Red Hat Pipelines vulnerabilities

• red hat openshift pipelines, builds for red hat openshift, openshift serverless +2 more +4 more Pipelines-as-code: openshift-pipelines-operator-rh: pipelines-as-code: repository users can trigger namespace edit-equivalent execution via auto-provisioned pipeline serviceaccount CVE-2026-50240 8.8 HighNovember 6, 2026
• kubeflow pipelines Kubeflow Pipelines: Cross-tenant execution-cache poisoning / output substitution via a namespace-blind cache key in the cache webhook (multi-user) CVE-2026-88982 Fix available 5.4 MediumNovember 5, 2026
• kubeflow pipelines Kubeflow Pipelines API server lacks authorization for shared pipeline uploads CVE-2026-77596 Fix available 9.6 CriticalNovember 5, 2026
• kubeflow pipelines Kubeflow Pipelines: Unauthenticated SSRF through artifact provider endpoints CVE-2026-88981 8.6 HighNovember 5, 2026
• kubeflow pipelines Kubeflow Pipelines: Unauthenticated server-side request forgery in the frontend http/https artifact source via decimal-IP bypass of the bucket validator CVE-2026-88980 8.6 HighNovember 5, 2026
• kubeflow pipelines Kubeflow Pipelines: Unauthenticated SSRF vulnerability in Kubeflow Pipelines TensorBoard proxy CVE-2026-88979 5.8 MediumNovember 5, 2026
• kubeflow pipelines Kubeflow Pipelines: RBAC bypass on shared pipelines allows any authenticated user to delete or modify global pipelines CVE-2026-88984 Fix available 7.2 HighNovember 5, 2026
• kubeflow pipelines Kubeflow Pipelines: Reflected XSS in the frontend pod information and events error responses CVE-2026-88986 Fix available 6.1 MediumNovember 5, 2026
• kubeflow pipelines Kubeflow Pipelines: SQL injection through unvalidated pagination tokens in Kubeflow Pipelines API server CVE-2026-88985 Fix available 6.5 MediumNovember 5, 2026
• kubeflow pipelines Kubeflow Pipelines — API server fetches a caller-supplied pipelineURL without host validation CVE-2026-88983 Fix available 5.0 MediumNovember 5, 2026
• kubeflow pipelines Kubeflow Pipelines: Pipeline archive upload allows decompression bomb to exhaust server memory CVE-2026-118761 Fix available 7.5 HighOctober 29, 2026
• kubeflow pipelines Kubeflow Pipelines: Missing namespace authorization permits cross-tenant artifact reads CVE-2026-118760 6.5 MediumOctober 29, 2026
• kubeflow pipelines Kubeflow Pipelines: Run log streaming endpoint bypasses namespace authorization, exposing pod execution logs cross-tenant CVE-2026-118759 Fix available 7.5 HighOctober 29, 2026
• kubeflow pipelines Kubeflow: Unauthenticated path traversal to arbitrary file read on ml-pipeline-ui via the volume artifact source CVE-2026-118758 7.5 HighOctober 29, 2026
• kubeflow pipelines Kubeflow Pipelines: Unauthenticated SSRF and HTTP smuggling in Kubeflow Pipelines frontend /_proxy/ route, bypasses ENABLE_AUTHZ=true CVE-2026-54745 10.0 CriticalAugust 28, 2026
• fast-uri, red hat cluster observability operator 1.5.0, confidential compute attestation +49 more +51 more fast-uri vulnerable to host confusion via failed IDN canonicalization CVE-2026-13676 Fix available 7.5 HighJune 29, 2026
• nodejs undici, red hat cluster observability operator 1.5.0, cryostat 4 +25 more +27 more undici WebSocket client vulnerable to denial of service via fragment count bypass CVE-2026-12151 Fix available 7.5 HighJune 17, 2026
• websockets ws, red hat cluster observability operator 1.5.0, cryostat 4 +46 more +48 more ws: Memory exhaustion DoS from tiny fragments and data chunks CVE-2026-48779 Fix available 7.5 HighJune 15, 2026
• form-data, red hat cluster observability operator 1.5.0, cryostat 4 +77 more +79 more form-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection) CVE-2026-12143 Fix available 8.7 HighJune 12, 2026
• axios, red hat cryostat 4, gatekeeper 3 +62 more +64 more Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection CVE-2026-44496 Fix available 7.5 HighJune 4, 2026
• axios, red hat cryostat 4, gatekeeper 3 +65 more +67 more Axios: Allocation of Resources Without Limits or Throttling in axios CVE-2026-44488 Fix available 7.5 HighJune 4, 2026
• axios, red hat cryostat 4, gatekeeper 3 +65 more +67 more Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter CVE-2026-44487 Fix available 8.2 HighJune 4, 2026
• axios, red hat cryostat 4, gatekeeper 3 +63 more +65 more Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection CVE-2026-44486 Fix available 7.5 HighJune 4, 2026
• red hat openshift pipelines, openshift builds 1.7.3, openshift builds 1.8.1 +2 more Openshift-pipelines-operator-rh: openshift-pipelines-operator: tekton-scheduler-rolebinding grants system:authenticated write access to kueue and cert-manager resources CVE-2026-10840 7.1 HighJune 4, 2026
• go standard library crypto/x509, red hat assisted installer for red hat openshift container platform 2, cert manager support for red hat openshift release 1.19 +128 more +130 more Inefficient candidate hostname parsing in crypto/x509 CVE-2026-27145 Public exploitFix available 6.5 MediumJune 2, 2026
• vitejs launch-editor, vite, red hat cluster observability operator 1.5.0 +25 more +27 more launch-editor vulnerable to command injection via the crafted request on Windows CVE-2024-52011 Public exploitFix available 7.5 HighJune 1, 2026
• axios, red hat cryostat 4, gatekeeper 3 +79 more +81 more Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge CVE-2026-44495 Fix available 7.0 HighMay 29, 2026
• axios, red hat cryostat 4, gatekeeper 3 +65 more +67 more Axios: Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy` CVE-2026-44494 Fix available 8.7 HighMay 29, 2026
• axios, red hat cryostat 4, gatekeeper 3 +65 more +67 more Axios: shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718) CVE-2026-44492 Fix available EPSS 12.3% 8.6 HighMay 29, 2026
• shell-quote, red hat cluster observability operator 1.5.0, cryostat 4 +46 more +48 more shell-quote `quote()` does not validate object-token shapes, allowing command injection via line terminators in `.op` CVE-2026-9277 Public exploitFix available 9.2 CriticalMay 22, 2026
• golang crypto, golang.org/x/crypto golang.org/x/crypto/ssh, red hat assisted installer for red hat openshift container platform 2 +54 more +56 more Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh CVE-2026-46595 Public exploitFix available 10.0 CriticalMay 22, 2026
• golang crypto, golang.org/x/crypto golang.org/x/crypto/ssh/knownhosts, red hat assisted installer for red hat openshift container platform 2 +53 more +55 more Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts CVE-2026-42508 Fix available 9.1 CriticalMay 22, 2026
• golang crypto, golang.org/x/crypto golang.org/x/crypto/ssh, red hat assisted installer for red hat openshift container platform 2 +62 more +64 more Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh CVE-2026-39835 Fix available 5.3 MediumMay 22, 2026
• golang crypto, golang.org/x/crypto golang.org/x/crypto/ssh/agent, red hat assisted installer for red hat openshift container platform 2 +46 more +48 more Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent CVE-2026-39832 Fix available 9.1 CriticalMay 22, 2026
• golang crypto, golang.org/x/crypto golang.org/x/crypto/ssh, red hat assisted installer for red hat openshift container platform 2 +68 more +70 more Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh CVE-2026-39830 Fix available 9.1 CriticalMay 22, 2026
• golang crypto, golang.org/x/crypto golang.org/x/crypto/ssh, red hat assisted installer for red hat openshift container platform 2 +74 more +76 more Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh CVE-2026-39829 Fix available 7.5 HighMay 22, 2026
• golang crypto, golang.org/x/crypto golang.org/x/crypto/ssh, red hat assisted installer for red hat openshift container platform 2 +64 more +66 more Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh CVE-2026-39828 Fix available 6.3 MediumMay 22, 2026
• protobufjs project protobufjs, protobufjs protobuf.js, red hat openshift pipelines +20 more +22 more protobufjs: Code injection through bytes field defaults in generated toObject code CVE-2026-44293 Fix available 7.7 HighMay 12, 2026
• protobufjs project protobufjs, protobufjs protobuf.js, red hat openshift pipelines +13 more +15 more protobufjs: Denial of service through unbounded protobuf recursion CVE-2026-44289 Fix available 7.5 HighMay 12, 2026
• go standard library net/mail, golang go, red hat assisted installer for red hat openshift container platform 2 +108 more +110 more Quadratic string concatenation in consumePhrase in net/mail CVE-2026-42499 Fix available 7.5 HighMay 7, 2026
• go standard library net/mail, golang go, red hat assisted installer for red hat openshift container platform 2 +107 more +109 more Quadratic string concatentation in consumeComment in net/mail CVE-2026-39820 Fix available 7.5 HighMay 7, 2026
• go standard library net/http, golang go, http2 +106 more +108 more Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net CVE-2026-33814 Fix available 7.5 HighMay 7, 2026
• go standard library net, golang go, red hat assisted installer for red hat openshift container platform 2 +145 more +147 more Crash when handling long CNAME response in net CVE-2026-33811 Fix available 7.5 HighMay 7, 2026
• beaugunderson ip-address, red hat confidential compute attestation, cryostat 4 +38 more +40 more ip-address: XSS in Address6 HTML-emitting methods CVE-2026-42338 Fix available 5.3 MediumMay 5, 2026
• axios, red hat cryostat 4, gatekeeper 3 +45 more +47 more Axios: Prototype pollution read-side gadgets in HTTP adapter allow credential injection and request hijacking CVE-2026-42264 Fix available 7.4 HighMay 5, 2026
• websockets ws, red hat cryostat 4, cryostat 4 on rhel 9 +47 more +49 more ws: Uninitialized memory disclosure CVE-2026-45736 Fix available 4.4 MediumMay 4, 2026
• axios, red hat cryostat 4, gatekeeper 3 +61 more +63 more Axios: unbounded recursion in toFormData causes DoS via deeply nested request data CVE-2026-42039 Fix available 6.9 MediumApril 24, 2026
• axios, red hat cryostat 4, gatekeeper 3 +57 more +59 more Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy CVE-2026-42041 Fix available 4.8 MediumApril 24, 2026
• axios, red hat cryostat 4, gatekeeper 3 +56 more +58 more Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0 CVE-2026-42043 Fix available 7.2 HighApril 24, 2026
• axios, red hat cryostat 4, gatekeeper 3 +59 more +61 more Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver` CVE-2026-42044 Fix available 6.5 MediumApril 24, 2026
• Show olderLoading…