Skip to contentRed Hat Openshift vulnerabilities
- red hat openshift ai (rhoai), openshift ai 2.25, openshift ai 3.3 +1 more +3 moreFeast: feast-operator: feast: default authentication mode is no_auth — shared multi-tenant instances deployed without authenticationCVE-2026-189417.7 High
- red hat ai inference server, openshift ai 2.25, openshift ai 3.3 +1 more +3 moreData-sciences-pipeline: dsp: v1 argo template path accepts arbitrary workflow spec, bypassing all v2 security hardeningCVE-2026-186217.6 High
- red hat openshift ai 2.25, openshift ai 3.3, openshift ai 3.4 +1 more +3 moreData-science-pipelines-operator: dspo: mysql dsn parameter injection via customextraparams enables local infile file exfiltration from operator podCVE-2026-186178.8 High
- red hat openshift ai 2.25, openshift ai 3.3, openshift ai 3.4 +1 more +3 moreData-science-pipelines-operator: dspo: operator clusterrole grants pods/exec:*, kubeflow.org */*, and clusterrole/binding crud cluster-wideCVE-2026-186088.7 High
- red hat openshift ai 2.25, openshift ai 3.3, openshift ai 3.4 +2 moreOdh-model-controller: odh-model-controller: cross-namespace secret read via nim account crd confused deputyCVE-2026-164566.5 Medium
- red hat openshift ai 2.25, openshift ai 3.3, openshift ai 3.4 +1 more +3 moreTrustyai-service-operator: trustyai-service-operator: tas internal service bypasses kube-rbac-proxy, exposing unauthenticated quarkus api cluster-wideCVE-2026-155818.0 High
- red hat openshift ai 2.25, openshift ai 3.3, openshift ai 3.4 +1 more +3 moreTrustyai-service-operator: trustyai-service-operator: lmevaljob sidecar containers bypass protected environment variable filtering, allowing trust_remote_code policy overrideCVE-2026-154678.1 High
- red hat openshift ai (rhoai), openshift ai 3.4 +1 moreMaas-billing: maas api: privilege escalation via forged http headers due to missing authenticationCVE-2026-144509.9 Critical
- red hat openshift ai (rhoai), openshift ai 3.4 +1 moreRhoai maas: llm-d: maas/llm-d inference gateway: default allowedroutes.namespaces.from: all allows namespace users to hijack shared model-serving traffic (tokens, prompts, outputs)CVE-2026-137178.8 High
- red hat enterprise linux 10, enterprise linux 10.0 extended update support, enterprise linux 6 extended lifecycle support - extension +25 more +27 moreDracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die()CVE-2026-15816Fix available7.5 High
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +4 more +6 moreP11-kit: integer overflow in rpc attribute-array length calculation can under-allocate nested attribute storage on 32 bit systemsCVE-2026-18938Fix available6.2 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +5 more +7 morePolicycoreutils: policycoreutils: toctou race condition in fixfiles allows arbitrary selinux label manipulationCVE-2026-19079Fix available4.4 Medium
- rpm-software-management popt, red hat enterprise linux 10, enterprise linux 6 +7 more +9 morePopt-devel: popt-static: size_t underflow in singleoptionhelpCVE-2026-18839Fix available2.2 Low
- red hat openshift container platform 4Openshift/oauth-proxy: openshift/oauth-proxy: unauthenticated identity header injection on whitelisted pathsCVE-2026-493316.5 Medium
- smuellerdd libkcapi, red hat enterprise linux 10, enterprise linux 10.0 extended update support +8 more +10 moreLibkcapi: infinite loop denial of service in libkcapi _kcapi_aio_read_all() due to unhandled io_getevents() timeout returnCVE-2026-71227Fix available5.1 Medium
- smuellerdd libkcapi, red hat enterprise linux 10, enterprise linux 10.0 extended update support +11 more +13 moreLibkcapi: memory corruption via uncanceled aio requests on error in libkcapi's one-shot aio pathCVE-2026-71226Fix available7.3 High
- smuellerdd libkcapi, red hat enterprise linux 10, enterprise linux 10.0 extended update support +8 more +10 moreLibkcapi: iv reuse in libkcapi one-shot symmetric cipher chunking causes cipher state reset across chunk boundariesCVE-2026-71225Fix available6.5 Medium
- fedoraproject sssd, red hat enterprise linux 10, enterprise linux 6 +7 more +9 moreSssd: sssd: pam responder out-of-bounds read via unchecked auth_token_length in protocol v1CVE-2026-68743Fix available5.5 Medium
- rpm-software-management popt, red hat enterprise linux 10, enterprise linux 6 +7 more +9 morePopt-devel: popt-static: off-by-one in poptstuffargsCVE-2026-18739Fix available2.5 Low
- fedoraproject sssd, red hat enterprise linux 10, enterprise linux 6 +7 more +9 moreSssd: sssd: nss responder uninitialized heap disclosure in initgroups replyCVE-2026-68744Fix available3.3 Low
- gnu tar, red hat discovery 2, enterprise linux 10 +10 more +12 moreTar: tar: toctou in incremental dumpdir 'x' rename handling allows restore path escapeCVE-2026-18477Fix available4.4 Medium
- gnu tar, red hat discovery 2, enterprise linux 10 +10 more +12 moreTar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwriteCVE-2026-18508Fix available4.4 Medium
- fedoraproject sssd, red hat enterprise linux 10, enterprise linux 6 +7 more +9 moreSssd: sssd: nss responder out-of-bounds read via unchecked addrlen in gethostbyaddrCVE-2026-68742Fix available5.5 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +4 more +6 morePcp: pcp: arbitrary file creation via path traversal in pmproxy logger servletCVE-2026-16531Fix available5.3 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +4 more +6 morePcp: pcp: remote denial of service and information leakageCVE-2026-16530Fix available6.5 Medium
