Acm (Redhat) - vulnerabilities (CVEs)

160 CVEs, 2 in the last 30 days, 8 known versions, newest CVE from 2026-10-15. Vendor: Redhat.

CVEs of Acm

CVE-2026-92982 - CVSS 8.5 (high), 2026-10-15: A flaw was found in Ansible Operator Plugins. A low-privileged Kubernetes user can exploit a Jinja2 template injection vulnerability by crafting malicious…
CVE-2026-89091 - CVSS 8.8 (high), 2026-10-08: A flaw was found in ansible-core. When installing a collection with `ansible-galaxy collection install`, the archive extractor validates member paths using…
CVE-2026-93685 - CVSS 5.4 (medium), 2026-09-18: A flaw was found in the multicluster-observability-addon. A remote attacker can access a debug endpoint without authentication, due to a misconfiguration in…
CVE-2026-92615 - CVSS 6.6 (medium), 2026-09-16: A flaw was found in flightctl. The configureRepoHTTPSClient() function in the device-render worker builds a per-repository tls.Config (which may include…
CVE-2026-89060 - CVSS 7.7 (high), 2026-09-11: A cross-namespace authorization flaw in multicluster-observability-addon allows a user with permission to modify a managed cluster’s ManagedClusterAddOn…
CVE-2026-66786 - CVSS 9.1 (critical), 2026-09-02: A flaw was found in submariner. In cert-auth mode, the connection configuration is built using free-form strings from the Custom Resource Definition (CRD)…
CVE-2026-73137 - CVSS 7.7 (high), 2026-08-20: A flaw was found in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management (RHACM). A tenant with HelmRelease create…
CVE-2026-67567 - CVSS 9.9 (critical), 2026-08-20: A flaw was found in the multicloud-operators-subscription component. This vulnerability allows a tenant, who has the ability to create HelmRelease custom…
CVE-2026-66788 - CVSS 9.9 (critical), 2026-08-20: A flaw was found in Lighthouse. A remote attacker, by compromising a spoke cluster, can exploit a vulnerability where the destination namespace for resource…
CVE-2026-66787 - CVSS 8.7 (high), 2026-08-20: A flaw was found in the lighthouse component of Red Hat Advanced Cluster Management for Kubernetes. This vulnerability stems from insufficient validation of…
CVE-2026-66785 - CVSS 8.7 (high), 2026-08-20: A flaw was found in Submariner. This vulnerability allows a malicious cluster (spoke) to redirect network traffic from other connected clusters (peer…
CVE-2026-76827 - CVSS 6.8 (medium), 2026-08-19: A flaw was found in search-indexer. This vulnerability allows a registered and authenticated managed cluster to tamper with or delete another cluster's…
CVE-2026-76139 - CVSS 8 (high), 2026-08-19: A flaw was found in acm-operator-bundle. The build process for this component downloads and runs a script from a remote source without verifying its…
CVE-2026-70496 - CVSS 9.9 (critical), 2026-08-19: A flaw was found in search-v2-operator. The operator's ClusterRole has permissions equivalent to a cluster administrator, allowing it to impersonate other…
CVE-2026-18874 - CVSS 6.2 (medium), 2026-08-19: A flaw was found in volsync-addon-controller. This vulnerability allows an attacker to inject malicious YAML (Yet Another Markup Language) code into the…
CVE-2026-71470 - CVSS 9.1 (critical), 2026-08-19: A flaw was found in the search-v2-operator. This vulnerability allows a privileged user, specifically a Custom Resource (CR) editor, to manipulate Search CR…
CVE-2026-66780 - CVSS 6.5 (medium), 2026-08-18: A flaw was found in the submariner-operator component. The `submariner-k8s-broker-cluster` Role, which is assigned to joined clusters, possesses excessive…
CVE-2026-66783 - CVSS 4.4 (medium), 2026-08-18: A flaw was found in the `submariner-operator` component of Red Hat Advanced Cluster Management for Kubernetes. This vulnerability allows a cluster…
CVE-2026-66782 - CVSS 5.8 (medium), 2026-08-18: A flaw was found in the Submariner operator. This vulnerability allows for the exposure of a long-lived broker service account (SA) bearer token within the…
CVE-2026-66781 - CVSS 5.4 (medium), 2026-08-18: A flaw was found in the Submariner operator. The Submariner Custom Resource (CR), used for configuring network connectivity, stores the IPsec pre-shared key…
CVE-2026-75924 - CVSS 8.7 (high), 2026-08-18: A flaw was found in managed-serviceaccount. A compromised addon-manager pod, due to its ClusterRole granting excessive permissions, can read any secret across…
CVE-2026-75485 - CVSS 5.5 (medium), 2026-08-18: A flaw was found in the must-gather component of Red Hat Advanced Cluster Management for Kubernetes. The cluster Proxy object is dumped in raw form, bypassing…
