Read the docs
TI-2026-23208 Aliases CVE-2026-29063GHSA-wf6x-7x77-mvgw

Immutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable

Priority MEDIUM 46CWE-1321Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
Partial Red Hat: 53 fixed, 17 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

Immutable.js provides many Persistent Immutable data structures. Prior to versions 3.8.3, 4.3.7, and 5.1.5, Prototype Pollution is possible in immutable via the mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject() APIs. This issue has been patched in versions 3.8.3, 4.3.7, and 5.1.5.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0099 62nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial immutable-js (immutable-js): 3.8.3, 4.3.7, 5.1.5immutable (npm): 4.3.8, 5.1.5, 3.8.3Red Hat: 67 advisoriesRed Hat: 53 fixed, 17 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
immutable-jsimmutable-jsbefore 3.8.3; before 4.3.7; before 5.1.53.8.3, 4.3.7, 5.1.5Patch availableCNA
—immutable (npm)4.0.0-rc.1 to before 4.3.84.3.8Patch availableGHSA-wf6x-7x77-mvgw
—immutable (npm)5.0.0 to before 5.1.55.1.5Patch availableGHSA-wf6x-7x77-mvgw
—immutable (npm)before 3.8.33.8.3Patch availableGHSA-wf6x-7x77-mvgw
  • immutable-js Vendorimmutable-js Affected before 3.8.3; before 4.3.7; before 5.1.5 Fixed in 3.8.3, 4.3.7, 5.1.5 Patch available CNA
  • immutable (npm) Vendor— Affected 4.0.0-rc.1 to before 4.3.8 Fixed in 4.3.8 Patch available GHSA-wf6x-7x77-mvgw
  • immutable (npm) Vendor— Affected 5.0.0 to before 5.1.5 Fixed in 5.1.5 Patch available GHSA-wf6x-7x77-mvgw
  • immutable (npm) Vendor— Affected before 3.8.3 Fixed in 3.8.3 Patch available GHSA-wf6x-7x77-mvgw

CPE configurations NVD · 40

CPEVersionsRoleVendor
cpe:2.3:a:immutable-js:immutable:*:*:*:*:*:node.js:*:*3.0.0 to before 3.8.3; 4.0.0 to before 4.3.8; 5.0.0 to before 5.1.5Vulnerableimmutable-js
cpe:2.3:a:redhat:3scale_api_management_platform:2.0:*:*:*:*:*:*:*2.0VulnerableRed Hat
cpe:2.3:a:redhat:advanced_cluster_management_for_kubernetes:*:*:*:*:*:*:*:*2.14 to before 2.14.3; 2.15 to before 2.15.2; 2.16 to before 2.16.1VulnerableRed Hat
cpe:2.3:a:redhat:advanced_cluster_security:*:*:*:*:*:*:*:*4.8.0 to before 4.8.11; 4.9.0 to before 4.9.6VulnerableRed Hat
cpe:2.3:a:redhat:advanced_cluster_security:*:*:*:*:*:kubernetes:*:*4.10.0 to before 4.10.2VulnerableRed Hat
cpe:2.3:a:redhat:ansible_automation_platform:2.0:*:*:*:*:*:*:*2.0VulnerableRed Hat
cpe:2.3:a:redhat:build_of_apicurio_registry:2.0:*:*:*:*:*:*:*2.0VulnerableRed Hat
cpe:2.3:a:redhat:connectivity_link:1.0:*:*:*:*:*:*:*1.0VulnerableRed Hat
cpe:2.3:a:redhat:developer_hub:*:*:*:*:*:*:*:*1.8.0 to before 1.8.6; 1.9.0 to before 1.9.4VulnerableRed Hat
cpe:2.3:a:redhat:discovery:2.0:*:*:*:*:*:*:*2.0VulnerableRed Hat
  • cpe:2.3:a:immutable-js:immutable:*:*:*:*:*:node.js:*:* Versions 3.0.0 to before 3.8.3; 4.0.0 to before 4.3.8; 5.0.0 to before 5.1.5 Vulnerable ·immutable-js
  • cpe:2.3:a:redhat:3scale_api_management_platform:2.0:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:advanced_cluster_management_for_kubernetes:*:*:*:*:*:*:*:* Versions 2.14 to before 2.14.3; 2.15 to before 2.15.2; 2.16 to before 2.16.1 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:advanced_cluster_security:*:*:*:*:*:*:*:* Versions 4.8.0 to before 4.8.11; 4.9.0 to before 4.9.6 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:advanced_cluster_security:*:*:*:*:*:kubernetes:*:* Versions 4.10.0 to before 4.10.2 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:ansible_automation_platform:2.0:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:build_of_apicurio_registry:2.0:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:connectivity_link:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:developer_hub:*:*:*:*:*:*:*:* Versions 1.8.0 to before 1.8.6; 1.9.0 to before 1.9.4 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:discovery:2.0:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·Red Hat
Show 30 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:redhat:edge_manager:*:*:*:*:*:*:*:*1.0 to before 1.0.3; 1.1 to before 1.1.3VulnerableRed Hat
cpe:2.3:a:redhat:logging_subsystem_for_red_hat_openshift:-:*:*:*:*:*:*:*not specified by NVDVulnerableRed Hat
cpe:2.3:a:redhat:migration_toolkit:1.8:*:*:*:*:*:*:*1.8VulnerableRed Hat
cpe:2.3:a:redhat:migration_toolkit_for_virtualization:2.9.0:*:*:*:*:*:*:*2.9.0VulnerableRed Hat
cpe:2.3:a:redhat:migration_toolkit_for_virtualization:2.10.0:*:*:*:*:*:*:*2.10.0VulnerableRed Hat
cpe:2.3:a:redhat:multicluster_engine_for_kubernetes:*:*:*:*:*:*:*:*2.6 to before 2.6.10; 2.7 to before 2.7.10; 2.8 to before 2.8.5; 2.9 to before 2.9.3; 2.10 to before 2.10.2; 2.11 to before 2.11.1VulnerableRed Hat
cpe:2.3:a:redhat:network_observability_operator:1.11.0:*:*:*:*:*:*:*1.11.0VulnerableRed Hat
cpe:2.3:a:redhat:network_observability_operator:1.12.3:*:*:*:*:*:*:*1.12.3VulnerableRed Hat
cpe:2.3:a:redhat:openshift_cluster_observability_operator:1.5.3:*:*:*:*:*:*:*1.5.3VulnerableRed Hat
cpe:2.3:a:redhat:openshift_container_platform:*:*:*:*:*:*:*:*4.12 to before 4.12.93; 4.13 to before 4.13.69; 4.14 to before 4.14.68; 4.15 to before 4.15.66; 4.16 to before 4.16.63; 4.17 to before 4.17.54; 4.18 to before 4.18.39; 4.19 to before 4.19.32; 4.20 to before 4.20.23; 4.21 to before 4.21.17VulnerableRed Hat
cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:*4.0VulnerableRed Hat
cpe:2.3:a:redhat:openshift_data_foundation:*:*:*:*:*:*:*:*4.18 to before 4.18.25; 4.19 to before 4.19.20; 4.20 to before 4.20.15VulnerableRed Hat
cpe:2.3:a:redhat:openshift_data_foundation:4.17:*:*:*:*:*:*:*4.17VulnerableRed Hat
cpe:2.3:a:redhat:openshift_gitops:-:*:*:*:*:*:*:*not specified by NVDVulnerableRed Hat
cpe:2.3:a:redhat:openshift_lightspeed:-:*:*:*:*:*:*:*not specified by NVDVulnerableRed Hat
cpe:2.3:a:redhat:openshift_pipelines:*:*:*:*:*:*:*:*1.20 to before 1.20.5VulnerableRed Hat
cpe:2.3:a:redhat:openshift_service_mesh:2.6:*:*:*:*:*:*:*2.6VulnerableRed Hat
cpe:2.3:a:redhat:openshift_service_mesh:3.0:*:*:*:*:*:*:*3.0VulnerableRed Hat
cpe:2.3:a:redhat:openshift_service_mesh:3.1:*:*:*:*:*:*:*3.1VulnerableRed Hat
cpe:2.3:a:redhat:openshift_service_mesh:3.2:*:*:*:*:*:*:*3.2VulnerableRed Hat
cpe:2.3:a:redhat:openshift_service_mesh:3.3:*:*:*:*:*:*:*3.3VulnerableRed Hat
cpe:2.3:a:redhat:openshift_virtualization:4:*:*:*:*:*:*:*4VulnerableRed Hat
cpe:2.3:a:redhat:quay:*:*:*:*:*:*:*:*3.9.0 to before 3.9.20; 3.10.0 to before 3.10.21; 3.12.0 to before 3.12.16; 3.15.0 to before 3.15.4; 3.16.0 to before 3.16.4; 3.17.0 to before 3.17.2VulnerableRed Hat
cpe:2.3:a:redhat:quay:3.18.0:*:*:*:*:*:*:*3.18.0VulnerableRed Hat
cpe:2.3:a:redhat:satellite:6.0:*:*:*:*:*:*:*6.0VulnerableRed Hat
cpe:2.3:a:redhat:satellite:6.18:*:*:*:*:*:*:*6.18VulnerableRed Hat
cpe:2.3:a:redhat:self-service_automation_portal:2.0:*:*:*:*:*:*:*2.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*8.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*9.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*10.0VulnerableRed Hat
  • cpe:2.3:a:redhat:edge_manager:*:*:*:*:*:*:*:* Versions 1.0 to before 1.0.3; 1.1 to before 1.1.3 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:logging_subsystem_for_red_hat_openshift:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:migration_toolkit:1.8:*:*:*:*:*:*:* Versions 1.8 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:migration_toolkit_for_virtualization:2.9.0:*:*:*:*:*:*:* Versions 2.9.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:migration_toolkit_for_virtualization:2.10.0:*:*:*:*:*:*:* Versions 2.10.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:multicluster_engine_for_kubernetes:*:*:*:*:*:*:*:* Versions 2.6 to before 2.6.10; 2.7 to before 2.7.10; 2.8 to before 2.8.5; 2.9 to before 2.9.3; 2.10 to before 2.10.2; 2.11 to before 2.11.1 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:network_observability_operator:1.11.0:*:*:*:*:*:*:* Versions 1.11.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:network_observability_operator:1.12.3:*:*:*:*:*:*:* Versions 1.12.3 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openshift_cluster_observability_operator:1.5.3:*:*:*:*:*:*:* Versions 1.5.3 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openshift_container_platform:*:*:*:*:*:*:*:* Versions 4.12 to before 4.12.93; 4.13 to before 4.13.69; 4.14 to before 4.14.68; 4.15 to before 4.15.66; 4.16 to before 4.16.63; 4.17 to before 4.17.54; 4.18 to before 4.18.39; 4.19 to before 4.19.32; 4.20 to before 4.20.23; 4.21 to before 4.21.17 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:* Versions 4.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openshift_data_foundation:*:*:*:*:*:*:*:* Versions 4.18 to before 4.18.25; 4.19 to before 4.19.20; 4.20 to before 4.20.15 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openshift_data_foundation:4.17:*:*:*:*:*:*:* Versions 4.17 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openshift_gitops:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openshift_lightspeed:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openshift_pipelines:*:*:*:*:*:*:*:* Versions 1.20 to before 1.20.5 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openshift_service_mesh:2.6:*:*:*:*:*:*:* Versions 2.6 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openshift_service_mesh:3.0:*:*:*:*:*:*:* Versions 3.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openshift_service_mesh:3.1:*:*:*:*:*:*:* Versions 3.1 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openshift_service_mesh:3.2:*:*:*:*:*:*:* Versions 3.2 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openshift_service_mesh:3.3:*:*:*:*:*:*:* Versions 3.3 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openshift_virtualization:4:*:*:*:*:*:*:* Versions 4 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:quay:*:*:*:*:*:*:*:* Versions 3.9.0 to before 3.9.20; 3.10.0 to before 3.10.21; 3.12.0 to before 3.12.16; 3.15.0 to before 3.15.4; 3.16.0 to before 3.16.4; 3.17.0 to before 3.17.2 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:quay:3.18.0:*:*:*:*:*:*:* Versions 3.18.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:satellite:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:satellite:6.18:*:*:*:*:*:*:* Versions 6.18 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:self-service_automation_portal:2.0:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Red Hat

Remediation

  • Fix · CNA immutable-js (immutable-js) Fixed in 3.8.3, 4.3.7, 5.1.5
  • Fix · GHSA-wf6x-7x77-mvgw immutable (npm) Fixed in 4.3.8 Advisory →
  • Fix · GHSA-wf6x-7x77-mvgw immutable (npm) Fixed in 5.1.5 Advisory →
  • Fix · GHSA-wf6x-7x77-mvgw immutable (npm) Fixed in 3.8.3 Advisory →

Red Hat 67 advisories

  • RHSA-2026:83622 Released 2026-10-15 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.17.28 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.17 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +16
  • RHSA-2026:48085 Released 2026-07-29 · Red Hat rating Important
    Red Hat Quay 3.18.0
    • Red Hat Quay 3.18 registry.redhat.io/quay/quay-rhel9
  • RHSA-2026:40022 Released 2026-07-23 · Red Hat rating Important
    OpenShift Container Platform 4.13.69 bug fix and security update
    • Red Hat OpenShift Container Platform 4.13 registry.redhat.io/openshift4/openshift-route-controller-manager-rhel8, registry.redhat.io/openshift4/ose-console, registry.redhat.io/openshift4/ose-haproxy-router +4
Show 64 more Red Hat advisories
  • RHSA-2026:41944 Released 2026-07-20 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.19.20 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.19 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +17
  • RHSA-2026:41941 Released 2026-07-20 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.18.25 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.18 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +16
  • RHSA-2026:41928 Released 2026-07-20 · Red Hat rating Important
    Red Hat Migration Toolkit for Containers
    • Red Hat Migration Toolkit 1.8 registry.redhat.io/rhmtc/openshift-migration-controller-rhel8, registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8, registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8 +6
  • RHSA-2026:40984 Released 2026-07-16 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.20.15 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.20 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +19
  • RHSA-2026:40945 Released 2026-07-16 · Red Hat rating Important
    Red Hat Edge Manager Version 1.1.3 Security Update
    • Red Hat Edge Manager 1.1 registry.redhat.io/rhem/flightctl-alert-exporter-rhel10, registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10, registry.redhat.io/rhem/flightctl-api-rhel10 +11
  • RHSA-2026:36621 Released 2026-07-16 · Red Hat rating Important
    OpenShift Container Platform 4.16.66 bug fix and security update
    • Red Hat OpenShift Container Platform 4.16 registry.redhat.io/openshift4/ose-azure-file-csi-driver-rhel9, registry.redhat.io/openshift4/ose-cluster-node-tuning-rhel9-operator, registry.redhat.io/openshift4/ose-console-rhel9 +4
  • RHSA-2026:40118 Released 2026-07-15 · Red Hat rating Important
    Red Hat Edge Manager Version 1.1.3 Security Update
    • Red Hat Edge Manager 1.1 registry.redhat.io/rhem/flightctl-alert-exporter-rhel9, registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel9, registry.redhat.io/rhem/flightctl-api-rhel9 +11
  • RHSA-2026:34049 Released 2026-07-09 · Red Hat rating Important
    OpenShift Container Platform 4.12.93 bug fix and security update
    • Red Hat OpenShift Container Platform 4.12 registry.redhat.io/openshift4/ose-console, registry.redhat.io/openshift4/ose-openstack-cloud-controller-manager-rhel8
  • RHSA-2026:34099 Released 2026-07-09 · Red Hat rating Important
    OpenShift Container Platform 4.17.55 bug fix and security update
    • Red Hat OpenShift Container Platform 4.17 registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/cloud-network-config-controller-rhel9 +47
  • RHSA-2026:34100 Released 2026-07-09 · Red Hat rating Important
    OpenShift Container Platform 4.17.55 security and extras update
    • Red Hat OpenShift Container Platform 4.17 registry.redhat.io/openshift4/nmstate-console-plugin-rhel9, registry.redhat.io/openshift4/ose-aws-efs-csi-driver-container-rhel9, registry.redhat.io/openshift4/ose-csi-external-provisioner-rhel9 +6
  • RHSA-2026:36882 Released 2026-07-08 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.14.3 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.14 registry.redhat.io/rhacm2/acm-cli-rhel9, registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9, registry.redhat.io/rhacm2/acm-governance-policy-framework-addon-rhel9 +10
  • RHSA-2026:36651 Released 2026-07-08 · Red Hat rating Important
    Red Hat Edge Manager Version 1.0.3 Security Update
    • Red Hat Edge Manager 1.0 registry.redhat.io/rhem/flightctl-alert-exporter-rhel9, registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel9, registry.redhat.io/rhem/flightctl-api-rhel9 +9
  • RHSA-2026:29864 Released 2026-07-02 · Red Hat rating Important
    OpenShift Container Platform 4.19.36 bug fix and security update
