Skip to contentRed Hat Openshift vulnerabilities
- red hat cert manager support for red hat openshift release 1.20, cost management on-premise 1, enterprise linux 10 +22 more +24 moreLibxml2: double-free/uaf in libxml2 python bindingsCVE-2026-74860Fix available8.5 High
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +6 more +8 moreGlib2: toctou symlink race in `g_file_create_replace_destination` fallback pathCVE-2026-864695.3 Medium
- red hat openshift ai (rhoai), openshift ai 2.25, openshift ai 3.5 +2 moreOdh-dashboard: odh-dashboard: nim credential secret readable by any authenticated userCVE-2026-863326.5 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +5 more +7 morePolkit: regression in cve-2026-4897 fix (polkit read_cookie()) - stack buffer underflowCVE-2026-85498Fix available3.5 Low
- red hat enterprise linux 10, enterprise linux 7, enterprise linux 8 +3 more +5 moreCorosync: corosync: integer overflow in check_memb_commit_token_sanity may bypass message length validation on 32-bit systemsCVE-2026-816666.5 Medium
- red hat enterprise linux 10, enterprise linux 10.0 extended update support, enterprise linux 7 extended lifecycle support +13 more +15 moreCorosync: corosync: heap-based buffer overflow in totempg assembly buffer during fragmented message reassemblyCVE-2026-81665Fix available7.5 High
- red hat ansible automation platform 2, enterprise linux 10, enterprise linux 7 +4 more +6 moreJwcrypto: jwcrypto: general json jws kid binding bypass during jwkset verificationCVE-2026-841855.9 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +4 more +6 moreRpm: command injection in `rpmbuild -t*` (`gettarspec`) via unescaped tarball pathCVE-2026-84837Fix available7.8 High
- red hat enterprise linux 10, enterprise linux 7, enterprise linux 8 +3 more +5 moreUtil-linux: util-linux: x-mount.subdir detached-tree resolution can escape via intermediate symlinksCVE-2026-78409Fix available7.0 High
- red hat cost management on-premise 1, enterprise linux 10, enterprise linux 7 +5 more +7 moreUtil-linux: util-linux: restricted bind mounts do not pin the source, allowing x-mount.owner/group/mode redirectionCVE-2026-78410Fix available7.8 High
- red hat cost management on-premise 1, enterprise linux 10, enterprise linux 7 +5 more +7 moreUtil-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authorityCVE-2026-78408Fix available7.9 High
- red hat openshift container platform 4.13, openshift container platform 4.14, openshift container platform 4.15 +8 more +10 moreOpenshift/oauth-server: openshift/oauth-server: quadratic-time dos via accept-language header underscore bypass on unauthenticated login endpointsCVE-2026-493297.5 High
- red hat cost management on-premise 1, enterprise linux 10, enterprise linux 10.0 extended update support +18 more +20 moreGdb: gdb: out-of-bounds write in stabs parser read_member_functions() via crafted elfCVE-2026-13732Fix available7.0 High
- red hat enterprise linux 10, enterprise linux 7, enterprise linux 8 +7 more +9 moreLibsolv: libsolv: out-of-bounds write in repo_write() via unvalidated directory id from vertical/paged .solv filelist dataCVE-2026-82327Fix available5.5 Medium
- red hat enterprise linux ai (rhel ai) 3, openshift ai (rhoai) +1 moreFfmpeg: ffmpeg: heap buffer overflow in tdsc_load_cursor() via cur_fmt_mono cursorCVE-2026-18393Fix available5.4 Medium
- red hat ansible automation platform 2, enterprise linux 10, enterprise linux 9 +2 more +4 moreJwcrypto: jwcrypto: denial of service via malformed jwe tokensCVE-2026-801795.9 Medium
- red hat openshift container platform 4Cri-o: cri-o: unvalidated image env var causes daemon crashCVE-2026-171136.0 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +5 more +7 moreNetworkmanager: networkmanager: 802-1x ca-path and phase2-ca-path bypass private_user restriction, allowing wpa-enterprise server validation bypass (incomplete fix for cve-2025-9615)CVE-2026-19685Fix available7.1 High
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +4 more +6 moreRpm: rpmbuild gettarspec() crafted tar member name → macro injectionCVE-2026-78367Fix available7.0 High
- red hat openshift container platform 4, openshift container platform 5 +1 moreKata-containers: insufficient validation of createcontainer mount and storage rules in genpolicyCVE-2026-77176Fix available8.1 High
- rpm-software-management popt, red hat enterprise linux 10, enterprise linux 6 +7 more +9 morePopt-devel: popt-static: short realloc in poptconfigfiletostringCVE-2026-18743Fix available2.5 Low
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +3 more +5 moreLibsoup: libsoup: integer truncation in sort_ranges() comparator causes silent omission of http range responsesCVE-2026-77014Fix available5.3 Medium
- red hat enterprise linux 10, enterprise linux 7, enterprise linux 8 +2 more +4 moreCockpit-ws: cockpit: cockpit-ws: unauthenticated remote memory leak via cockpitlang cookie in send_login_htmlCVE-2026-76235Fix available7.5 High
- red hat multicluster global hub 1.4.9, multicluster global hub 1.5.8, multicluster global hub 1.6.6 +9 more +11 moreMulticloud-operators-subscription: multicloud-operators-subscription: isclusteradmin() trusts user-settable annotations on managed clustersCVE-2026-667929.9 Critical
