Read the docs
TI-2023-04114 Aliases CVE-2023-4456GHSA-ccmh-37rx-6pp5

Openshift-logging: lokistack authorisation is cached too broadly

Priority LOW 30CWE-1220Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat.

Summary

A flaw was found in openshift-logging LokiStack. The key used for caching is just the token, which is too broad. This issue allows a user with a token valid for one action to execute other actions as long as the authorization allowing the original action is still cached.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00588 48th percentileScored 2026-11-07
Fix Fixed Red Hat: 3 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Red HatRHOL-5.5-RHEL-8—v0.1.0-327Patch availableCNA
Red HatRHOL-5.6-RHEL-8—v0.1.0-326Patch availableCNA
Red HatRHOL-5.7-RHEL-8—v0.1.0-325Patch availableCNA
  • RHOL-5.5-RHEL-8 VendorRed Hat Affected — Fixed in v0.1.0-327 Patch available CNA
  • RHOL-5.6-RHEL-8 VendorRed Hat Affected — Fixed in v0.1.0-326 Patch available CNA
  • RHOL-5.7-RHEL-8 VendorRed Hat Affected — Fixed in v0.1.0-325 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:redhat:openshift_logging:*:*:*:*:*:*:*:*all versionsVulnerableRed Hat
  • cpe:2.3:a:redhat:openshift_logging:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Red Hat

Remediation

Red Hat 3 advisories

  • RHSA-2023:5095 Released 2023-09-20 · Red Hat rating Moderate
    Logging Subsystem 5.6.11 - Red Hat OpenShift security update
    • RHOL 5.6 for RHEL 8 openshift-logging/lokistack-gateway-rhel8
  • RHSA-2023:5096 Released 2023-09-20 · Red Hat rating Moderate
    Logging Subsystem 5.5.16 - Red Hat OpenShift security update
    • RHOL 5.5 for RHEL 8 openshift-logging/lokistack-gateway-rhel8
  • RHSA-2023:4933 Released 2023-09-13 · Red Hat rating Moderate
    Logging Subsystem 5.7.6 - Red Hat OpenShift security update
    • RHOL 5.7 for RHEL 8 openshift-logging/lokistack-gateway-rhel8

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
RHOL 5.5 for RHEL 8Fixed RHSA-2023:5096
RHOL 5.6 for RHEL 8Fixed RHSA-2023:5095
RHOL 5.7 for RHEL 8Fixed RHSA-2023:4933
Not affected: 3 products
  • RHOL 5.5 for RHEL 8
  • RHOL 5.6 for RHEL 8
  • RHOL 5.7 for RHEL 8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-4456
  2. 2026-10-03 Alias added: GHSA-ccmh-37rx-6pp5

References

Advisory 5

  • TI-2024-00175 Kernel: netfilter: use-after-free in nft_trans_gc_catchall_sync leads to privilege escalation CVSS 3.1HIGH 7.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences