Skip to contentRed Hat Openshift Gitops vulnerabilities
- red hat openshift gitopsGithub.com/argoproj-labs/argocd-image-updater: argocd-image-updater: arbitrary command execution via crafted ssh repository proxy configurationCVE-2026-1216218.8 High
- red hat agentic cluster security suite 0.2, cost management 4, advanced cluster security for kubernetes 4.11 +51 more +53 moreCa-certificates: distrust emudhra intermediate ca certificates due to security concernsCVE-2026-114406Fix available6.8 Medium
- red hat openshift gitopsGitops-operator: gitops-operator: missing allowednamespace check in reconcilerhook for clusterrole/role cases enables potential privilege escalation and dosCVE-2026-142517.7 High
- red hat openshift gitops, argoproj argo-helm, red hat openshift data foundation 4 +1 more +3 moreArgo-cd: argo cd unauthenticated remote code execution in repo-server via generatemanifest grpc endpointCVE-2026-154168.9 High
- form-data, red hat cluster observability operator 1.5.0, cryostat 4 +77 more +79 moreform-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection)CVE-2026-12143Fix available8.7 High
- go standard library crypto/x509, red hat assisted installer for red hat openshift container platform 2, cert manager support for red hat openshift release 1.19 +128 more +130 moreInefficient candidate hostname parsing in crypto/x509CVE-2026-27145Public exploitFix available6.5 Medium
- golang crypto, golang.org/x/crypto golang.org/x/crypto/ssh, red hat assisted installer for red hat openshift container platform 2 +54 more +56 moreInvoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/sshCVE-2026-46595Public exploitFix available10.0 Critical
- golang crypto, golang.org/x/crypto golang.org/x/crypto/ssh/knownhosts, red hat assisted installer for red hat openshift container platform 2 +53 more +55 moreInvoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhostsCVE-2026-42508Fix available9.1 Critical
- golang crypto, golang.org/x/crypto golang.org/x/crypto/ssh, red hat assisted installer for red hat openshift container platform 2 +62 more +64 moreInvoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/sshCVE-2026-39835Fix available5.3 Medium
- golang crypto, golang.org/x/crypto golang.org/x/crypto/ssh/agent, red hat assisted installer for red hat openshift container platform 2 +46 more +48 moreInvoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agentCVE-2026-39832Fix available9.1 Critical
- golang crypto, golang.org/x/crypto golang.org/x/crypto/ssh, red hat assisted installer for red hat openshift container platform 2 +68 more +70 moreInvoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/sshCVE-2026-39830Fix available9.1 Critical
- golang crypto, golang.org/x/crypto golang.org/x/crypto/ssh, red hat assisted installer for red hat openshift container platform 2 +74 more +76 moreInvoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/sshCVE-2026-39829Fix available7.5 High
- golang crypto, golang.org/x/crypto golang.org/x/crypto/ssh, red hat assisted installer for red hat openshift container platform 2 +64 more +66 moreInvoking bypass of certificate restrictions in golang.org/x/crypto/sshCVE-2026-39828Fix available6.3 Medium
- traefik, red hat openshift dev spaces 3.29, openshift gitops +2 moreTraefik: Gateway API TraefikService backend accepts rest@internal, allowing unauthorized exposure of the REST provider despite providers.rest.insecure=falseCVE-2026-44774Fix available6.4 Medium
- go standard library net/mail, golang go, red hat assisted installer for red hat openshift container platform 2 +108 more +110 moreQuadratic string concatenation in consumePhrase in net/mailCVE-2026-42499Fix available7.5 High
- go standard library net/mail, golang go, red hat assisted installer for red hat openshift container platform 2 +107 more +109 moreQuadratic string concatentation in consumeComment in net/mailCVE-2026-39820Fix available7.5 High
- go standard library net/http, golang go, http2 +106 more +108 moreInfinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/netCVE-2026-33814Fix available7.5 High
- go standard library net, golang go, red hat assisted installer for red hat openshift container platform 2 +145 more +147 moreCrash when handling long CNAME response in netCVE-2026-33811Fix available7.5 High
- prometheus, red hat file integrity operator, logging for red hat openshift 6 +53 more +55 morePrometheus: remote read endpoint allows denial of service via crafted snappy payloadCVE-2026-42154Public exploitFix available7.5 High
- prometheus, red hat custom metric autoscaler operator for red hat openshift, file integrity operator +52 more +54 morePrometheus Azure AD remote write OAuth client secret exposed via config APICVE-2026-42151Fix available7.5 High
- argoproj argo cd, argo-cd, red hat openshift data foundation 4 +3 more +5 moreArgoCD ServerSideDiff is vulnerable to Kubernetes Secret ExtractionCVE-2026-42880Public exploitFix available9.6 Critical
- argoproj argo cd, red hat openshift data foundation 4, openshift gitops +2 moreIn Argo CD 3.2.0 before 3.2.11 and 3.3.0 before 3.3.9, ServerSideDiff allows reading cleartext...CVE-2026-438247.7 High
- qt, qt qtdeclarative, red hat multicluster global hub +10 more +12 morePossible QML code injection in VectorImage componentCVE-2025-14576Fix available7.4 High
- apache thrift, red hat multicluster global hub 1.3.4, multicluster global hub 1.4.5 +12 more +14 moreApache Thrift: C++ JSON OOB readCVE-2026-41607Fix available6.5 Medium
