Skip to contentRed Hat Multicluster Global Hub vulnerabilities
- red hat multicluster global hubMulticluster-global-hub-operator-bundle: operator serviceaccount granted unrestricted impersonation of users, groups and serviceaccounts cluster-wideCVE-2026-1107447.2 High
- red hat multicluster global hubPostgres-exporter: net/http/pprof exposed on metrics listenerCVE-2026-835507.1 High
- red hat multicluster global hub 1.4.9, multicluster global hub 1.5.8, multicluster global hub 1.6.6 +9 more +11 moreMulticloud-operators-subscription: multicloud-operators-subscription: isclusteradmin() trusts user-settable annotations on managed clustersCVE-2026-667929.9 Critical
- red hat multicluster global hub 1.4.9, multicluster global hub 1.5.8, multicluster global hub 1.6.6 +2 more +4 moreMulticluster-global-hub: multicluster-global-hub: spec-topic read acl leaks bootstrap kubeconfigs to all managed hubs during migrationCVE-2026-715776.3 Medium
- red hat multicluster global hub 1.4.9, multicluster global hub 1.5.8, multicluster global hub 1.6.6 +2 more +4 moreMulticluster-global-hub: multicluster-global-hub: manager trusts self-asserted evt.source() for leaf-hub identity in all status handlersCVE-2026-715768.5 High
- go standard library crypto/x509, red hat assisted installer for red hat openshift container platform 2, cert manager support for red hat openshift release 1.19 +128 more +130 moreInefficient candidate hostname parsing in crypto/x509CVE-2026-27145Public exploitFix available6.5 Medium
- docker engine, moby docker engine, docker docker/daemon +20 more +22 moreDocker: `PUT /containers/{id}/archive` executes container binary on the hostCVE-2026-41567Public exploitFix available7.2 High
- hamba avro, red hat cryostat 4 on rhel 9, multicluster global hub 1.4.5 +11 more +13 moreiskorotkov/avro: CPU Exhaustion in Avro DecoderCVE-2026-46385Fix available8.7 High
- hamba avro, red hat cryostat 4 on rhel 9, multicluster global hub 1.4.5 +11 more +13 moreiskorotkov/avro: Integer Overflow in Avro DecoderCVE-2026-46384Fix available8.7 High
- go standard library net/mail, golang go, red hat assisted installer for red hat openshift container platform 2 +108 more +110 moreQuadratic string concatenation in consumePhrase in net/mailCVE-2026-42499Fix available7.5 High
- go standard library net/mail, golang go, red hat assisted installer for red hat openshift container platform 2 +107 more +109 moreQuadratic string concatentation in consumeComment in net/mailCVE-2026-39820Fix available7.5 High
- go standard library net/http, golang go, http2 +106 more +108 moreInfinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/netCVE-2026-33814Fix available7.5 High
- go standard library net, golang go, red hat assisted installer for red hat openshift container platform 2 +145 more +147 moreCrash when handling long CNAME response in netCVE-2026-33811Fix available7.5 High
- apache thrift, red hat cryostat 4 on rhel 9, multicluster global hub +24 more +26 moreApache Thrift: TSSLTransportFactory.java hostname verificationCVE-2026-43869Fix available7.3 High
- prometheus, red hat file integrity operator, logging for red hat openshift 6 +53 more +55 morePrometheus: remote read endpoint allows denial of service via crafted snappy payloadCVE-2026-42154Public exploitFix available7.5 High
- prometheus, red hat custom metric autoscaler operator for red hat openshift, file integrity operator +52 more +54 morePrometheus Azure AD remote write OAuth client secret exposed via config APICVE-2026-42151Fix available7.5 High
- qt, qt qtdeclarative, red hat multicluster global hub +10 more +12 morePossible QML code injection in VectorImage componentCVE-2025-14576Fix available7.4 High
- apache thrift, red hat multicluster global hub 1.3.4, multicluster global hub 1.4.5 +12 more +14 moreApache Thrift: C++ JSON OOB readCVE-2026-41607Fix available6.5 Medium
- apache thrift, red hat multicluster global hub 1.3.4, multicluster global hub 1.4.5 +12 more +14 moreApache Thrift: c_glib dispatch stack overflowCVE-2026-41606Fix available5.3 Medium
- apache thrift, red hat multicluster global hub 1.3.4, multicluster global hub 1.4.5 +12 more +14 moreApache Thrift: Swift Compact Protocol integer overflowCVE-2026-41605Fix available7.3 High
- apache thrift, red hat multicluster global hub 1.3.4, multicluster global hub 1.4.5 +12 more +14 moreApache Thrift: Swift Range crash in skip()CVE-2026-41604Fix available8.2 High
- apache thrift, red hat multicluster global hub, multicluster global hub 1.3.4 +17 more +19 moreApache Thrift: Go TFramedTransport uint32 overflowCVE-2026-41602Fix available7.5 High
- apache thrift, red hat cryostat 4 on rhel 9, multicluster global hub +16 more +18 moreApache Thrift: Specially crafted input can crash a c_glib Thrift server with invalid pointer error.CVE-2025-48431Fix available7.5 High
- grafana tempo, enterprise traces (get), red hat logging subsystem for red hat openshift +13 more +15 moreTempo query limit results in unbounded memory allocationCVE-2026-21728Fix available7.5 High
- grafana pyroscope, red hat multicluster global hub, multicluster global hub 1.7.0 +5 more +7 moreSensitive COS `SecretKey` exposed in plaintext via configuration API due to missing type protectionCVE-2025-41118Fix available9.1 Critical
- openfga, red hat multicluster global hub 1.7.0, advanced cluster management for kubernetes 2.14 +3 more +5 moreOpenFGA Playground Preshared Key ExposureCVE-2026-40293Fix available6.5 Medium
- go standard library crypto/x509, golang go, red hat assisted installer for red hat openshift container platform 2 +103 more +105 moreCase-sensitive excludedSubtrees name constraints cause Auth Bypass in crypto/x509CVE-2026-33810Fix available8.2 High
- go standard library crypto/tls, golang go, red hat assisted installer for red hat openshift container platform 2 +117 more +119 moreUnauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tlsCVE-2026-32283Fix available7.5 High
- go standard library crypto/x509, golang go, red hat assisted installer for red hat openshift container platform 2 +140 more +142 moreUnexpected work during chain building in crypto/x509CVE-2026-32280Fix available7.5 High
- jackc pgx, github.com/jackc/pgx/v5 github.com/jackc/pgx/v5/pgproto3, red hat cryostat 4 on rhel 9 +29 more +31 moreCVE-2026-33816 in github.com/jackc/pgxCVE-2026-33816Fix available9.8 Critical
- jackc pgx, github.com/jackc/pgx/v5 github.com/jackc/pgx/v5/pgproto3, red hat cryostat 4 on rhel 9 +28 more +30 moreCVE-2026-33815 in github.com/jackc/pgxCVE-2026-33815Fix available9.8 Critical
- go-jose, red hat assisted installer for red hat openshift container platform 2, cert-manager operator for red hat openshift +110 more +112 moreGo JOSE affect by a panic in JWE decryptionCVE-2026-34986Fix available7.5 High
- moby, docker engine, red hat multicluster engine for kubernetes +7 more +9 moreMoby: Off-by-one error in plugin privilege validationCVE-2026-33997Fix available6.8 Medium
- linuxfoundation nats-server, red hat multicluster global hub 1.4.5, multicluster global hub 1.6.5 +2 more +4 moreNATS: Pre-auth remote server crash via WebSocket frame length overflow in wsReadCVE-2026-27889Fix available7.5 High
- linuxfoundation nats-server, red hat multicluster global hub 1.4.5, multicluster global hub 1.6.5 +2 more +4 moreNATS is vulnerable to pre-auth DoS through WebSockets client serviceCVE-2026-33219Fix available5.3 Medium
- linuxfoundation nats-server, red hat multicluster global hub 1.4.5, multicluster global hub 1.6.5 +2 more +4 moreNATS has pre-auth server panic via leafnode handlingCVE-2026-33218Fix available7.5 High
- linuxfoundation nats-server, red hat multicluster global hub 1.4.5, multicluster global hub 1.6.5 +2 more +4 moreNATS allows MQTT clients to bypass ACL checksCVE-2026-33217Fix available7.1 High
- linuxfoundation nats-server, red hat multicluster global hub 1.4.5, multicluster global hub 1.6.5 +2 more +4 moreNATS has MQTT plaintext password disclosureCVE-2026-33216Fix available8.6 High
- linuxfoundation nats-server, red hat multicluster global hub 1.4.5, multicluster global hub 1.6.5 +2 more +4 moreNATS Server panic via malicious compression on leafnode portCVE-2026-29785Fix available7.5 High
- linuxfoundation nats-server, red hat multicluster global hub 1.4.5, multicluster global hub 1.6.5 +2 more +4 moreNATS credentials are exposed in monitoring port via command-line argvCVE-2026-33247Fix available7.4 High
- goxmldsig project goxmldsig, red hat multicluster global hub 1.3.4, multicluster global hub 1.4.5 +10 more +12 moregoxmldsig has validateSignature Loop Variable Capture Signature BypassCVE-2026-33487Fix available7.5 High
- grpc, grpc grpc-go, red hat assisted installer for red hat openshift container platform 2 +166 more +168 moregRPC-Go has an authorization bypass via missing leading slash in :pathCVE-2026-33186Public exploitFix available9.1 Critical
- github.com/buger/jsonparser, jsonparser project jsonparser, red hat cluster observability operator 1.5.0 +17 more +19 moreDenial of service in github.com/buger/jsonparserCVE-2026-32285Fix available7.5 High
- github.com/jackc/pgproto3/v2, jackc pgproto3, red hat assisted installer for red hat openshift container platform 2 +26 more +28 moreDenial of service in github.com/jackc/pgproto3/v2CVE-2026-32286Public exploitFix available7.5 High
- go standard library net/url, golang go, red hat assisted installer for red hat openshift container platform 2 +143 more +145 moreIncorrect parsing of IPv6 host literals in net/urlCVE-2026-25679Fix available7.5 High
- go standard library crypto/x509, golang go, red hat assisted installer for red hat openshift container platform 2 +99 more +101 moreIncorrect enforcement of email constraints in crypto/x509CVE-2026-27137Fix available7.5 High
- docker compose, cli, command line interface +27 more +29 moreDocker Desktop Docker Plugins Uncontrolled Search Path Element Local Privilege Escalation VulnerabilityCVE-2025-15558Fix available7.0 High
- grafana, grafana grafana/grafana, grafana/grafana-enterprise +12 more +14 moreDashboard Permissions Scope Bypass Enables Cross‑Dashboard Privilege EscalationCVE-2026-21721Public exploitFix available8.1 High
- go standard library net/url, golang go, red hat assisted installer for red hat openshift container platform 2 +160 more +162 moreMemory exhaustion in query parameter parsing in net/urlCVE-2025-61726Fix available7.5 High
- python urllib3, red hat assisted installer for red hat openshift container platform 2, cert-manager operator for red hat openshift 1.18 +105 more +107 moreurllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)CVE-2026-21441Fix available8.9 High
- Show moreLoading…