Skip to contentRedhat Advanced Cluster Management For Kubernetes vulnerabilities
- redhat insights-client, red hat advanced cluster management for kubernetes 2.11, advanced cluster management for kubernetes 2.13 +5 more +7 moreInsights-client: insights-client: clusterrole grants cluster-wide secrets get/list/watch beyond least privilegeCVE-2026-718466.5 Medium
- redhat insights-client, red hat advanced cluster management for kubernetes 2.11, advanced cluster management for kubernetes 2.13 +5 more +7 moreInsights-client-rhel9: insights-client: pull-secret bearer token written to logs on non-200 ccx responseCVE-2026-714747.1 High
- redhat insights-client, red hat advanced cluster management for kubernetes 2.13, advanced cluster management for kubernetes 2.14 +4 more +6 moreInsights-client-rhel9: insights-client: spoke-controlled clusterid injected unencoded into insights api url pathCVE-2026-714756.8 Medium
- redhat insights-client, red hat advanced cluster management for kubernetes 2.11, advanced cluster management for kubernetes 2.13 +5 more +7 moreInsights-client: insights-client: ccx_token bearer credential logged in clear text at startup via setdefault()CVE-2026-718456.3 Medium
- axios, red hat cryostat 4, gatekeeper 3 +79 more +81 moreAxios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config MergeCVE-2026-44495Fix available7.0 High
- red hat multicluster engine for kubernetes, redhat advanced cluster management for kubernetes +1 moreMce: privilege escalation via excessive /etc/passwd permissionsCVE-2025-578516.4 Medium
- red hat multicluster engine for kubernetes, multicluster engine for kubernetes 2.1, multicluster engine for kubernetes 2.11 +4 more +6 moreRhacm: open cluster management (ocm): cross-cluster privilege escalation via improper kubernetes client certificate renewal validationCVE-2026-4740Fix available8.2 High
- immutable-js immutable, immutable-js, red hat cluster observability operator 1.5.0 +90 more +92 moreImmutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutableCVE-2026-29063Fix available8.7 High
- nodemailer, red hat advanced cluster management for kubernetes 2, ceph storage 8 +4 more +6 moreNodemailer: nodemailer: denial of service via crafted email address headerCVE-2025-14874Fix available7.5 High
- red hat advanced cluster management for kubernetes 2.11 for rhel 9, advanced cluster management for kubernetes 2.12 for rhel 9, redhat advanced cluster management for kubernetes +2 moreRhacm: users with clusterreader role can see credentials from managed-clustersCVE-2025-60175.5 Medium
- red hat advanced cluster management for kubernetes 2, ansible automation platform 1.2, ansible tower 3 +4 more +6 moreOpenshift api admission checks does not enforce "custom-host" permissionsCVE-2022-32484.4 Medium
- eclipse jetty, ietf http, http/2 +166 more +168 moreEclipse Jetty XmlParser allows arbitrary DOCTYPE declarationsCVE-2023-44487In KEVPublic exploitFix availableEPSS 100.0%7.5 High
- redhat advanced cluster management for kubernetes, redhat.com rhacm +1 moreThe grc-policy-propagator allows security escalation within the cluster. The propagator allows...CVE-2023-30277.8 High
- redhat advanced cluster management for kubernetes, redhat.com rhacm +1 moreRHACM: unauthenticated SSRF in console API endpoint. A Server-Side Request Forgery (SSRF)...CVE-2022-38417.8 High
- redhat advanced cluster management for kubernetesA vulnerability was found in the search-api container in Red Hat Advanced Cluster Management for...CVE-2022-22386.5 Medium
- golang ssh, fedoraproject extra packages for enterprise linux, fedora +1 more +3 moregolang.org/x/crypto/ssh Denial of service via crafted SignerCVE-2022-27191Fix available7.5 High
- redhat.com rhacm, redhat advanced cluster management for kubernetes +1 moreA flaw was found in rhacm versions before 2.0.5 and before 2.1.0. Two internal service APIs were...CVE-2020-256883.5 Low
- red hat open-cluster-management, redhat advanced cluster management for kubernetes +1 moreAn issue was discovered in ManagedClusterView API, that could allow secrets to be disclosed to...CVE-2020-256555.7 Medium