- apache thrift, red hat multicluster global hub 1.3.4, multicluster global hub 1.4.5 +12 more +14 moreApache Thrift: c_glib dispatch stack overflowCVE-2026-41606Fix available5.3 Medium
- apache thrift, red hat multicluster global hub 1.3.4, multicluster global hub 1.4.5 +12 more +14 moreApache Thrift: Swift Compact Protocol integer overflowCVE-2026-41605Fix available7.3 High
- apache thrift, red hat multicluster global hub 1.3.4, multicluster global hub 1.4.5 +12 more +14 moreApache Thrift: Swift Range crash in skip()CVE-2026-41604Fix available8.2 High
- apache thrift, red hat multicluster global hub, multicluster global hub 1.3.4 +17 more +19 moreApache Thrift: Go TFramedTransport uint32 overflowCVE-2026-41602Fix available7.5 High
- moby spdystream, red hat cert-manager operator for red hat openshift, cluster observability operator 1.5.0 +44 more +46 moreSpdyStream: DOS on CRICVE-2026-35469Fix available8.7 High
- red hat openshift gitopsArgocd-image-updater: argocd image updater: cross-namespace privilege escalation via insufficient namespace validationCVE-2026-63889.1 Critical
- follow-redirects, red hat cluster observability operator 1.5.0, cryostat 4 +79 more +81 morefollow-redirects: Custom Authentication Headers Leaked to Cross-Domain Redirect TargetsCVE-2026-40895Fix available6.9 Medium
- go standard library crypto/x509, golang go, red hat assisted installer for red hat openshift container platform 2 +103 more +105 moreCase-sensitive excludedSubtrees name constraints cause Auth Bypass in crypto/x509CVE-2026-33810Fix available8.2 High
- go standard library crypto/tls, golang go, red hat assisted installer for red hat openshift container platform 2 +117 more +119 moreUnauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tlsCVE-2026-32283Fix available7.5 High
- go standard library crypto/x509, golang go, red hat assisted installer for red hat openshift container platform 2 +140 more +142 moreUnexpected work during chain building in crypto/x509CVE-2026-32280Fix available7.5 High
- go-jose, red hat assisted installer for red hat openshift container platform 2, cert-manager operator for red hat openshift +110 more +112 moreGo JOSE affect by a panic in JWE decryptionCVE-2026-34986Fix available7.5 High
- lodash, lodash lodash-amd, lodash-es +105 more +107 morelodash vulnerable to Code Injection via `_.template` imports key namesCVE-2026-4800Public exploitFix available8.1 High
- path-to-regexp, red hat cryostat 4, cryostat 4 on rhel 9 +49 more +51 morepath-to-regexp vulnerable to Denial of Service via sequential optional groupsCVE-2026-4926Fix available7.5 High
- traefik, red hat openshift dev spaces 3.27, openshift dev spaces 3.28 +1 more +3 moreTraefik mTLS bypass via fragmented ClientHello SNI extraction failureCVE-2026-32305Fix available7.8 High
- goxmldsig project goxmldsig, red hat multicluster global hub 1.3.4, multicluster global hub 1.4.5 +10 more +12 moregoxmldsig has validateSignature Loop Variable Capture Signature BypassCVE-2026-33487Fix available7.5 High
- grpc, grpc grpc-go, red hat assisted installer for red hat openshift container platform 2 +166 more +168 moregRPC-Go has an authorization bypass via missing leading slash in :pathCVE-2026-33186Public exploitFix available9.1 Critical
- github.com/buger/jsonparser, jsonparser project jsonparser, red hat cluster observability operator 1.5.0 +17 more +19 moreDenial of service in github.com/buger/jsonparserCVE-2026-32285Fix available7.5 High
- go standard library net/url, golang go, red hat assisted installer for red hat openshift container platform 2 +143 more +145 moreIncorrect parsing of IPv6 host literals in net/urlCVE-2026-25679Fix available7.5 High
- go standard library crypto/x509, golang go, red hat assisted installer for red hat openshift container platform 2 +99 more +101 moreIncorrect enforcement of email constraints in crypto/x509CVE-2026-27137Fix available7.5 High
- immutable-js immutable, immutable-js, red hat cluster observability operator 1.5.0 +90 more +92 moreImmutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutableCVE-2026-29063Fix available8.7 High
- docker compose, cli, command line interface +27 more +29 moreDocker Desktop Docker Plugins Uncontrolled Search Path Element Local Privilege Escalation VulnerabilityCVE-2025-15558Fix available7.0 High
- naturalintelligence fast-xml-parser, red hat migration toolkit for applications 8, advanced cluster security 4.8 +11 more +13 morefast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity namesCVE-2026-25896Fix available9.3 Critical
- naturalintelligence fast-xml-parser, red hat migration toolkit for applications 8, advanced cluster security 4.8 +11 more +13 morefast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit)CVE-2026-26278Fix available7.5 High
- ajv.js ajv, red hat confidential compute attestation, cryostat 4 +67 more +69 moreajv has ReDoS when using `$data` optionCVE-2025-69873Fix available2.9 Low
- cli, red hat confidential compute attestation, cryostat 4 +32 more +34 morenpm cli Incorrect Permission Assignment Local Privilege Escalation VulnerabilityCVE-2026-0775Fix available7.0 High
- lodash, lodash lodash-amd, lodash-es +119 more +121 morePrototype Pollution Vulnerability in Lodash _.unset and _.omit functionsCVE-2025-13465Public exploitFix available6.9 Medium
- Show olderLoading…