    • Red Hat OpenShift Container Platform 4.19 registry.redhat.io/openshift4/ose-console-rhel9, registry.redhat.io/openshift4/ose-monitoring-plugin-rhel9
  • RHSA-2026:28964 Released 2026-07-01 · Red Hat rating Important
    OpenShift Container Platform 4.15.66 bug fix and security update
    • Red Hat OpenShift Container Platform 4.15 registry.redhat.io/openshift4/cloud-network-config-controller-rhel8, registry.redhat.io/openshift4/egress-router-cni-rhel8, registry.redhat.io/openshift4/kube-metrics-server-rhel8 +47
  • RHSA-2026:34342 Released 2026-07-01 · Red Hat rating Critical
    Cluster Observability Operator 1.5.0
    • Cluster Observability Operator 1.5 registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9, registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf5-rhel9, registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf6-rhel9 +9
  • RHSA-2026:28893 Released 2026-07-01 · Red Hat rating Important
    OpenShift Container Platform 4.14.68 bug fix and security update
    • Red Hat OpenShift Container Platform 4.14 registry.redhat.io/openshift4/cloud-network-config-controller-rhel8, registry.redhat.io/openshift4/egress-router-cni-rhel8, registry.redhat.io/openshift4/kubevirt-csi-driver-rhel8 +47
  • RHSA-2026:29857 Released 2026-07-01 · Red Hat rating Important
    OpenShift Container Platform 4.18.46 bug fix and security update
    • Red Hat OpenShift Container Platform 4.18 registry.redhat.io/openshift4/ose-cluster-node-tuning-rhel9-operator, registry.redhat.io/openshift4/ose-console-rhel9, registry.redhat.io/openshift4/ose-openshift-apiserver-rhel9
  • RHSA-2026:27063 Released 2026-06-23 · Red Hat rating Important
    OpenShift Container Platform 4.20.26 bug fix and security update
    • Red Hat OpenShift Container Platform 4.20 registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/oc-mirror-plugin-rhel9, registry.redhat.io/openshift4/ose-console-rhel9 +3
  • RHSA-2026:26232 Released 2026-06-16 · Red Hat rating Important
    General availability of the satellite/iop-host-inventory-frontend-rhel9 container image
    • Red Hat Satellite 6.18 registry.redhat.io/satellite/iop-host-inventory-frontend-rhel9
  • RHSA-2026:26225 Released 2026-06-16 · Red Hat rating Important
    Technical preview of the satellite/iop-vulnerability-frontend-rhel9 container image
    • Red Hat Satellite 6.18 registry.redhat.io/satellite/iop-vulnerability-frontend-rhel9
  • RHSA-2026:23246 Released 2026-06-10 · Red Hat rating Important
    OpenShift Container Platform 4.19.33 bug fix and security update
    • Red Hat OpenShift Container Platform 4.19 registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9, registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9 +47
  • RHSA-2026:24977 Released 2026-06-10 · Red Hat rating Important
    RHOAI 2.25.7 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-caikit-nlp-rhel9, registry.redhat.io/rhoai/odh-caikit-tgis-serving-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9 +34
  • RHSA-2026:24473 Released 2026-06-08 · Red Hat rating Important
    Network Observability 1.12.0 for OpenShift
    • Network Observability (NETOBSERV) 1.12.3 registry.redhat.io/network-observability/network-observability-console-plugin-pf4-rhel9, registry.redhat.io/network-observability/network-observability-console-plugin-rhel9, registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9
  • RHSA-2026:21657 Released 2026-06-03 · Red Hat rating Important
    OpenShift Container Platform 4.18.43 bug fix and security update
    • Red Hat OpenShift Container Platform 4.18 registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/azure-service-rhel9-operator +47
  • RHSA-2026:21703 Released 2026-06-03 · Red Hat rating Important
    OpenShift Container Platform 4.20.24 bug fix and security update
    • Red Hat OpenShift Container Platform 4.20 registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/openshift-route-controller-manager-rhel9, registry.redhat.io/openshift4/ose-agent-installer-ui-rhel9 +22
  • RHSA-2026:21658 Released 2026-06-03 · Red Hat rating Important
    OpenShift Container Platform 4.18.43 security and extras update
    • Red Hat OpenShift Container Platform 4.18 registry.redhat.io/openshift4/nmstate-console-plugin-rhel9, registry.redhat.io/openshift4/ose-aws-efs-csi-driver-container-rhel9, registry.redhat.io/openshift4/ose-cluster-nfd-rhel9-operator +5
  • RHSA-2026:22465 Released 2026-06-02 · Red Hat rating Important
    Red Hat Quay 3.17.2
    • Red Hat Quay 3.17 registry.redhat.io/quay/quay-rhel9
  • RHSA-2026:21931 Released 2026-05-29 · Red Hat rating Important
    Red Hat OpenShift Pipelines Release 1.20.5
    • Red Hat OpenShift Pipelines 1.20 registry.redhat.io/openshift-pipelines/pipelines-console-plugin-rhel9, registry.redhat.io/openshift-pipelines/pipelines-pipelines-as-code-controller-rhel9
  • RHSA-2026:20088 Released 2026-05-29 · Red Hat rating Important
    OpenShift Container Platform 4.16.63 bug fix and security update
    • Red Hat OpenShift Container Platform 4.16 registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/cloud-network-config-controller-rhel9 +47
  • RHSA-2026:20041 Released 2026-05-27 · Red Hat rating Important
    OpenShift Container Platform 4.19.32 bug fix and security update
    • Red Hat OpenShift Container Platform 4.19 registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9, registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9 +47
  • RHSA-2026:20042 Released 2026-05-27 · Red Hat rating Important
    OpenShift Container Platform 4.19.32 security and extras update
    • Red Hat OpenShift Container Platform 4.19 registry.redhat.io/openshift4/nmstate-console-plugin-rhel9, registry.redhat.io/openshift4/ose-aws-efs-csi-driver-container-rhel9, registry.redhat.io/openshift4/ose-dpu-cni-rhel9 +5
  • RHSA-2026:20034 Released 2026-05-26 · Red Hat rating Important
    OpenShift Container Platform 4.21.17 bug fix and security update
    • Red Hat OpenShift Container Platform 4.21 registry.redhat.io/openshift4/ose-agent-installer-ui-rhel9, registry.redhat.io/openshift4/ose-aws-ebs-csi-driver-rhel9, registry.redhat.io/openshift4/ose-cluster-api-rhel9 +15
  • RHSA-2026:19712 Released 2026-05-20 · Red Hat rating Critical
    RHOAI 3.3.3 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.3 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9 +33
  • RHSA-2026:17598 Released 2026-05-20 · Red Hat rating Important
    OpenShift Container Platform 4.17.54 bug fix and security update
    • Red Hat OpenShift Container Platform 4.17 registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/cloud-network-config-controller-rhel9 +47
  • RHSA-2026:17469 Released 2026-05-20 · Red Hat rating Important
    OpenShift Container Platform 4.20.23 security and extras update
    • Red Hat OpenShift Container Platform 4.20 registry.redhat.io/openshift4/nmstate-console-plugin-rhel9, registry.redhat.io/openshift4/ose-node-feature-discovery-rhel9
  • RHSA-2026:19410 Released 2026-05-19 · Red Hat rating Important
    MTV RHEL9 Images
    • Migration Toolkit for Virtualization 2.9 registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9
  • RHSA-2026:19409 Released 2026-05-19 · Red Hat rating Important
    MTV RHEL9 Images
    • Migration Toolkit for Virtualization 2.10 registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9
  • RHSA-2026:19375 Released 2026-05-19 · Red Hat rating Important
    Red Hat Quay 3.16.4
    • Red Hat Quay 3.16 registry.redhat.io/quay/quay-rhel9
  • RHSA-2026:12118 Released 2026-05-06 · Red Hat rating Important
    OpenShift Container Platform 4.18.39 bug fix and security update
    • Red Hat OpenShift Container Platform 4.18 registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/azure-service-rhel9-operator +47
  • RHSA-2026:13853 Released 2026-05-05 · Red Hat rating Important
    multicluster engine for Kubernetes v2.11.1 security update
    • multicluster engine for Kubernetes 2.11 registry.redhat.io/multicluster-engine/console-mce-rhel9, registry.redhat.io/multicluster-engine/registration-rhel9
  • RHSA-2026:13847 Released 2026-05-05 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.16.1 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.16 registry.redhat.io/rhacm2/console-rhel9
  • RHSA-2026:13829 Released 2026-05-05 · Red Hat rating Important
    RHACS 4.10.2 security and bug fix update
    • Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10 registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator, registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8 +1
  • RHSA-2026:13826 Released 2026-05-05 · Red Hat rating Critical
    Red Hat Developer Hub 1.9.4 release.
    • Red Hat Developer Hub 1.9 registry.redhat.io/rhdh/rhdh-hub-rhel9, registry.redhat.io/rhdh/rhdh-rhel9-operator
  • RHSA-2026:13791 Released 2026-05-05 · Red Hat rating Important
    RHACS 4.9.6 security and bug fix update
    • Red Hat Advanced Cluster Security 4.9 registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator, registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8 +3
  • RHSA-2026:13548 Released 2026-05-04 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.15.2 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.15 registry.redhat.io/rhacm2/acm-cli-rhel9, registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9, registry.redhat.io/rhacm2/acm-governance-policy-framework-addon-rhel9 +8
  • RHSA-2026:13542 Released 2026-05-04 · Red Hat rating Important
    multicluster engine for Kubernetes v2.10.2 security update
