Red Hat Openshift Serverless vulnerabilities

• red hat openshift pipelines, builds for red hat openshift, openshift serverless +2 more +4 more Pipelines-as-code: openshift-pipelines-operator-rh: pipelines-as-code: repository users can trigger namespace edit-equivalent execution via auto-provisioned pipeline serviceaccount CVE-2026-50240 8.8 HighNovember 6, 2026
• red hat exploit intelligence, openshift serverless, build of apache camel 4 for quarkus 3 +7 more +9 more Io.quarkus/quarkus-vertx-http: quarkus-vertx-http: authorization bypass in management interface via path concatenation flaw CVE-2026-107912 7.7 HighNovember 5, 2026
• red hat openshift serverless, openshift source-to-image (s2i), openshift container platform 4 +1 more +3 more Source-to-image: source-to-image: security boundary bypass via absolute symbolic link extraction CVE-2026-107174 6.4 MediumOctober 7, 2026
• red hat exploit intelligence, openshift serverless, build of apache camel 4 for quarkus 3 +8 more +10 more Quarkus-vertx-http: authorization bypass via path normalization discrepancy in quarkus http security CVE-2026-87743 7.5 HighSeptember 18, 2026
• fast-uri, red hat cluster observability operator 1.5.0, confidential compute attestation +49 more +51 more fast-uri vulnerable to host confusion via failed IDN canonicalization CVE-2026-13676 Fix available 7.5 HighJune 29, 2026
• fasterxml jackson-databind, red hat cryostat 4 on rhel 9, openshift developer tools and services +44 more +46 more jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray) CVE-2026-54513 Fix available 8.1 HighJune 23, 2026
• quarkus, red hat cryostat 4 on rhel 9, openshift serverless +15 more +17 more Authentication/Authorization Bypass via Advanced Path Normalization Vulnerabilities CVE-2026-50559 Fix available 7.5 HighJune 19, 2026
• go standard library crypto/x509, red hat assisted installer for red hat openshift container platform 2, cert manager support for red hat openshift release 1.19 +128 more +130 more Inefficient candidate hostname parsing in crypto/x509 CVE-2026-27145 Public exploitFix available 6.5 MediumJune 2, 2026
• golang crypto, golang.org/x/crypto golang.org/x/crypto/ssh, red hat assisted installer for red hat openshift container platform 2 +54 more +56 more Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh CVE-2026-46595 Public exploitFix available 10.0 CriticalMay 22, 2026
• golang crypto, golang.org/x/crypto golang.org/x/crypto/ssh/knownhosts, red hat assisted installer for red hat openshift container platform 2 +53 more +55 more Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts CVE-2026-42508 Fix available 9.1 CriticalMay 22, 2026
• golang crypto, golang.org/x/crypto golang.org/x/crypto/ssh, red hat assisted installer for red hat openshift container platform 2 +62 more +64 more Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh CVE-2026-39835 Fix available 5.3 MediumMay 22, 2026
• golang crypto, golang.org/x/crypto golang.org/x/crypto/ssh/agent, red hat assisted installer for red hat openshift container platform 2 +46 more +48 more Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent CVE-2026-39832 Fix available 9.1 CriticalMay 22, 2026
• golang crypto, golang.org/x/crypto golang.org/x/crypto/ssh, red hat assisted installer for red hat openshift container platform 2 +68 more +70 more Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh CVE-2026-39830 Fix available 9.1 CriticalMay 22, 2026
• golang crypto, golang.org/x/crypto golang.org/x/crypto/ssh, red hat assisted installer for red hat openshift container platform 2 +74 more +76 more Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh CVE-2026-39829 Fix available 7.5 HighMay 22, 2026
• golang crypto, golang.org/x/crypto golang.org/x/crypto/ssh, red hat assisted installer for red hat openshift container platform 2 +64 more +66 more Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh CVE-2026-39828 Fix available 6.3 MediumMay 22, 2026
• apache camel, red hat openshift serverless, build of apache camel 4 for quarkus 3 +4 more +6 more Apache Camel: Camel-CXF Message Header Injection via Missing Inbound Filtering CVE-2026-47323 Public exploitFix available EPSS 19.6% 9.8 CriticalMay 19, 2026