- red hat enterprise linux 10, enterprise linux 10.0 extended update support, enterprise linux 6 +14 more +16 morePcp: pcp: denial of service due to signed integer overflowCVE-2026-16529Fix available7.5 High
- red hat enterprise linux 10, enterprise linux 10.0 extended update support, enterprise linux 6 +14 more +16 morePcp: pcp pmproxy: unauthenticated access to /store endpoint allows bypassing pmcd access rulesCVE-2026-16527Fix available7.3 High
- red hat enterprise linux 10, enterprise linux 10.0 extended update support, enterprise linux 6 +14 more +16 morePcp: pcp: privilege escalation to root via linux_sockets pmda vulnerabilityCVE-2026-16526Fix available8.8 High
- red hat enterprise linux 10, enterprise linux 10.0 extended update support, enterprise linux 6 +14 more +16 morePcp: pcp linux_sockets pmda: arbitrary command execution via command injectionCVE-2026-16524Fix available7.8 High
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +4 more +6 moreBinutils: binutils: out-of-bounds write in bfd dlx elf backend relocation processingCVE-2026-18220Public exploit7.8 High
- red hat enterprise linux 10, enterprise linux 7, enterprise linux 8 +3 more +5 moreCriu: criu: container escape via rseq critical section hijack during checkpoint/restoreCVE-2026-18107Public exploitFix available7.8 High
- red hat enterprise linux 10, enterprise linux 10.0 extended update support, enterprise linux 6 +24 more +26 moreSg3_utils: sg3_utils: arbitrary command execution via udev property injection in sg_inq --exportCVE-2026-16313Fix available7.6 High
- red hat openshift container platform 4.12, openshift container platform 4.13, openshift container platform 4.14 +8 more +10 moreOpenshift/oauth-proxy: openshift/oauth-proxy: underscore header smuggling enables identity impersonation on wsgi/php upstreamsCVE-2026-493328.5 High
- samba, red hat ceph storage 9.2, enterprise linux 10 +7 more +9 moreSamba: ctdb fails to do integrity checking of received packetsCVE-2026-58224Fix available6.5 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +3 more +5 moreSamba: samba ad ldap compare filter injection and trusted-request confusion disclose protected attributesCVE-2026-58222Public exploitFix available8.8 High
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +3 more +5 moreSamba: dns signing dos via tkey name cache exhaustionCVE-2026-58218Fix available5.3 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +3 more +5 moreSamba: kpasswd service: kpasswd packet that contains malformed asn.1 might cause the server to access 6 bytes of unallocated memory leading server to crashCVE-2026-58216Fix available5.3 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +6 more +8 moreBinutils: gnu binutils: heap-buffer-overflow in linker leads to information disclosure and denial of serviceCVE-2026-15003Fix available5.6 Medium
- red hat container native virtualization 4.14, container native virtualization 4.16, container native virtualization 4.17 +6 more +8 moreVirt-cdi-operator: containerized-data-importer: cdi.kubevirt.io:view aggregated clusterrole grants create on datavolumes/source, allowing unauthorized pvc cloneCVE-2026-175277.7 High
- red hat enterprise linux 10, enterprise linux 9, hardened images +3 more +5 moreDbus-broker: dbus-broker: session bus denial of service via emfile during peer setupCVE-2026-16730Fix available5.5 Medium
- red hat openshift update service, quay 3 +1 moreQuay: ssrf in red hat quay notification webhooks (slack/generic)CVE-2026-169105.5 Medium
- red hat openshift ai 2.25, openshift ai 3.3, openshift ai 3.4 +2 moreOdh-dashboard: odh-dashboard: backend port 8080 trusts x-forwarded-access-token without origin validationCVE-2026-167458.8 High
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +4 more +6 moreNano: gnu nano: arbitrary memory writes, information disclosure, or denial of service via format string vulnerability in error handling.CVE-2026-6390Fix available6.8 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +5 more +7 moreLibarchive: libarchive: signed integer overflow in archive_write_zip_headerCVE-2026-16517Fix available2.9 Low
- red hat enterprise linux 10, enterprise linux 8, enterprise linux 9 +2 more +4 moreRpcbind: rpcbind: stack buffer overflow in rpcinfo rpcbdump() short-mode version-list formattingCVE-2026-16461Fix available6.5 Medium
- red hat enterprise linux 10, enterprise linux 8, enterprise linux 9 +2 more +4 moreKronosnet: kronosnet: access control list bypass via link id spoofing on unencrypted dynamic linksCVE-2026-15812Fix available4.8 Medium
- red hat enterprise linux 10, enterprise linux 8, enterprise linux 9 +2 more +4 moreKronosnet: kronosnet: encryption key exposure in memory after cryptographic configuration changesCVE-2026-15811Fix available5.8 Medium
- red hat mirror registry for red hat openshift 2, quay 3.10, quay 3.12 +5 more +7 moreQuay: mirror-registry: ssrf: repo-level mirror accepts external_reference without url validationCVE-2026-159276.8 Medium
- red hat enterprise linux 10, enterprise linux 8, enterprise linux 9 +2 more +4 moreRpcbind: rpcbind: stack buffer overflow in rpcinfo rpcbaddrlist()CVE-2026-16277Fix available6.5 Medium
- red hat cert manager support for red hat openshift release 1.17, cert manager support for red hat openshift release 1.18, cert manager support for red hat openshift release 1.19 +29 more +31 moreGdbusserver: glib2: gdbusserver pre-authentication dos via unbounded sasl line bufferingCVE-2026-15588Fix available5.3 Medium
- Show moreLoading…