    • multicluster engine for Kubernetes 2.10 registry.redhat.io/multicluster-engine/backplane-rhel9-operator, registry.redhat.io/multicluster-engine/console-mce-rhel9, registry.redhat.io/multicluster-engine/discovery-rhel9 +1
  • RHSA-2026:11916 Released 2026-04-29 · Red Hat rating Important
    Red Hat Quay 3.10.21
    • Red Hat Quay 3.10 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:11858 Released 2026-04-29 · Red Hat rating Important
    multicluster engine for Kubernetes v2.7.10 security update
    • multicluster engine for Kubernetes 2.7 registry.redhat.io/multicluster-engine/console-mce-rhel9
  • RHSA-2026:11414 Released 2026-04-28 · Red Hat rating Important
    multicluster engine for Kubernetes v2.9.3 security update
    • multicluster engine for Kubernetes 2.9 registry.redhat.io/multicluster-engine/backplane-rhel9-operator, registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9, registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9 +5
  • RHSA-2026:11217 Released 2026-04-27 · Red Hat rating Important
    RHACS 4.8.11 security and bug fix update
    • Red Hat Advanced Cluster Security 4.8 registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-scanner-rhel8 +2
  • RHSA-2026:11070 Released 2026-04-27 · Red Hat rating Important
    RHACS 4.8.11 security and bug fix update
    • Red Hat Advanced Cluster Security 4.8 registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-scanner-rhel8 +2
  • RHSA-2026:9848 Released 2026-04-22 · Red Hat rating Important
    multicluster engine for Kubernetes v2.6.10 security update
    • multicluster engine for Kubernetes 2.6 registry.redhat.io/multicluster-engine/backplane-rhel9-operator, registry.redhat.io/multicluster-engine/console-mce-rhel9, registry.redhat.io/multicluster-engine/discovery-rhel9 +1
  • RHSA-2026:9742 Released 2026-04-22 · Red Hat rating Critical
    Red Hat Developer Hub 1.8.6 release.
    • Red Hat Developer Hub 1.8 registry.redhat.io/rhdh/rhdh-hub-rhel9, registry.redhat.io/rhdh/rhdh-rhel9-operator
  • RHSA-2026:8493 Released 2026-04-16 · Red Hat rating Critical
    Kiali 2.22.2 for Red Hat OpenShift Service Mesh 3.3
    • Red Hat OpenShift Service Mesh 3.3 registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9, registry.redhat.io/openshift-service-mesh/kiali-rhel9
  • RHSA-2026:8491 Released 2026-04-16 · Red Hat rating Critical
    Kiali 2.17.6 for Red Hat OpenShift Service Mesh 3.2
    • Red Hat OpenShift Service Mesh 3.2 registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9, registry.redhat.io/openshift-service-mesh/kiali-rhel9
  • RHSA-2026:8490 Released 2026-04-16 · Red Hat rating Critical
    Kiali 2.11.9 for Red Hat OpenShift Service Mesh 3.1
    • Red Hat OpenShift Service Mesh 3.1 registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9, registry.redhat.io/openshift-service-mesh/kiali-rhel9
  • RHSA-2026:8484 Released 2026-04-16 · Red Hat rating Critical
    Kiali 2.4.15 for Red Hat OpenShift Service Mesh 3.0
    • Red Hat OpenShift Service Mesh 3.0 registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9, registry.redhat.io/openshift-service-mesh/kiali-rhel9
  • RHSA-2026:8483 Released 2026-04-16 · Red Hat rating Critical
    Kiali 1.73.29 for Red Hat OpenShift Service Mesh 2.6
    • Red Hat OpenShift Service Mesh 2.6 registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8, registry.redhat.io/openshift-service-mesh/kiali-rhel8
  • RHSA-2026:8218 Released 2026-04-15 · Red Hat rating Important
    multicluster engine for Kubernetes v2.8.5 security update
    • multicluster engine for Kubernetes 2.8 registry.redhat.io/multicluster-engine/backplane-rhel9-operator, registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9, registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9 +5
  • RHSA-2026:7329 Released 2026-04-09 · Red Hat rating Important
    A Subscription Management tool for finding and reporting Red Hat product usage
    • Red Hat Discovery 2 registry.redhat.io/discovery/discovery-server-rhel9, registry.redhat.io/discovery/discovery-ui-rhel9
  • RHSA-2026:6926 Released 2026-04-07 · Red Hat rating Important
    Red Hat Quay 3.9.20
    • Red Hat Quay 3.9 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:6720 Released 2026-04-06 · Red Hat rating Important
    Red Hat Quay 3.12.16
    • Red Hat Quay 3.12 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:6568 Released 2026-04-03 · Red Hat rating Important
    Red Hat Quay 3.15.4
    • Red Hat Quay 3.15 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:6428 Released 2026-04-02 · Red Hat rating Important
    Network Observability 1.11.1 for OpenShift
    • Network Observability (NETOBSERV) 1.11.0 registry.redhat.io/network-observability/network-observability-cli-rhel9, registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9, registry.redhat.io/network-observability/network-observability-console-plugin-rhel9 +3