• io.opentelemetry opentelemetry-api, opentelemetry-extension-trace-propagators, open-telemetry opentelemetry-java +17 more +19 more opentelemetry-java: Unbounded Memory Allocation in W3C Baggage Propagation CVE-2026-45292 Fix available 5.3 MediumMay 14, 2026
• go standard library net/mail, golang go, red hat assisted installer for red hat openshift container platform 2 +108 more +110 more Quadratic string concatenation in consumePhrase in net/mail CVE-2026-42499 Fix available 7.5 HighMay 7, 2026
• go standard library net/mail, golang go, red hat assisted installer for red hat openshift container platform 2 +107 more +109 more Quadratic string concatentation in consumeComment in net/mail CVE-2026-39820 Fix available 7.5 HighMay 7, 2026
• go standard library net/http, golang go, http2 +106 more +108 more Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net CVE-2026-33814 Fix available 7.5 HighMay 7, 2026
• go standard library net, golang go, red hat assisted installer for red hat openshift container platform 2 +145 more +147 more Crash when handling long CNAME response in net CVE-2026-33811 Fix available 7.5 HighMay 7, 2026
• quarkus, red hat cryostat 4 on rhel 9, hawtio hawtio 4.4.0 +16 more +18 more Quarkus authorization bypass via semicolon path normalization inconsistency CVE-2026-39852 Fix available 8.8 HighMay 4, 2026
• apache camel, apache software foundation camel platform http main, red hat openshift serverless +7 more +9 more Apache Camel Platform HTTP Main: Authentication Bypass on Non-Root Context Paths in camel main runtime CVE-2026-40022 Public exploitFix available 8.2 HighApril 27, 2026
• apache camel, apache software foundation camel coap, camel google pubsub +10 more +12 more Apache Camel JMS, Apache Camel CoAP, Apache Camel Google PubSub: Incomplete fix for CVE-2025-27636 in non-HTTP HeaderFilterStrategies (camel-jms, camel-sjms, camel-coap, camel-google-pubsub) allows ca… CVE-2026-40453 Public exploitFix available 9.9 CriticalApril 27, 2026
• apache httpclient, red hat cryostat 4, migration toolkit for applications 8 +45 more +47 more Apache HttpClient: SCRAM-SHA-256 mutual authentication bypass may cause the client to accept authentication without proper mutual authentication verification CVE-2026-40542 Fix available 7.3 HighApril 22, 2026
• linuxfoundation tekton pipelines, tektoncd pipeline, red hat openshift lightspeed +8 more +10 more Tekton Pipelines: Git Resolver Unsanitized Revision Parameter Enables git Argument Injection Leading to RCE CVE-2026-40938 Fix available 7.5 HighApril 21, 2026
• apache kafka, red hat openshift serverless, build of apache camel 4 for quarkus 3 +16 more +18 more Apache Kafka: Missing JWT token validation in OAUTHBEARER authentication CVE-2026-33557 Fix available 9.1 CriticalApril 20, 2026
• go standard library crypto/x509, golang go, red hat assisted installer for red hat openshift container platform 2 +103 more +105 more Case-sensitive excludedSubtrees name constraints cause Auth Bypass in crypto/x509 CVE-2026-33810 Fix available 8.2 HighApril 7, 2026
• go standard library crypto/tls, golang go, red hat assisted installer for red hat openshift container platform 2 +117 more +119 more Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls CVE-2026-32283 Fix available 7.5 HighApril 7, 2026
• go standard library crypto/x509, golang go, red hat assisted installer for red hat openshift container platform 2 +140 more +142 more Unexpected work during chain building in crypto/x509 CVE-2026-32280 Fix available 7.5 HighApril 7, 2026
• go-jose, red hat assisted installer for red hat openshift container platform 2, cert-manager operator for red hat openshift +110 more +112 more Go JOSE affect by a panic in JWE decryption CVE-2026-34986 Fix available 7.5 HighApril 3, 2026
• lfprojects mcp go sdk, modelcontextprotocol go-sdk, red hat migration toolkit for virtualization +4 more +6 more Model Context Protocol Go SDK: DNS Rebinding Protection Disabled by Default for Servers Running on Localhost CVE-2026-34742 Fix available 7.6 HighApril 1, 2026
• codehaus-plexus plexus-utils, red hat cryostat 4, openshift developer tools and services +49 more +51 more Plexus-Utils has a Directory Traversal vulnerability in its extractFile method CVE-2025-67030 Fix available 8.8 HighMarch 25, 2026
