker or a compromised application can exploit this use-after-free-class condition to crash the calling process (high availability impact) or corrupt buffer contents for limited confidentiality and integrity impact. No public exploit code or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in SSSD's PAM responder allows a local low-privileged attacker to crash the SSSD process and disclose sensitive memory contents by sending a crafted protocol v1 authentication request. Affected systems span all major Red Hat Enterprise Linux releases (6 through 10) and OpenShift Container Platform 4, representing a broad footprint in enterprise Linux environments. No active exploitation is confirmed (not listed in CISA KEV), and the EPSS score of 0.14% at the 3rd percentile reflects a very low observed exploitation probability at time of analysis.
Heap-based buffer overflows in GIMP's APNG and DDS image loaders let an attacker corrupt heap memory - and potentially achieve code execution - when a victim opens a specially crafted image file. The APNG path is triggered when the fcTL frame width exceeds the IHDR image width, so pixel data is written past the end of a heap allocation, while the DDS path involves a bits-per-pixel mismatch inside the load_layer() function. Exploitation is local and gated by user interaction (CVSS:3.1/AV:L/AC:L/PR:N/UI:R, 7.8 High), no public exploit code has been identified at time of analysis, and EPSS is very low at 0.13% (3rd percentile); Red Hat has shipped patched packages via RHSA-2026:73768 and RHSA-2026:50817.
Privilege escalation in Red Hat Build of Keycloak's user creation component exposes environments running Fine-Grained Admin Permissions V2 (FGAP V2) to unauthorized group assignment by scoped sub-administrators. A sub-admin holding only user-create permissions can bypass group-level authorization checks and enroll newly created users into any group - including privileged or sensitive ones - well beyond the sub-admin's delegated scope. SSVC rates technical impact as total and no public exploit has been identified, though the EPSS score of 0.24% (15th percentile) and SSVC exploitation status of 'none' indicate low immediate exploitation likelihood.
Denial of service in gnome-remote-desktop as shipped in Red Hat Enterprise Linux 8, 9, and 10 lets an unauthenticated remote attacker exhaust server resources when the daemon runs in system mode with RDP enabled. Because the incoming connection handler bypasses the connection throttler, an attacker can open large numbers of parallel pre-authentication RDP connections, accumulating accepted sockets and pending routing-token operations until timeout and blocking legitimate RDP logins. There is no public exploit identified at time of analysis, and the flaw is specific to Red Hat's build - it does not affect the upstream project.
Information disclosure in 389 Directory Server (upstream of Red Hat Directory Server 11-13, shipped across RHEL 6-10) lets an unauthenticated remote attacker inject LDAP search filters into the CleanAllRUV replication status-check extended operation. Because the handler evaluates attacker-controlled filters against cn=config using elevated replication-plugin privileges and leaks a boolean match result, attackers can blindly enumerate sensitive configuration metadata such as replication bind DNs and password storage scheme details. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the network-reachable, no-authentication attack surface makes it a meaningful reconnaissance primitive.
Remote unauthenticated denial of service in 389 Directory Server (389-ds-base, shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) allows an attacker to crash the LDAP daemon by sending a crafted replication extended operation. The flaw is a stack buffer overflow in the RUV parsing path that triggers during payload decoding before any authorization check, so no credentials are needed. No public exploit identified at time of analysis; stack protectors constrain the outcome to a server crash rather than code execution.