- red hat openshift ai 3.4Models-as-a-service: red hat openshift ai: maas-api and maas-controller serviceaccounts with excessive permissions lead to privilege escalationCVE-2026-152187.9 High
- redhat quay, red hat openshift update service, quay 3 +2 moreQuay: ssrf via build archive_url in quay build apiCVE-2026-742474.2 Medium
- redhat quay, red hat openshift update service, quay 3 +2 moreQuay: unauthenticated exported logs download in quayCVE-2026-742455.9 Medium
- redhat quay, red hat openshift update service, quay 3 +2 moreQuay: stripe webhook accepts forged events without signature verification in quayCVE-2026-742445.9 Medium
- redhat quay, red hat openshift update service, quay 3 +2 moreQuay: unauthenticated secscan notification endpoint in quay when psk is unsetCVE-2026-742436.5 Medium
- redhat quay, red hat openshift update service, quay 3 +2 moreQuay: repository notification uuid idor in quay apiCVE-2026-742425.3 Medium
- redhat quay, red hat openshift update service, quay 3 +2 moreQuay: ldap referral filter injection in quay external ldap authenticationCVE-2026-742414.8 Medium
- redhat quay, red hat openshift update service, quay 3 +2 moreQuay: jwt claim validation bypasses in quay federated robot and sso authenticationCVE-2026-742405.4 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +7 more +9 moreLibdm: lvm2: libdm: denial of service via uncontrolled recursion in config parserCVE-2026-19617Fix available5.5 Medium
- red hat ansible automation platform 2, enterprise linux 10, enterprise linux 8 +7 more +9 morePodman: podman: quadlet install --replace non-truncating write retains removed host-access directivesCVE-2026-19730Fix available4.2 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +8 more +10 moreBinutils: binutils: multiple use-after-free in add_archive_element via lto plugin processingCVE-2026-19548Fix available5.5 Medium
- red hat openshift container platform 4Ose-oauth-server: oauth-server: open redirect vulnerability enables phishing via unvalidated parameter.CVE-2026-190784.3 Medium
- red hat openshift container platform 4.14, openshift container platform 4.15, openshift container platform 4.16 +6 more +8 moreOpenshift/console: authenticated ssrf with full response reflection and path neutralization via dev console webhook helpers in openshift consoleCVE-2026-502367.4 High
- red hat openshift container platform 4.12, openshift container platform 4.13, openshift container platform 4.14 +8 more +10 moreOpenshift/console: namespace tenant ssrf with egress bypass, catalog poisoning, and admin-mediated supply chain escalation via projecthelmchartrepository in openshift consoleCVE-2026-502377.4 High
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +6 more +8 moreKbd: local privilege escalation in openvt via incorrect process owner verification allowing passwordless root loginCVE-2026-72693Fix available7.8 High
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +5 more +7 moreQemu-kvm: vhost inflight migration vmstate integer type mismatch causes out-of-bounds accessCVE-2026-6426Fix available4.4 Medium
- red hat openshift ai 2.25, openshift ai 3.3, openshift ai 3.4 +1 more +3 moreData-sciences-pipeline: user-controlled serviceaccount for workflow pods without authorization check — confused deputyCVE-2026-186207.1 High
- red hat openshift ai 2.25, openshift ai 3.3, openshift ai 3.4 +1 more +3 moreMl-metdata: bundled grpc 1.46.3 (2022) with published http/2 dos cves — directly reachable on listenerCVE-2026-186187.5 High
- red hat openshift ai 2.25, openshift ai 3.3, openshift ai 3.4 +1 more +3 moreData-science-pipelines-operator: dspo: cryptographically weak secret generation (math/rand) for db and s3 credentialsCVE-2026-186117.5 High
- red hat openshift ai 2.25, openshift ai 3.3, openshift ai 3.4 +1 more +3 moreOdh-training-operator-rhel9: rhoai fork aggregates training job create onto native edit/admin clusterrolesCVE-2026-189828.8 High
- red hat openshift ai 3.3, openshift ai 3.4, openshift ai 3.5 +2 moreOdh-training-operator-rhel9: [trainer v2 security] trn-02: rhoai overlay aggregates trainjobs crud into standard edit clusterroleCVE-2026-189518.8 High
- red hat openshift ai (rhoai), openshift ai 2.25, openshift ai 3.3 +1 more +3 moreOdh-dashboard: odh-dashboard: confused-deputy privilege escalation via unchecked roleref in rolebinding creationCVE-2026-189508.8 High
- red hat openshift ai 2.25, openshift ai 3.3, openshift ai 3.4 +2 moreOdh-dashboard: odh-dashboard: clusterrole grants cluster-wide crud on secrets and rbac management resourcesCVE-2026-189498.8 High
- red hat openshift ai (rhoai), openshift ai 2.25, openshift ai 3.3 +1 more +3 moreFeast: feast: unsafe dill deserialization of registry-stored udfs — rce on feature server and registry serverCVE-2026-18948Fix available9.9 Critical
- red hat openshift ai (rhoai), openshift ai 2.25, openshift ai 3.3 +1 more +3 moreFeast: feast: authorization bypass in /materialize endpoints enables dos via unauthorized full re-materializationCVE-2026-189478.5 High
- red hat openshift ai (rhoai), openshift ai 2.25, openshift ai 3.4 +2 moreFeast-operator: feast: feast apply cronjob runs user python with feature-server sa — tenant code to sa token escalationCVE-2026-189425.5 Medium
- Show moreLoading…