CVE-2026-73834 - CVSS 5.5 (medium), 2026-08-18: A flaw was found in the must-gather component of Red Hat Advanced Cluster Management for Kubernetes. Certain ACM wrapper Custom Resources that embed Secret…
CVE-2026-66793 - CVSS 8.8 (high), 2026-08-18: A flaw was found in the governance-policy-addon-controller component of Red Hat Advanced Cluster Management for Kubernetes. A user with permissions to…
CVE-2026-71472 - CVSS 9.1 (critical), 2026-08-17: A flaw was found in acm-search-v2-rhel9. This vulnerability allows an authenticated attacker, such as a hub administrator or a Search Custom Resource (CR)…
CVE-2026-70495 - CVSS 8.8 (high), 2026-08-17: A flaw was found in search-v2-operator. This component's `search-serviceaccount` has overly broad permissions, allowing it to impersonate users and groups…
CVE-2026-66792 - CVSS 9.9 (critical), 2026-08-17: A flaw was found in the multicloud-operators-subscription component. This vulnerability allows a user on a managed cluster to escalate their privileges by…
CVE-2026-71846 - CVSS 6.5 (medium), 2026-08-12: A flaw was found in insights-client. The component's ServiceAccount is bound to a ClusterRole granting cluster-wide secrets get, list, and watch permissions,…
CVE-2026-71469 - CVSS 7.5 (high), 2026-08-12: A flaw was found in search-v2-api. An unauthenticated attacker can exploit this by sending requests with unique random bearer tokens. Each unique token…
CVE-2026-71471 - CVSS 9 (critical), 2026-08-12: A flaw was found in acm-search-v2-rhel9. An attacker with administrative privileges on the hub cluster, specifically with patch access to the Search Custom…
CVE-2026-71473 - CVSS 8.5 (high), 2026-08-12: A flaw was found in the `search-v2-operator` component. A user with specific administrative permissions on a managed cluster can exploit a vulnerability that…
CVE-2026-72508 - CVSS 9.9 (critical), 2026-08-12: A flaw was found in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management (RHACM). This vulnerability allows a…
CVE-2026-64927 - CVSS 6.4 (medium), 2026-08-12: A flaw was found in the multicloud-operators-channel component. This vulnerability allows a user with specific permissions to manipulate how the system…
CVE-2026-73122 - CVSS 7.7 (high), 2026-08-12: A flaw was found in the multicloud-operators-channel component of Red Hat Advanced Cluster Management (RHACM). This vulnerability allows a compromised agent…
CVE-2026-66878 - CVSS 7.7 (high), 2026-08-12: A flaw was found in multicloud-operators-subscription. A privileged user, specifically a namespace administrator capable of creating Channel and Subscription…
CVE-2026-70398 - CVSS 9.6 (critical), 2026-08-12: A flaw was found in multicloud-integrations, a component of Red Hat Advanced Cluster Management (RHACM). This vulnerability allows an authenticated user,…
CVE-2026-72526 - CVSS 9.9 (critical), 2026-08-12: A flaw was found in the multicloud-integrations component. The Application propagation controller processes the `ocm-managed-cluster` annotation from an…
CVE-2026-71474 - CVSS 7.1 (high), 2026-08-11: A flaw was found in insights-client. When the application receives a non-200 response, it logs the request headers, which can include the cloud.openshift.com…
CVE-2026-71468 - CVSS 5.3 (medium), 2026-08-11: A flaw was found in acm-search-v2-api-rhel9. When the `getFederationConfig` function refreshes its cache, it improperly reuses a user's bearer token for all…
CVE-2026-71475 - CVSS 6.8 (medium), 2026-08-11: A flaw was found in insights-client. A compromised managed cluster, referred to as a 'spoke', can inject unencoded data into the Insights API URL path. This…
CVE-2026-71845 - CVSS 7.7 (high), 2026-08-11: A flaw was found in insights-client. The setDefault() function logs the value of every environment variable it processes, including CCX_TOKEN, a bearer…
CVE-2026-71467 - CVSS 7.5 (high), 2026-08-11: A flaw was found in search-v2-api. The authentication middleware in the affected component unconditionally skips authentication when a request includes an…
CVE-2026-10090 - CVSS 9 (critical), 2026-08-05: A flaw was found in the Application Subscription controller (multicluster-operators-subscription) of Red Hat Advanced Cluster Management for Kubernetes (ACM).…
CVE-2026-16242 - CVSS 9.4 (critical), 2026-07-20: A flaw was found in the Konnectivity proxy-server configuration for hosted control planes. The agent-facing listener was started without --cluster-ca-cert…
CVE-2026-13676 - CVSS 7.5 (high), 2026-06-29: fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs. The IDN conversion path calls a helper that…
