Vulnerabilities

TI-2026-50175 CVE-2026-71846 · GHSA-wfwr-qqxc-6cch

Insights-client: insights-client: clusterrole grants cluster-wide secrets get/list/watch beyond least privilege

LOW 28

A flaw was found in insights-client.

CVSS 3.1MEDIUM 6.5 Local Low privileges No interaction EPSS 0.0016 Published 2026-08-12 Fixed in 1787688993, 1787259125 +4 CWE-250

TI-2026-50089 CVE-2026-71474 · GHSA-6q5x-r3rm-rpv8

Insights-client-rhel9: insights-client: pull-secret bearer token written to logs on non-200 ccx response

LOW 30

A flaw was found in insights-client.

CVSS 3.1HIGH 7.1 Local No auth No interaction EPSS 0.00156 Published 2026-08-11 Fixed in 1787688993, 1787259125 +4 CWE-532

TI-2026-50090 CVE-2026-71475 · GHSA-gqvx-3g3q-49g9

Insights-client-rhel9: insights-client: spoke-controlled clusterid injected unencoded into insights api url path

LOW 31

A flaw was found in insights-client.

CVSS 3.1MEDIUM 6.8 Network High privileges No interaction EPSS 0.00694 Published 2026-08-11 Fixed in 1787259125, 1786882244 +3 CWE-22

TI-2026-50174 CVE-2026-71845 · GHSA-h2jx-ffv3-pwqm

Insights-client: insights-client: ccx_token bearer credential logged in clear text at startup via setdefault()

LOW 34

A flaw was found in insights-client.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00501 Published 2026-08-11 Fixed in 1787688993, 1787259125 +4 CWE-532

TI-2026-32429 CVE-2026-44495 · GHSA-3g43-6gmg-66jw

Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge

HIGH 69

Axios is a promise based HTTP client for the browser and Node.js.

CVSS 3.1HIGH 7.7 Network No auth No interaction EPSS 0.00854 Published 2026-06-11 Partial fix · 1.15.2, 0.31.1 CWE-1321

TI-2025-35720 CVE-2025-57851 · GHSA-87qg-cwpg-cjvw

Mce: privilege escalation via excessive /etc/passwd permissions

LOW 30

A container privilege escalation flaw was found in certain Multicluster Engine for Kubernetes images.

CVSS 3.1MEDIUM 6.7 Local High privileges No interaction EPSS 0.00117 Published 2026-04-08 No fix listed CWE-276

TI-2026-04135 CVE-2026-4740 · GHSA-q4gv-pjmh-c735

Improper certificate validation in Red Hat multicluster engine for Kubernetes 2.1

LOW 37

A flaw was found in Open Cluster Management (OCM), the technology underlying Red Hat Advanced Cluster Management (ACM).

CVSS 3.1HIGH 8.2 Local High privileges No interaction EPSS 0.00151 Published 2026-04-07 Partial fix · 1776881164, 1777478390 +4 CWE-295

TI-2026-23208 CVE-2026-29063 · GHSA-wf6x-7x77-mvgw

Immutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable

MEDIUM 46

Immutable.js provides many Persistent Immutable data structures.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.0099 Published 2026-03-06 Partial fix · 3.8.3, 4.3.7 +2 CWE-1321

TI-2025-13566 CVE-2025-14874 · GHSA-rcmh-qjqh-p98v

Nodemailer: nodemailer: denial of service via crafted email address header

HIGH 72

A flaw was found in Nodemailer.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00599 Published 2025-12-18 Partial fix · 7.0.11 CWE-703

TI-2025-05437 CVE-2025-6017 · GHSA-g8pw-ch7g-q2vc

Rhacm: users with clusterreader role can see credentials from managed-clusters

LOW 24

A flaw was found in Red Hat Advanced Cluster Management through versions 2.10, before 2.10.7, 2.11, before 2.11.4, and 2.12, before 2.12.4.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00167 Published 2025-07-02 Fixed in 0.16.0, v2.11.8-3 +14 CWE-359

TI-2023-23979 CVE-2023-44487 · GHSA-qppj-fm5r-hxr3

The HTTP/2 protocol allows a denial of service (server resource consumption) because…

CRITICAL 90KEV

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.99999 Published 2023-10-10 Partial fix · 1.28.0, 0.17.0 +9 CWE-400

TI-2022-03001 CVE-2022-3248 · GHSA-4rc4-8xqr-5g82

Openshift api admission checks does not enforce "custom-host" permissions

LOW 33

A flaw was found in OpenShift API, as admission checks do not enforce "custom-host" permissions.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00479 Published 2023-10-05 No fix listed CWE-863

TI-2023-02835 CVE-2023-3027 · GHSA-ffmc-4rrr-xm85

Improper privilege management in RHACM

LOW 35

The grc-policy-propagator allows security escalation within the cluster.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00198 Published 2023-06-05 No fix listed CWE-269

TI-2022-03521 CVE-2022-3841 · GHSA-4mp7-jw3w-xgg2

Server-side request forgery in Red Hat RHACM

LOW 36

RHACM: unauthenticated SSRF in console API endpoint.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00236 Published 2023-01-11 Partial fix CWE-918

TI-2022-02066 CVE-2022-2238 · GHSA-gpp7-gqhm-5827

SQL injection in Red Hat Advanced Cluster Management for Kubernetes

LOW 31

A vulnerability was found in the search-api container in Red Hat Advanced Cluster Management for Kubernetes when a query in the search filter gets parsed by the backend.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00937 Published 2022-09-01 Partial fix CWE-89

TI-2022-10313 CVE-2022-27191 · GHSA-8c26-wmh5-6g9v

The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go…

MEDIUM 40

The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker to crash a server in certain circumstances involving AddHostKey.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.03963 Published 2022-03-18 Partial fix · 0.0.0-20220314234659-1baeb1ce4c0b CWE-327

TI-2020-15704 CVE-2020-25688 · GHSA-xm77-mpc2-5mxx

Hard-coded credentials in rhacm

LOW 16

A flaw was found in rhacm versions before 2.0.5 and before 2.1.0.

CVSS 3.1LOW 3.5 Adjacent network Low privileges No interaction EPSS 0.00251 Published 2020-11-23 Partial fix CWE-321

TI-2020-15672 CVE-2020-25655 · GHSA-fvqj-2g9g-f9xv

Incorrect authorization in Red Hat open-cluster-management

LOW 30

An issue was discovered in ManagedClusterView API, that could allow secrets to be disclosed to users without the correct permissions.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00609 Published 2020-11-09 Fixed CWE-863

Vulnerabilities

Filters