• linuxfoundation tekton pipelines, tektoncd pipeline, red hat builds for red hat openshift +9 more +11 more Tekton Pipelines git resolver has path traversal that allows reading arbitrary files from the resolver pod CVE-2026-33211 Fix available 9.6 CriticalMarch 18, 2026
• grpc, grpc grpc-go, red hat assisted installer for red hat openshift container platform 2 +166 more +168 more gRPC-Go has an authorization bypass via missing leading slash in :path CVE-2026-33186 Public exploitFix available 9.1 CriticalMarch 18, 2026
• istio, red hat cert-manager operator for red hat openshift, externaldns operator +10 more +12 more Istio JWKS resolver to prevent private key material from being exposed when JWKS fetch fails. CVE-2026-31837 8.7 HighMarch 10, 2026
• go standard library net/url, golang go, red hat assisted installer for red hat openshift container platform 2 +143 more +145 more Incorrect parsing of IPv6 host literals in net/url CVE-2026-25679 Fix available 7.5 HighMarch 6, 2026
• go standard library crypto/x509, golang go, red hat assisted installer for red hat openshift container platform 2 +99 more +101 more Incorrect enforcement of email constraints in crypto/x509 CVE-2026-27137 Fix available 7.5 HighMarch 6, 2026
• docker compose, cli, command line interface +27 more +29 more Docker Desktop Docker Plugins Uncontrolled Search Path Element Local Privilege Escalation Vulnerability CVE-2025-15558 Fix available 7.0 HighMarch 4, 2026
• chainguard kaniko, red hat openshift serverless +1 more kaniko has tar archive path traversal in build context extraction allows writing files outside destination directory CVE-2026-28406 Fix available 8.2 HighFebruary 27, 2026
• lfprojects mcp go sdk, modelcontextprotocol go-sdk, red hat migration toolkit for virtualization +3 more +5 more MCP Go SDK Vulnerable to Improper Handling of Case Sensitivity CVE-2026-27896 Fix available 7.0 HighFebruary 26, 2026
• cli, red hat confidential compute attestation, cryostat 4 +32 more +34 more npm cli Incorrect Permission Assignment Local Privilege Escalation Vulnerability CVE-2026-0775 Fix available 7.0 HighJanuary 23, 2026
• isaacs node-tar, tar, red hat confidential compute attestation +37 more +39 more node-tar has Race Condition in Path Reservations via Unicode Ligature Collisions on macOS APFS CVE-2026-23950 Fix available 8.8 HighJanuary 20, 2026
• go standard library net/url, golang go, red hat assisted installer for red hat openshift container platform 2 +160 more +162 more Memory exhaustion in query parameter parsing in net/url CVE-2025-61726 Fix available 7.5 HighJanuary 16, 2026
• python urllib3, red hat assisted installer for red hat openshift container platform 2, cert-manager operator for red hat openshift 1.18 +105 more +107 more urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API) CVE-2026-21441 Fix available 8.9 HighJanuary 7, 2026
• red hat openshift serverless, build of apache camel - hawtio 4, build of apache camel 4 for quarkus 3 +29 more +31 more Undertow: outofmemory when parsing form data encoding with application/x-www-form-urlencoded CVE-2024-3884 Fix available 7.5 HighDecember 3, 2025
• red hat multicluster global hub, openshift serverless, advanced cluster management for kubernetes 2 +1 more +3 more Nx: nx/devkit: malicious versions of nx and plugins published to npm CVE-2025-10894 Public exploit 9.6 CriticalAugust 27, 2025
• red hat builds for red hat openshift, custom metric autoscaler operator for red hat openshift, multicluster global hub +24 more +26 more Github.com/cloudflare/circl: circl-fourq: missing and wrong validation can lead to incorrect results CVE-2025-8556 Fix available 3.7 LowJune 10, 2025
• red hat .net 6.0 on red hat enterprise linux, cryostat 3, logging subsystem for red hat openshift +52 more +54 more Npm-serialize-javascript: cross-site scripting (xss) in serialize-javascript CVE-2024-11831 Fix available 5.4 MediumJanuary 16, 2025
• red hat cert-manager operator for red hat openshift, cryostat 3, multicluster engine for kubernetes +5 more +7 more Cert-manager: potential dos when parsing specially crafted pem inputs CVE-2024-12401 Fix available 4.4 MediumNovember 20, 2024
• Show olderLoading…