CVE-2026-49980 - CVSS 9.8 (critical), 2026-06-24: Rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.46.0 until 1.74.3, rclone rcd --rc-serve…
CVE-2026-44990 - CVSS 9.3 (critical), 2026-06-12: ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Under the default…
CVE-2026-12143 - CVSS 8.7 (high), 2026-06-12: form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the `field` argument to `FormData#append` and the…
CVE-2026-44495 - CVSS 7.7 (high), 2026-06-11: Axios is a promise based HTTP client for the browser and Node.js. From 0.19.0 to before 0.31.1 and 1.15.2, Axios contains prototype-pollution gadgets in…
CVE-2026-44494 - CVSS 8.7 (high), 2026-06-11: Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.16.0, the Axios library is vulnerable to a Prototype Pollution…
CVE-2026-44492 - CVSS 8.6 (high), 2026-06-11: Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios does not normalise IPv4-mapped IPv6 addresses. When…
CVE-2026-44496 - CVSS 7.5 (high), 2026-06-11: Axios is a promise based HTTP client for the browser and Node.js. Axios versions before 0.32.0 on the 0.x line and before 1.16.0 on the 1.x line build a…
CVE-2026-44488 - CVSS 7.5 (high), 2026-06-11: Axios is a promise based HTTP client for the browser and Node.js. Axios versions 1.7.0 through 1.15.x did not enforce configured request and response size…
CVE-2026-44487 - CVSS 8.2 (high), 2026-06-11: Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’s Node.js HTTP adapter may forward a Proxy-Authorization…
CVE-2026-44486 - CVSS 7.5 (high), 2026-06-11: Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’ Node.js HTTP adapter can leak proxy credentials to a…
CVE-2026-45447 - CVSS 8.8 (high), 2026-06-09: Issue summary: A specially crafted PKCS#7 or S/MIME signed message could trigger a use-after-free during PKCS#7 signature verification. Impact summary: A…
CVE-2026-11332 - CVSS 7.8 (high), 2026-06-05: A flaw was found in ansible-core. The ansible-galaxy role install command processes dependency specifications from a role's meta/requirements.yml file. Due to…
CVE-2026-10732 - CVSS 7.5 (high), 2026-06-05: All versions of the package decompress are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) when extracting a ZIP archive containing two…
CVE-2026-41567 - CVSS 7.5 (high), 2026-06-05: Moby is an open source container framework. In versions prior to 29.5.1 and in moby/moby v2 prior to v2.0.0-beta.14, when a compressed archive is uploaded to…
CVE-2026-27145 - CVSS 7.5 (high), 2026-06-02: (*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused…
CVE-2026-46385 - CVSS 8.7 (high), 2026-05-29: iskorotkov/avro is a fast Go Avro codec. Prior to 2.33.0, the Avro array and map decoders looped over an attacker-controlled block-count value without…
CVE-2026-46384 - CVSS 8.7 (high), 2026-05-29: iskorotkov/avro is a fast Go Avro codec. Prior to 2.33.0, several Avro decoder paths read attacker-controlled 64-bit values from the wire format and either…
CVE-2026-44724 - CVSS 7.8 (high), 2026-05-27: systeminformation is a System and OS information library for node.js. From 4.17.0 to 5.31.5, on Linux, systeminformation is vulnerable to command injection in…
CVE-2026-39821 - CVSS 9.6 (critical), 2026-05-22: The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com")…
CVE-2026-42508 - CVSS 9.1 (critical), 2026-05-22: Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for…
CVE-2026-46595 - CVSS 10 (critical), 2026-05-22: Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key,…
CVE-2026-39835 - CVSS 7.5 (high), 2026-05-22: SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting…
CVE-2026-39830 - CVSS 9.1 (critical), 2026-05-22: A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blocked goroutine…
CVE-2026-39829 - CVSS 7.5 (high), 2026-05-22: The RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key with an excessively large modulus or DSA parameter…
CVE-2026-39828 - CVSS 8.8 (high), 2026-05-22: When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially…
CVE-2026-39832 - CVSS 9.1 (critical), 2026-05-22: When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were not serialized in the request. Destination…
CVE-2026-42338 - CVSS 8.1 (high), 2026-05-12: ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.1.1, Address6.group() and Address6.link() do not…
CVE-2026-42264 - CVSS 9.1 (critical), 2026-05-08: Axios is a promise based HTTP client for the browser and Node.js. From version 1.0.0 to before version 1.15.2, fFive config properties (auth, baseURL,…
CVE-2026-42499 - CVSS 7.5 (high), 2026-05-07: Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.
CVE-2026-39820 - CVSS 7.5 (high), 2026-05-07: Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations.
CVE-2026-33814 - CVSS 7.5 (high), 2026-05-07: When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a…
CVE-2026-33811 - CVSS 7.5 (high), 2026-05-07: When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.
CVE-2026-35579 - CVSS 9.8 (critical), 2026-05-05: CoreDNS is a DNS server written in Go. In versions prior to 1.14.3, the gRPC, QUIC, DoH, and DoH3 transport implementations incorrectly handle TSIG…
CVE-2026-6322 - CVSS 7.5 (high), 2026-05-05: fast-uri normalize() decoded percent-encoded authority delimiters inside the host component and then re-emitted them as raw delimiters during serialization. A…
CVE-2026-43869 - CVSS 7.3 (high), 2026-05-05: Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended…
CVE-2026-42151 - CVSS 7.5 (high), 2026-05-04: Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the client_secret field in the Azure AD remote…
CVE-2026-42154 - CVSS 7.5 (high), 2026-05-04: Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the remote read endpoint (/api/v1/read) does not…
CVE-2025-14576 - CVSS 7.8 (high), 2026-04-30: Insufficient validation of node IDs in Qt SVG module allows arbitrary QML/JavaScript code injection when loading malicious SVG files through the VectorImage…
CVE-2026-41602 - CVSS 7.5 (high), 2026-04-28: Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation This issue affects Apache Thrift: before 0.23.0.…
CVE-2026-41606 - CVSS 7.5 (high), 2026-04-28: Uncontrolled Recursion vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0,…
CVE-2026-41605 - CVSS 7.7 (high), 2026-04-28: Integer Overflow or Wraparound vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version…
CVE-2026-41604 - CVSS 8.2 (high), 2026-04-28: Out-of-bounds Read vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which…
CVE-2026-41607 - CVSS 9.1 (critical), 2026-04-28: Out-of-bounds Read vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which…
CVE-2025-48431 - CVSS 7.5 (high), 2026-04-28: Mismatched Memory Management Routines vulnerability in Apache Thrift c_glib language bindings. This issue affects Apache Thrift: before 0.23.0. Users are…
CVE-2026-3006 - CVSS 7 (high), 2026-04-27: Successful exploitation of the race condition vulnerability could allow an attacker to trigger a kernel heap overflow, potentially leading to local privilege…
CVE-2026-42044 - CVSS 9.1 (critical), 2026-04-24: Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.15.2, he Axios library is vulnerable to a Prototype Pollution…
CVE-2026-42043 - CVSS 10 (critical), 2026-04-24: Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, an attacker who can influence the target URL of an Axios request…
CVE-2026-42041 - CVSS 8.2 (high), 2026-04-24: Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the Axios library is vulnerable to a Prototype Pollution…
CVE-2026-42039 - CVSS 7.5 (high), 2026-04-24: Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, toFormData recursively walks nested objects with no depth limit,…
CVE-2026-42033 - CVSS 7.4 (high), 2026-04-24: Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, when Object.prototype has been polluted by any co-dependency…
CVE-2026-21728 - CVSS 7.5 (high), 2026-04-24: Tempo queries with large limits can cause large memory allocations which can impact the availability of the service, depending on its deployment strategy.…
CVE-2026-41176 - CVSS 9.8 (critical), 2026-04-23: Rclone is a command-line program to sync files and directories to and from different cloud storage providers. The RC endpoint `options/set` is exposed without…
CVE-2026-41179 - CVSS 9.8 (critical), 2026-04-23: Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Starting in version 1.48.0 and prior to version…
CVE-2026-40895 - CVSS 7.5 (high), 2026-04-21: follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. Prior to 1.16.0, when an…
CVE-2026-40293 - CVSS 7.5 (high), 2026-04-17: OpenFGA is an authorization/permission engine built for developers. In versions 0.1.4 through 1.13.1, when OpenFGA is configured to use preshared-key…