Rhsso-container-image: unsecured management interface exposed to adjecent network
Priority MEDIUM 44CWE-276Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 1 fixed, 1 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat.
Summary
A flaw was found in Red Hat Single Sign-On for OpenShift container images, which are configured with an unsecured management interface enabled. This flaw allows an attacker to use this interface to deploy malicious code and access and modify potentially sensitive information in the app server configuration.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00789 56th percentileScored 2026-11-07
Fix Partial Red Hat: 1 advisoryRed Hat: 1 fixed, 1 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Red Hat | RHEL-8 based Middleware Containers | — | 7.6-20 | Patch available | CNA |
| Red Hat | Red Hat Single Sign-On 7 | — | — | No fix listed | CNA |
- RHEL-8 based Middleware Containers VendorRed Hat Affected — Fixed in 7.6-20 Patch available CNA
- Red Hat Single Sign-On 7 VendorRed Hat Affected — Fixed in — No fix listed CNA
CPE configurations NVD · 10
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:redhat:single_sign-on:7.0:*:*:*:*:*:*:* | 7.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:openshift_container_platform:4.9:*:*:*:*:*:*:* | 4.9 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:openshift_container_platform:4.10:*:*:*:*:*:*:* | 4.10 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:openshift_container_platform_for_ibm_z:4.9:*:*:*:*:*:*:* | 4.9 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:openshift_container_platform_for_ibm_z:4.10:*:*:*:*:*:*:* | 4.10 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:openshift_container_platform_for_linuxone:4.9:*:*:*:*:*:*:* | 4.9 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:openshift_container_platform_for_linuxone:4.10:*:*:*:*:*:*:* | 4.10 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:openshift_container_platform_for_power:4.9:*:*:*:*:*:*:* | 4.9 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:openshift_container_platform_for_power:4.10:*:*:*:*:*:*:* | 4.10 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* | 8.0 | Running on | Red Hat |
- cpe:2.3:a:redhat:single_sign-on:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:openshift_container_platform:4.9:*:*:*:*:*:*:* Versions 4.9 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:openshift_container_platform:4.10:*:*:*:*:*:*:* Versions 4.10 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:openshift_container_platform_for_ibm_z:4.9:*:*:*:*:*:*:* Versions 4.9 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:openshift_container_platform_for_ibm_z:4.10:*:*:*:*:*:*:* Versions 4.10 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:openshift_container_platform_for_linuxone:4.9:*:*:*:*:*:*:* Versions 4.9 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:openshift_container_platform_for_linuxone:4.10:*:*:*:*:*:*:* Versions 4.10 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:openshift_container_platform_for_power:4.9:*:*:*:*:*:*:* Versions 4.9 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:openshift_container_platform_for_power:4.10:*:*:*:*:*:*:* Versions 4.10 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Running on ·Red Hat
Remediation
Red Hat 1 advisory
- RHSA-2023:1047 Released 2023-03-01 · Red Hat rating ImportantRed Hat Single Sign-On 7.6.2 for OpenShift image security and enhancement update
- Middleware Containers for OpenShift rh-sso-7/sso76-openshift-rhel8
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
Red Hat RHEL-8 based Middleware Containers, Red Hat Single Sign-On 7 — RHSA-2023:1047
3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW
Other records, highest priority first
- TI-2022-03591 Keycloak: session takeover with oidc offline refreshtokensPriority LOW 34
- TI-2022-01319 Keycloak: xss on impersonation under specific circumstancesPriority LOW 29
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Single Sign-On 7 | Affected | No fix yet |
| Middleware Containers for OpenShift | Fixed | RHSA-2023:1047 |
Timeline
- 2026-10-02 Threatist record created from CVE-2022-4039
- 2026-10-03 Alias added: GHSA-7g6j-5xq2-wgqv
References
More Red Hat Openshift Container Platform vulnerabilities
- TI-2019-15875 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-15874 Protection mechanism failure in Jenkins Script Security Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-05363 Code injection in Elastic Kibana KEVCVSS 3.1CRITICAL 10.0
- TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8
- TI-2026-34021 Linux kernel skb coalescing drops shared-frag marker KEVCVSS 3.1HIGH 7.8
- TI-2026-23989 crypto: algif_aead - Revert to operating out-of-place KEVCVSS 3.1HIGH 7.8
Sources
- CVE-2022-4039 · CVE Program
- CVE-2022-4039 · NVD
- FIRST EPSS
- GHSA-7g6j-5xq2-wgqv · GitHub Advisory Database · CC BY 4.0
- CVE-2022-4039 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences