Skip to contentRed Hat Openshift vulnerabilities
- fedoraproject sssd, red hat enterprise linux 10, enterprise linux 6 +7 more +9 moreSssd: sssd: local denial of service due to null pointer dereference in pam responderCVE-2026-909955.5 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +4 more +6 moreSssd: sssd: denial of service via malformed pam v1 requestsCVE-2026-909944.0 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +4 more +6 moreSssd: local oob read in nss service request parsers (`sss_nss_protocol_parse_svc_name` / `sss_nss_protocol_parse_svc_port`)CVE-2026-904634.0 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +4 more +6 moreDevice-mapper-multipath: local denial of service via blocking ipc send operationsCVE-2026-89329Fix available6.2 Medium
- red hat enterprise linux 10, enterprise linux 8, enterprise linux 9 +4 more +6 morePcs: pcs: non-root haclient users can read arbitrary files via pcs host auth --tokenCVE-2026-84828Fix available6.5 Medium
- red hat enterprise linux 10, enterprise linux 8, enterprise linux 9 +3 more +5 moreCrun: crun: /dev/null symlink follow during stdio reopen allows host bind-mount write and chownCVE-2026-88265Fix available5.6 Medium
- containers crun, red hat enterprise linux 10, enterprise linux 8 +4 more +6 moreCrun: crun: /dev/console symlink follow allows root-owned file creation outside the rootfsCVE-2026-88264Fix available5.6 Medium
- red hat enterprise linux 10, enterprise linux 8, enterprise linux 9 +3 more +5 moreCrun: crun: rootful krun with passt executes container payload as host rootCVE-2026-84042Fix available7.8 High
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +4 more +6 moreCups: openprinting cups: remaining case-insensitive username matching in scheduler side paths (cve-2026-27447 follow-up)CVE-2026-87876Fix available3.0 Low
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +4 more +6 moreCups: openprinting cups: heap out-of-bounds read in cupsutf32toutf8() via missing source-length boundCVE-2026-87875Fix available4.3 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +4 more +6 moreSssd: sssd: idp authentication prefix comparison allows cross-user impersonationCVE-2026-87853Fix available7.5 High
- red hat fast datapath for rhel 10, fast datapath for rhel 8, fast datapath for rhel 9 +4 more +6 moreDpdk: dpdk: missing length validation before reading command_data in virtio-net control queue handlerCVE-2026-86564Fix available3.3 Low
- red hat cert manager support for red hat openshift release 1.20, cost management on-premise 1, enterprise linux 10 +22 more +24 moreLibxml2: double-free/uaf in libxml2 python bindingsCVE-2026-74860Fix available8.5 High
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +6 more +8 moreGlib2: toctou symlink race in `g_file_create_replace_destination` fallback pathCVE-2026-864695.3 Medium
- red hat openshift ai (rhoai), openshift ai 2.25, openshift ai 3.5 +2 moreOdh-dashboard: odh-dashboard: nim credential secret readable by any authenticated userCVE-2026-863326.5 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +5 more +7 morePolkit: regression in cve-2026-4897 fix (polkit read_cookie()) - stack buffer underflowCVE-2026-85498Fix available3.5 Low
- red hat enterprise linux 10, enterprise linux 7, enterprise linux 8 +3 more +5 moreCorosync: corosync: integer overflow in check_memb_commit_token_sanity may bypass message length validation on 32-bit systemsCVE-2026-816666.5 Medium
- red hat enterprise linux 10, enterprise linux 10.0 extended update support, enterprise linux 7 extended lifecycle support +13 more +15 moreCorosync: corosync: heap-based buffer overflow in totempg assembly buffer during fragmented message reassemblyCVE-2026-81665Fix available7.5 High
- red hat ansible automation platform 2, enterprise linux 10, enterprise linux 7 +4 more +6 moreJwcrypto: jwcrypto: general json jws kid binding bypass during jwkset verificationCVE-2026-841855.9 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +4 more +6 moreRpm: command injection in `rpmbuild -t*` (`gettarspec`) via unescaped tarball pathCVE-2026-84837Fix available7.8 High
- red hat enterprise linux 10, enterprise linux 7, enterprise linux 8 +3 more +5 moreUtil-linux: util-linux: x-mount.subdir detached-tree resolution can escape via intermediate symlinksCVE-2026-78409Fix available7.0 High
- red hat cost management on-premise 1, enterprise linux 10, enterprise linux 7 +5 more +7 moreUtil-linux: util-linux: restricted bind mounts do not pin the source, allowing x-mount.owner/group/mode redirectionCVE-2026-78410Fix available7.8 High
- red hat cost management on-premise 1, enterprise linux 10, enterprise linux 7 +5 more +7 moreUtil-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authorityCVE-2026-78408Fix available7.9 High
- red hat openshift container platform 4.13, openshift container platform 4.14, openshift container platform 4.15 +8 more +10 moreOpenshift/oauth-server: openshift/oauth-server: quadratic-time dos via accept-language header underscore bypass on unauthenticated login endpointsCVE-2026-493297.5 High