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Logging Subsystem for Red Hat OpenShiftAffectedNo fix planned: Will not fix
Migration Toolkit for VirtualizationAffectedNo fix planned: Will not fix
Network Observability OperatorAffectedNo fix yet
Node HealthCheck OperatorAffectedNo fix yet
OpenShift LightspeedAffectedNo fix yet
OpenShift PipelinesAffectedNo fix planned: Will not fix
Red Hat 3scale API Management Platform 2AffectedNo fix yet
Red Hat Ansible Automation Platform 2AffectedNo fix yet
Red Hat Connectivity Link 1AffectedNo fix yet
Red Hat Enterprise Linux 10AffectedNo fix yet
Red Hat Enterprise Linux 9AffectedNo fix yet
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet
Red Hat OpenShift GitOpsAffectedNo fix yet
Red Hat OpenShift Virtualization 4AffectedNo fix yet
Red Hat Satellite 6AffectedNo fix yet
Red Hat build of Apicurio Registry 2AffectedNo fix yet
Self-service automation portal 2AffectedNo fix yet
Cluster Observability Operator 1.5Fixed RHSA-2026:34342
Migration Toolkit for Virtualization 2.10Fixed RHSA-2026:19409
Migration Toolkit for Virtualization 2.9Fixed RHSA-2026:19410
Network Observability (NETOBSERV) 1.11.0Fixed RHSA-2026:6428
Network Observability (NETOBSERV) 1.12.3Fixed RHSA-2026:24473
Red Hat Advanced Cluster Management for Kubernetes 2.14Fixed RHSA-2026:36882
Red Hat Advanced Cluster Management for Kubernetes 2.15Fixed RHSA-2026:13548
Red Hat Advanced Cluster Management for Kubernetes 2.16Fixed RHSA-2026:13847
Red Hat Advanced Cluster Security 4.8Fixed RHSA-2026:11070, RHSA-2026:11217
Red Hat Advanced Cluster Security 4.9Fixed RHSA-2026:13791
Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10Fixed RHSA-2026:13829
Red Hat Developer Hub 1.8Fixed RHSA-2026:9742
Red Hat Developer Hub 1.9Fixed RHSA-2026:13826
Red Hat Discovery 2Fixed RHSA-2026:7329
Red Hat Edge Manager 1.0Fixed RHSA-2026:36651
Red Hat Edge Manager 1.1Fixed RHSA-2026:40118, RHSA-2026:40945
Red Hat Migration Toolkit 1.8Fixed RHSA-2026:41928
Red Hat OpenShift AI 2.25Fixed RHSA-2026:24977
Red Hat OpenShift AI 3.3Fixed RHSA-2026:19712
Red Hat OpenShift Container Platform 4.12Fixed RHSA-2026:34049
Red Hat OpenShift Container Platform 4.13Fixed RHSA-2026:40022
Red Hat OpenShift Container Platform 4.14Fixed RHSA-2026:28893
Red Hat OpenShift Container Platform 4.15Fixed RHSA-2026:28964
Red Hat OpenShift Container Platform 4.16Fixed RHSA-2026:20088, RHSA-2026:36621
Red Hat OpenShift Container Platform 4.17Fixed RHSA-2026:17598, RHSA-2026:34099, RHSA-2026:34100
Red Hat OpenShift Container Platform 4.18Fixed RHSA-2026:12118, RHSA-2026:21657, RHSA-2026:21658, RHSA-2026:29857
Red Hat OpenShift Container Platform 4.19Fixed RHSA-2026:20041, RHSA-2026:20042, RHSA-2026:23246, RHSA-2026:29864
Red Hat OpenShift Container Platform 4.20Fixed RHSA-2026:17469, RHSA-2026:21703, RHSA-2026:27063
Red Hat OpenShift Container Platform 4.21Fixed RHSA-2026:20034
Red Hat OpenShift Pipelines 1.20Fixed RHSA-2026:21931
Red Hat OpenShift Service Mesh 2.6Fixed RHSA-2026:8483
Red Hat OpenShift Service Mesh 3.0Fixed RHSA-2026:8484
Red Hat OpenShift Service Mesh 3.1Fixed RHSA-2026:8490
Red Hat OpenShift Service Mesh 3.2Fixed RHSA-2026:8491
Red Hat OpenShift Service Mesh 3.3Fixed RHSA-2026:8493
Red Hat Openshift Data Foundation 4.17Fixed RHSA-2026:83622
Red Hat Openshift Data Foundation 4.18Fixed RHSA-2026:41941
Red Hat Openshift Data Foundation 4.19Fixed RHSA-2026:41944
Red Hat Openshift Data Foundation 4.20Fixed RHSA-2026:40984
Red Hat Quay 3.10Fixed RHSA-2026:11916
Red Hat Quay 3.12Fixed RHSA-2026:6720
Red Hat Quay 3.15Fixed RHSA-2026:6568
Red Hat Quay 3.16Fixed RHSA-2026:19375
Red Hat Quay 3.17Fixed RHSA-2026:22465
Red Hat Quay 3.18Fixed RHSA-2026:48085
Red Hat Quay 3.9Fixed RHSA-2026:6926
Red Hat Satellite 6.18Fixed RHSA-2026:26225, RHSA-2026:26232
multicluster engine for Kubernetes 2.10Fixed RHSA-2026:13542
multicluster engine for Kubernetes 2.11Fixed RHSA-2026:13853
multicluster engine for Kubernetes 2.6Fixed RHSA-2026:9848
multicluster engine for Kubernetes 2.7Fixed RHSA-2026:11858
multicluster engine for Kubernetes 2.8Fixed RHSA-2026:8218
multicluster engine for Kubernetes 2.9Fixed RHSA-2026:11414
Not affected: 54 products
  • Cluster Observability Operator 1.5
  • Migration Toolkit for Virtualization 2.10
  • Migration Toolkit for Virtualization 2.9
  • Network Observability (NETOBSERV) 1.11.0
  • Network Observability (NETOBSERV) 1.12.3
  • Node HealthCheck Operator
  • OpenShift Service Mesh 3
  • Red Hat Advanced Cluster Management for Kubernetes 2.14
  • Red Hat Advanced Cluster Management for Kubernetes 2.15
  • Red Hat Advanced Cluster Management for Kubernetes 2.16
  • Red Hat Advanced Cluster Security 4.8
  • Red Hat Advanced Cluster Security 4.9
  • Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10
  • Red Hat Developer Hub 1.8
  • Red Hat Developer Hub 1.9
  • Red Hat Discovery 2
  • Red Hat Edge Manager 1.0
  • Red Hat Edge Manager 1.1
  • Red Hat Enterprise Linux 8
  • Red Hat Migration Toolkit 1.8
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift AI 2.25
  • Red Hat OpenShift AI 3.3
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Container Platform 4.12
  • Red Hat OpenShift Container Platform 4.13
  • Red Hat OpenShift Container Platform 4.14
  • Red Hat OpenShift Container Platform 4.15
  • Red Hat OpenShift Container Platform 4.16
  • Red Hat OpenShift Container Platform 4.17
  • Red Hat OpenShift Container Platform 4.18
  • Red Hat OpenShift Container Platform 4.19
  • Red Hat OpenShift Container Platform 4.20
  • Red Hat OpenShift Container Platform 4.21
  • Red Hat OpenShift Pipelines 1.20
  • Red Hat OpenShift Service Mesh 3.3
  • Red Hat Openshift Data Foundation 4.17
  • Red Hat Openshift Data Foundation 4.18
  • Red Hat Openshift Data Foundation 4.19
  • Red Hat Openshift Data Foundation 4.20
  • Red Hat Quay 3.10
  • Red Hat Quay 3.12
  • Red Hat Quay 3.15
  • Red Hat Quay 3.16
  • Red Hat Quay 3.17
  • Red Hat Quay 3.18
  • Red Hat Quay 3.9
  • Red Hat Satellite 6
  • multicluster engine for Kubernetes 2.10
  • multicluster engine for Kubernetes 2.11
  • multicluster engine for Kubernetes 2.6
  • multicluster engine for Kubernetes 2.7
  • multicluster engine for Kubernetes 2.8
  • multicluster engine for Kubernetes 2.9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-29063
  2. 2026-10-03 Alias added: GHSA-wf6x-7x77-mvgw
  3. 2026-10-07 Fix available: Red Hat OpenShift Pipelines 1.20 · Red Hat
  4. 2026-10-09 Affected versions changed · Red Hat
  5. 2026-10-16 Fix available: RHSA-2026:83622 · Red Hat
  6. 2026-10-16 Fix available: Migration Toolkit for Virtualization 2.10, Red Hat Openshift Data Foundation 4.17 · Red Hat
  7. 2026-11-05 Fix available: Cluster Observability Operator 1.5, Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10 · Red Hat

References

Exploit 1

Advisory 69

Other 8

  • TI-2026-42694 Immutable.js: Hash-collision algorithmic complexity denial of service in Immutable.Map/Set CVSS 4.0HIGH 8.7
  • TI-2026-42693 Immutable.js `List` 32-bit trie overflow → unrecoverable DoS CVSS 4.0HIGH 8.7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences