Skip to contentRed Hat Openshift vulnerabilities
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +6 more +8 moreKbd: local privilege escalation in openvt via incorrect process owner verification allowing passwordless root loginCVE-2026-72693Fix available7.8 High
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +5 more +7 moreQemu-kvm: vhost inflight migration vmstate integer type mismatch causes out-of-bounds accessCVE-2026-6426Fix available4.4 Medium
- red hat openshift ai 2.25, openshift ai 3.3, openshift ai 3.4 +1 more +3 moreData-sciences-pipeline: user-controlled serviceaccount for workflow pods without authorization check — confused deputyCVE-2026-186207.1 High
- red hat openshift ai 2.25, openshift ai 3.3, openshift ai 3.4 +1 more +3 moreMl-metdata: bundled grpc 1.46.3 (2022) with published http/2 dos cves — directly reachable on listenerCVE-2026-186187.5 High
- red hat openshift ai 2.25, openshift ai 3.3, openshift ai 3.4 +1 more +3 moreData-science-pipelines-operator: dspo: cryptographically weak secret generation (math/rand) for db and s3 credentialsCVE-2026-186117.5 High
- red hat openshift ai 2.25, openshift ai 3.3, openshift ai 3.4 +1 more +3 moreOdh-training-operator-rhel9: rhoai fork aggregates training job create onto native edit/admin clusterrolesCVE-2026-189828.8 High
- red hat openshift ai 3.3, openshift ai 3.4, openshift ai 3.5 +2 moreOdh-training-operator-rhel9: [trainer v2 security] trn-02: rhoai overlay aggregates trainjobs crud into standard edit clusterroleCVE-2026-189518.8 High
- red hat openshift ai (rhoai), openshift ai 2.25, openshift ai 3.3 +1 more +3 moreOdh-dashboard: odh-dashboard: confused-deputy privilege escalation via unchecked roleref in rolebinding creationCVE-2026-189508.8 High
- red hat openshift ai 2.25, openshift ai 3.3, openshift ai 3.4 +2 moreOdh-dashboard: odh-dashboard: clusterrole grants cluster-wide crud on secrets and rbac management resourcesCVE-2026-189498.8 High
- red hat openshift ai (rhoai), openshift ai 2.25, openshift ai 3.3 +1 more +3 moreFeast: feast: unsafe dill deserialization of registry-stored udfs — rce on feature server and registry serverCVE-2026-18948Fix available9.9 Critical
- red hat openshift ai (rhoai), openshift ai 2.25, openshift ai 3.3 +1 more +3 moreFeast: feast: authorization bypass in /materialize endpoints enables dos via unauthorized full re-materializationCVE-2026-189478.5 High
- red hat openshift ai (rhoai), openshift ai 2.25, openshift ai 3.4 +2 moreFeast-operator: feast: feast apply cronjob runs user python with feature-server sa — tenant code to sa token escalationCVE-2026-189425.5 Medium
- red hat openshift ai (rhoai), openshift ai 2.25, openshift ai 3.3 +1 more +3 moreFeast: feast-operator: feast: default authentication mode is no_auth — shared multi-tenant instances deployed without authenticationCVE-2026-189417.7 High
- red hat ai inference server, openshift ai 2.25, openshift ai 3.3 +1 more +3 moreData-sciences-pipeline: dsp: v1 argo template path accepts arbitrary workflow spec, bypassing all v2 security hardeningCVE-2026-186217.6 High
- red hat openshift ai 2.25, openshift ai 3.3, openshift ai 3.4 +1 more +3 moreData-science-pipelines-operator: dspo: mysql dsn parameter injection via customextraparams enables local infile file exfiltration from operator podCVE-2026-186178.8 High
- red hat openshift ai 2.25, openshift ai 3.3, openshift ai 3.4 +1 more +3 moreData-science-pipelines-operator: dspo: operator clusterrole grants pods/exec:*, kubeflow.org */*, and clusterrole/binding crud cluster-wideCVE-2026-186088.7 High
- red hat openshift ai 2.25, openshift ai 3.3, openshift ai 3.4 +2 moreOdh-model-controller: odh-model-controller: cross-namespace secret read via nim account crd confused deputyCVE-2026-164566.5 Medium
- red hat openshift ai 2.25, openshift ai 3.3, openshift ai 3.4 +1 more +3 moreTrustyai-service-operator: trustyai-service-operator: tas internal service bypasses kube-rbac-proxy, exposing unauthenticated quarkus api cluster-wideCVE-2026-155818.0 High
- red hat openshift ai 2.25, openshift ai 3.3, openshift ai 3.4 +1 more +3 moreTrustyai-service-operator: trustyai-service-operator: lmevaljob sidecar containers bypass protected environment variable filtering, allowing trust_remote_code policy overrideCVE-2026-154678.1 High
- red hat openshift ai (rhoai), openshift ai 3.4 +1 moreMaas-billing: maas api: privilege escalation via forged http headers due to missing authenticationCVE-2026-144509.9 Critical
- red hat openshift ai (rhoai), openshift ai 3.4 +1 moreRhoai maas: llm-d: maas/llm-d inference gateway: default allowedroutes.namespaces.from: all allows namespace users to hijack shared model-serving traffic (tokens, prompts, outputs)CVE-2026-137178.8 High
- red hat enterprise linux 10, enterprise linux 10.0 extended update support, enterprise linux 6 extended lifecycle support - extension +25 more +27 moreDracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die()CVE-2026-15816Fix available7.5 High
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +4 more +6 moreP11-kit: integer overflow in rpc attribute-array length calculation can under-allocate nested attribute storage on 32 bit systemsCVE-2026-18938Fix available6.2 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +5 more +7 morePolicycoreutils: policycoreutils: toctou race condition in fixfiles allows arbitrary selinux label manipulationCVE-2026-19079Fix available4.4 Medium
- rpm-software-management popt, red hat enterprise linux 10, enterprise linux 6 +7 more +9 morePopt-devel: popt-static: size_t underflow in singleoptionhelpCVE-2026-18839Fix available2.2 Low
- red hat openshift container platform 4Openshift/oauth-proxy: openshift/oauth-proxy: unauthenticated identity header injection on whitelisted pathsCVE-2026-493316.5 Medium
- smuellerdd libkcapi, red hat enterprise linux 10, enterprise linux 10.0 extended update support +8 more +10 moreLibkcapi: infinite loop denial of service in libkcapi _kcapi_aio_read_all() due to unhandled io_getevents() timeout returnCVE-2026-71227Fix available5.1 Medium
- smuellerdd libkcapi, red hat enterprise linux 10, enterprise linux 10.0 extended update support +11 more +13 moreLibkcapi: memory corruption via uncanceled aio requests on error in libkcapi's one-shot aio pathCVE-2026-71226Fix available7.3 High
- smuellerdd libkcapi, red hat enterprise linux 10, enterprise linux 10.0 extended update support +8 more +10 moreLibkcapi: iv reuse in libkcapi one-shot symmetric cipher chunking causes cipher state reset across chunk boundariesCVE-2026-71225Fix available6.5 Medium
- fedoraproject sssd, red hat enterprise linux 10, enterprise linux 6 +7 more +9 moreSssd: sssd: pam responder out-of-bounds read via unchecked auth_token_length in protocol v1CVE-2026-68743Fix available5.5 Medium
- rpm-software-management popt, red hat enterprise linux 10, enterprise linux 6 +7 more +9 morePopt-devel: popt-static: off-by-one in poptstuffargsCVE-2026-18739Fix available2.5 Low
- fedoraproject sssd, red hat enterprise linux 10, enterprise linux 6 +7 more +9 moreSssd: sssd: nss responder uninitialized heap disclosure in initgroups replyCVE-2026-68744Fix available3.3 Low
- gnu tar, red hat discovery 2, enterprise linux 10 +10 more +12 moreTar: tar: toctou in incremental dumpdir 'x' rename handling allows restore path escapeCVE-2026-18477Fix available4.4 Medium
- gnu tar, red hat discovery 2, enterprise linux 10 +10 more +12 moreTar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwriteCVE-2026-18508Fix available4.4 Medium
- fedoraproject sssd, red hat enterprise linux 10, enterprise linux 6 +7 more +9 moreSssd: sssd: nss responder out-of-bounds read via unchecked addrlen in gethostbyaddrCVE-2026-68742Fix available5.5 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +4 more +6 morePcp: pcp: arbitrary file creation via path traversal in pmproxy logger servletCVE-2026-16531Fix available5.3 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +4 more +6 morePcp: pcp: remote denial of service and information leakageCVE-2026-16530Fix available6.5 Medium
- red hat enterprise linux 10, enterprise linux 10.0 extended update support, enterprise linux 6 +14 more +16 morePcp: pcp: denial of service due to signed integer overflowCVE-2026-16529Fix available7.5 High
- red hat enterprise linux 10, enterprise linux 10.0 extended update support, enterprise linux 6 +14 more +16 morePcp: pcp pmproxy: unauthenticated access to /store endpoint allows bypassing pmcd access rulesCVE-2026-16527Fix available7.3 High
- red hat enterprise linux 10, enterprise linux 10.0 extended update support, enterprise linux 6 +14 more +16 morePcp: pcp: privilege escalation to root via linux_sockets pmda vulnerabilityCVE-2026-16526Fix available8.8 High
- red hat enterprise linux 10, enterprise linux 10.0 extended update support, enterprise linux 6 +14 more +16 morePcp: pcp linux_sockets pmda: arbitrary command execution via command injectionCVE-2026-16524Fix available7.8 High
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +4 more +6 moreBinutils: binutils: out-of-bounds write in bfd dlx elf backend relocation processingCVE-2026-18220Public exploit7.8 High
- red hat enterprise linux 10, enterprise linux 7, enterprise linux 8 +3 more +5 moreCriu: criu: container escape via rseq critical section hijack during checkpoint/restoreCVE-2026-18107Public exploitFix available7.8 High
- red hat enterprise linux 10, enterprise linux 10.0 extended update support, enterprise linux 6 +24 more +26 moreSg3_utils: sg3_utils: arbitrary command execution via udev property injection in sg_inq --exportCVE-2026-16313Fix available7.6 High
- red hat openshift container platform 4.12, openshift container platform 4.13, openshift container platform 4.14 +8 more +10 moreOpenshift/oauth-proxy: openshift/oauth-proxy: underscore header smuggling enables identity impersonation on wsgi/php upstreamsCVE-2026-493328.5 High
- samba, red hat ceph storage 9.2, enterprise linux 10 +7 more +9 moreSamba: ctdb fails to do integrity checking of received packetsCVE-2026-58224Fix available6.5 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +3 more +5 moreSamba: samba ad ldap compare filter injection and trusted-request confusion disclose protected attributesCVE-2026-58222Public exploitFix available8.8 High
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +3 more +5 moreSamba: dns signing dos via tkey name cache exhaustionCVE-2026-58218Fix available5.3 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +3 more +5 moreSamba: kpasswd service: kpasswd packet that contains malformed asn.1 might cause the server to access 6 bytes of unallocated memory leading server to crashCVE-2026-58216Fix available5.3 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +6 more +8 moreBinutils: gnu binutils: heap-buffer-overflow in linker leads to information disclosure and denial of serviceCVE-2026-15003Fix available5.6 Medium
- Show moreLoading…