- red hat cost management on-premise 1, enterprise linux 10, enterprise linux 10.0 extended update support +18 more +20 moreGdb: gdb: out-of-bounds write in stabs parser read_member_functions() via crafted elfCVE-2026-13732Fix available7.0 High
- red hat enterprise linux 10, enterprise linux 7, enterprise linux 8 +7 more +9 moreLibsolv: libsolv: out-of-bounds write in repo_write() via unvalidated directory id from vertical/paged .solv filelist dataCVE-2026-82327Fix available5.5 Medium
- red hat enterprise linux ai (rhel ai) 3, openshift ai (rhoai) +1 moreFfmpeg: ffmpeg: heap buffer overflow in tdsc_load_cursor() via cur_fmt_mono cursorCVE-2026-18393Fix available5.4 Medium
- red hat ansible automation platform 2, enterprise linux 10, enterprise linux 9 +2 more +4 moreJwcrypto: jwcrypto: denial of service via malformed jwe tokensCVE-2026-801795.9 Medium
- red hat openshift container platform 4Cri-o: cri-o: unvalidated image env var causes daemon crashCVE-2026-171136.0 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +5 more +7 moreNetworkmanager: networkmanager: 802-1x ca-path and phase2-ca-path bypass private_user restriction, allowing wpa-enterprise server validation bypass (incomplete fix for cve-2025-9615)CVE-2026-19685Fix available7.1 High
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +4 more +6 moreRpm: rpmbuild gettarspec() crafted tar member name → macro injectionCVE-2026-78367Fix available7.0 High
- red hat openshift container platform 4, openshift container platform 5 +1 moreKata-containers: insufficient validation of createcontainer mount and storage rules in genpolicyCVE-2026-77176Fix available8.1 High
- rpm-software-management popt, red hat enterprise linux 10, enterprise linux 6 +7 more +9 morePopt-devel: popt-static: short realloc in poptconfigfiletostringCVE-2026-18743Fix available2.5 Low
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +3 more +5 moreLibsoup: libsoup: integer truncation in sort_ranges() comparator causes silent omission of http range responsesCVE-2026-77014Fix available5.3 Medium
- red hat enterprise linux 10, enterprise linux 7, enterprise linux 8 +2 more +4 moreCockpit-ws: cockpit: cockpit-ws: unauthenticated remote memory leak via cockpitlang cookie in send_login_htmlCVE-2026-76235Fix available7.5 High
- red hat multicluster global hub 1.4.9, multicluster global hub 1.5.8, multicluster global hub 1.6.6 +9 more +11 moreMulticloud-operators-subscription: multicloud-operators-subscription: isclusteradmin() trusts user-settable annotations on managed clustersCVE-2026-667929.9 Critical
- red hat openshift ai 3.4Models-as-a-service: red hat openshift ai: maas-api and maas-controller serviceaccounts with excessive permissions lead to privilege escalationCVE-2026-152187.9 High
- redhat quay, red hat openshift update service, quay 3 +2 moreQuay: ssrf via build archive_url in quay build apiCVE-2026-742474.2 Medium
- redhat quay, red hat openshift update service, quay 3 +2 moreQuay: unauthenticated exported logs download in quayCVE-2026-742455.9 Medium
- redhat quay, red hat openshift update service, quay 3 +2 moreQuay: stripe webhook accepts forged events without signature verification in quayCVE-2026-742445.9 Medium
- redhat quay, red hat openshift update service, quay 3 +2 moreQuay: unauthenticated secscan notification endpoint in quay when psk is unsetCVE-2026-742436.5 Medium
- redhat quay, red hat openshift update service, quay 3 +2 moreQuay: repository notification uuid idor in quay apiCVE-2026-742425.3 Medium
- redhat quay, red hat openshift update service, quay 3 +2 moreQuay: ldap referral filter injection in quay external ldap authenticationCVE-2026-742414.8 Medium
- redhat quay, red hat openshift update service, quay 3 +2 moreQuay: jwt claim validation bypasses in quay federated robot and sso authenticationCVE-2026-742405.4 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +7 more +9 moreLibdm: lvm2: libdm: denial of service via uncontrolled recursion in config parserCVE-2026-19617Fix available5.5 Medium
- red hat ansible automation platform 2, enterprise linux 10, enterprise linux 8 +7 more +9 morePodman: podman: quadlet install --replace non-truncating write retains removed host-access directivesCVE-2026-19730Fix available4.2 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +8 more +10 moreBinutils: binutils: multiple use-after-free in add_archive_element via lto plugin processingCVE-2026-19548Fix available5.5 Medium
- red hat openshift container platform 4Ose-oauth-server: oauth-server: open redirect vulnerability enables phishing via unvalidated parameter.CVE-2026-190784.3 Medium
- red hat openshift container platform 4.14, openshift container platform 4.15, openshift container platform 4.16 +6 more +8 moreOpenshift/console: authenticated ssrf with full response reflection and path neutralization via dev console webhook helpers in openshift consoleCVE-2026-502367.4 High
- red hat openshift container platform 4.12, openshift container platform 4.13, openshift container platform 4.14 +8 more +10 moreOpenshift/console: namespace tenant ssrf with egress bypass, catalog poisoning, and admin-mediated supply chain escalation via projecthelmchartrepository in openshift consoleCVE-2026-502377.4 High
- Show moreLoading…