Openshift (Redhat) - vulnerabilities (CVEs)

780 CVEs, 75 in the last 30 days, 117 known versions, newest CVE from 2026-10-28. Vendor: Redhat.

CVEs of Openshift

CVE-2026-109411 - CVSS 8.1 (high), 2026-10-28: An access control bypass flaw was found in Samba's vfs_ceph_rgw module in it's openat() function. An authenticated user can bypass access controls to read or…
CVE-2026-116497 - CVSS 5.5 (medium), 2026-10-26: A NULL pointer dereference vulnerability was found in gssproxy. When a GSSX_INIT_SEC_CONTEXT request is received with the target_name field absent, the daemon…
CVE-2026-115449 - CVSS 3.5 (low), 2026-10-22: A flaw was found in libslirp. When handling ICMP echo requests, the reply length is not updated to match the actual data received from the host. Under…
CVE-2026-115424 - CVSS 5.5 (medium), 2026-10-22: A flaw was found in the OpenShift client oc. When extracting container image layers with oc image extract, the application fails to properly sanitize symbolic…
CVE-2026-114406 - CVSS 6.8 (medium), 2026-10-21: The system certificate authority (CA) store in Red Hat products, distributed via ca-certificates RPM packages, included multiple root CA certificates of…
CVE-2026-114236 - CVSS 3.3 (low), 2026-10-21: storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer may, when processing corrupt or malicious inputs, leak a file descriptor; unbounded repeated calls…
CVE-2026-92824 - CVSS 6.2 (medium), 2026-10-21: A flaw was found in libmodulemd. In the module stream v2 rpm-map emission path, an inner loop incorrectly uses the count of digest algorithms as its bound…
CVE-2026-92823 - CVSS 6.2 (medium), 2026-10-21: A flaw was found in libmodulemd. In builds with rpmio support enabled, compressed modulemd YAML is decompressed through a custom read handler that does not…
CVE-2026-92822 - CVSS 6.2 (medium), 2026-10-21: A flaw was found in libmodulemd. When parsing module metadata, the xmd field is converted into nested GVariant values through recursive YAML mapping and…
CVE-2026-114038 - CVSS 5.1 (medium), 2026-10-21: A flaw was found in device-mapper-multipath. A local user can trigger an out-of-bounds read by sending a command with a format string ending in a trailing…
CVE-2026-16460 - CVSS 7.4 (high), 2026-10-19: A flaw was found in bootc and ostree. Already-staged deployments are finalized without revalidating the deployment's container image against the current…
CVE-2026-89096 - CVSS 5.9 (medium), 2026-10-16: A flaw was found in nfs-utils. An unauthenticated remote attacker can trigger a Denial of Service (DoS) by sending repeated state notification requests to an…
CVE-2026-85977 - CVSS 5.3 (medium), 2026-10-16: A flaw was found in libtirpc. A remote attacker can exploit this vulnerability by sending specially crafted PMAPPROC_DUMP replies to a client application that…
CVE-2026-85231 - CVSS 6.5 (medium), 2026-10-16: A flaw was found in libtirpc. An authenticated remote attacker could exploit this vulnerability by sending oversized wrapped data requests to an RPC (Remote…
CVE-2026-89098 - CVSS 5.5 (medium), 2026-10-16: A flaw was found in nfs-utils. The fsidd daemon improperly handles input received over its local domain socket by relying on program assertions to verify…
CVE-2026-111555 - CVSS 6 (medium), 2026-10-16: A flaw was found in luksmeta. Improper boundary validation of metadata slots allows an attacker capable of supplying or modifying a disk header to redirect…
CVE-2026-104715 - CVSS 7.8 (high), 2026-10-16: A flaw was found in cifs-utils. This flaw allows an unprivileged local user to achieve privilege escalation. When a privileged service mounts a Common…
CVE-2026-92982 - CVSS 8.5 (high), 2026-10-15: A flaw was found in Ansible Operator Plugins. A low-privileged Kubernetes user can exploit a Jinja2 template injection vulnerability by crafting malicious…
CVE-2026-86849 - CVSS 6.5 (medium), 2026-10-14: A flaw was found in DPDK lib/vhost vhost-crypto. Integer overflow in chain length checks, and missing length checks on the RSA path, can overflow a host…
CVE-2026-86856 - CVSS 6.5 (medium), 2026-10-14: A flaw was found in the DPDK nfp vDPA driver. Stack and heap buffers sized for a single queue pair can be overflowed when more virtqueues are configured,…
CVE-2026-86847 - CVSS 6.5 (medium), 2026-10-14: A flaw was found in DPDK lib/vhost vhost-crypto. Write-back chain cleanup can follow an uninitialized next pointer when mapping a guest descriptor fails,…
CVE-2026-86846 - CVSS 6.5 (medium), 2026-10-14: A flaw was found in DPDK lib/vhost vhost-crypto. A guest can supply an avail-ring descriptor index that is used without bounds checking, causing an…
CVE-2026-86845 - CVSS 6.5 (medium), 2026-10-14: A flaw was found in DPDK lib/vhost vhost-crypto. Session cleanup can leave a stale cached session pointer, and the data path does not check the session type…
CVE-2026-86566 - CVSS 6.5 (medium), 2026-10-14: A flaw was found in DPDK lib/vhost. A guest with runt RX descriptors can underflow the copy length in vhost enqueue, causing a denial of service in a shared…
CVE-2026-86848 - CVSS 8.8 (high), 2026-10-14: A flaw was found in DPDK lib/vhost vhost-crypto. The indirect-descriptor snapshot double-fetches a guest descriptor next index, allowing a malicious guest to…
CVE-2026-86567 - CVSS 8.8 (high), 2026-10-14: A flaw was found in DPDK lib/vhost. The VDUSE handler fails to invalidate vring pointers when the IOTLB is invalidated, leading to use-after-unmap.
CVE-2026-100236 - CVSS 8.6 (high), 2026-10-14: A flaw was found in the DPDK GSO library. When software GSO copies packet headers into a new mbuf, it does not check that the header fits in the source first…
CVE-2026-86565 - CVSS 8.2 (high), 2026-10-14: A flaw was found in DPDK lib/vhost. A guest can desynchronize virtqueue size from inflight descriptor table size, causing an out-of-bounds write in the host…
CVE-2026-86563 - CVSS 7.8 (high), 2026-10-14: A flaw was found in DPDK lib/vhost. A double-offset bug in vhost log mapping calculation can lead to incorrect memory access.
CVE-2026-86562 - CVSS 7.8 (high), 2026-10-14: A flaw was found in DPDK lib/vhost. A TOCTOU double-fetch of control-queue descriptors allows a heap buffer overflow with attacker-controlled content in the…
CVE-2026-86561 - CVSS 6.5 (medium), 2026-10-14: A flaw was found in DPDK lib/vhost. Memory size is not adequately validated before mmap during vhost memory-region setup, which can lead to a host crash or…
CVE-2026-93683 - CVSS 6.4 (medium), 2026-10-14: A flaw was found in the DPDK vhost library. When handling a virtio indirect descriptor table, the host reads the table length more than once from guest memory…
CVE-2026-109968 - CVSS 5.5 (medium), 2026-10-14: A flaw was found in the clevis PKCS#11 pin. The clevis-pkcs11-afunix-socket-unlock daemon logs LUKS disk encryption passphrases in plaintext to a log file.…
CVE-2026-104795 - CVSS 8.8 (high), 2026-10-14: The insights-runtime-extractor runs as a privileged DaemonSet (`hostPID: true`) that scans container processes for runtime fingerprinting. When scanning a…
CVE-2026-109971 - CVSS 4.7 (medium), 2026-10-14: A flaw was found in the clevis PKCS#11 pin. The clevis-decrypt-pkcs11 script passes the PKCS#11 token PIN as a command-line argument to pkcs11-tool, making it…
CVE-2026-109970 - CVSS 4.7 (medium), 2026-10-14: A flaw was found in the clevis PKCS#11 pin. The clevis-luks-pkcs11-askpin script writes the PKCS#11 token PIN in plaintext to a file without setting…
CVE-2026-109969 - CVSS 4.7 (medium), 2026-10-14: A flaw was found in the clevis PKCS#11 pin. The clevis-pkcs11-afunix-socket-unlock daemon creates AF_UNIX sockets without explicit permission restrictions or…
CVE-2026-110036 - CVSS 3.3 (low), 2026-10-13: A flaw was found in device-mapper-persistent-data. A local attacker can cause a Denial of Service (DoS) by inducing a user or system tool to process crafted…
CVE-2026-109976 - CVSS 4.7 (medium), 2026-10-13: A flaw was found in the clevis PKCS#11 pin. The clevis-pkcs11-afunix-socket-unlock daemon crashes when an AF_UNIX client connects to the data socket without a…
CVE-2026-75888 - CVSS 7.7 (high), 2026-10-12: A flaw was found in the OpenShift console. An authenticated console user can exploit a Server-Side Request Forgery (SSRF) vulnerability by providing a…
CVE-2026-107935 - CVSS 9.3 (critical), 2026-10-09: A path traversal vulnerability was found in gvproxy, the network forwarder provided by the gvisor-tap-vsock package. The unauthenticated…
CVE-2026-89091 - CVSS 8.8 (high), 2026-10-08: A flaw was found in ansible-core. When installing a collection with `ansible-galaxy collection install`, the archive extractor validates member paths using…
CVE-2026-107565 - CVSS 5.1 (medium), 2026-10-08: A flaw was found in luksmeta. A local attacker with administrative privileges can cause data corruption when saving metadata to a Linux Unified Key Setup…
CVE-2026-93017 - CVSS 7.7 (high), 2026-10-08: The `insights-operator-gather` ClusterRole grants the operator's service account read access to secrets in the core API group with no namespace or…
CVE-2026-107176 - CVSS 6.8 (medium), 2026-10-07: A flaw was found in the cluster-samples-operator. The RBAC Role coreos-pull-secret-reader in namespace openshift-config grants get, list, and watch…
CVE-2026-107161 - CVSS 7.5 (high), 2026-10-07: A heap-based buffer overflow flaw was found in Cyrus SASL. The add_to_challenge() function in the DIGEST-MD5 plugin computes the size of the buffer needed for…
CVE-2026-107174 - CVSS 6.4 (medium), 2026-10-07: A flaw was found in source-to-image. When unpacking archive files, the application fails to properly sanitize symbolic links pointing to absolute file paths.…
CVE-2026-80048 - CVSS 5.5 (medium), 2026-10-06: A flaw was found in `sssd-kcm`. A local user or process able to connect to the `sssd-kcm` UNIX socket can exploit this vulnerability. By sending a large…
CVE-2026-104045 - CVSS 4.7 (medium), 2026-10-06: A flaw was found in SSSD. A local user can trigger a Denial of Service (DoS) by exploiting a race condition in the autofs responder between asynchronous…
CVE-2026-104046 - CVSS 6.2 (medium), 2026-10-06: A flaw was found in SSSD (System Security Services Daemon). When Identity Provider (IdP) authentication is enabled, pre-authentication requests retain state…
CVE-2026-104048 - CVSS 8.1 (high), 2026-10-06: A flaw was found in SSSD. In trust-enabled identity management environments, SSSD evaluates Host-Based Access Control (HBAC) rules by stripping domain…
CVE-2026-104047 - CVSS 5.3 (medium), 2026-10-06: A flaw was found in SSSD. When configured to use Microsoft Entra ID, search inputs are not properly sanitized before being incorporated into directory query…
CVE-2026-76061 - CVSS 5.5 (medium), 2026-10-06: A flaw was found in CRI-O's `bind_mount_prefix` handling. When configured with a non-empty `bind_mount_prefix`, a malicious container or local attacker could…
CVE-2026-88252 - CVSS 5.5 (medium), 2026-10-06: A flaw was found in sssd. A local user can cause a Denial of Service (DoS) by exhausting the responder service's available file descriptors (system handles…
CVE-2026-104044 - CVSS 6.2 (medium), 2026-10-06: A flaw was found in sssd. A local attacker can trigger a Denial of Service (DoS) by sending a specially crafted Pluggable Authentication Module (PAM) request…
CVE-2026-104043 - CVSS 5.5 (medium), 2026-10-06: A flaw was found in SSSD. A local attacker with access to the Name Service Switch (NSS) responder UNIX socket can trigger an integer underflow by sending a…
CVE-2026-104042 - CVSS 5.5 (medium), 2026-10-06: A flaw was found in sssd. A local attacker can cause a Denial of Service (DoS) by sending a crafted Pluggable Authentication Module (PAM) request containing a…
CVE-2026-104041 - CVSS 5.5 (medium), 2026-10-06: A flaw was found in SSSD. An unprivileged local user can repeatedly request lookups for nonexistent entries through the Name Service Switch (NSS) responder.…
CVE-2026-104040 - CVSS 6.1 (medium), 2026-10-06: A flaw was found in SSSD. When configured with the Entra ID identity provider, input lookup names containing single quotes are not properly escaped before…
CVE-2026-104039 - CVSS 4.7 (medium), 2026-10-06: A flaw was found in SSSD. A local user can cause a denial of service (DoS) by disrupting system authentication services. When handling Generic Security…
CVE-2026-104038 - CVSS 5.9 (medium), 2026-10-06: A flaw was found in sssd. A remote attacker can cause a denial of service (DoS) by submitting a certificate that lacks an expected Security Identifier (SID)…
CVE-2026-104037 - CVSS 5.5 (medium), 2026-10-06: A flaw was found in SSSD. A local attacker can exploit this issue by sending a specially crafted request with an invalid packet length to the autofs responder…
CVE-2026-92821 - CVSS 6.8 (medium), 2026-10-06: A flaw was found in SSSD. When configured to evaluate password expiration warnings before restrictive access rules in LDAP (Lightweight Directory Access…
CVE-2026-104036 - CVSS 5.8 (medium), 2026-10-06: A flaw was found in SSSD's NFS idmap plugin. When retrieving cached user or group names, the plugin detects if an entry exceeds the destination buffer size…
CVE-2026-104035 - CVSS 5.5 (medium), 2026-10-06: A flaw was found in SSSD. An issue in the Kerberos Credential Manager (KCM) responder allows a local user to cause a Denial of Service (DoS) by maintaining a…
CVE-2026-104034 - CVSS 4.7 (medium), 2026-10-06: A flaw was found in SSSD. A use-after-free vulnerability exists in the Kerberos Credential Manager (KCM) responder during Kerberos ticket-granting ticket…
CVE-2026-104033 - CVSS 5.4 (medium), 2026-10-06: A flaw was found in SSSD. When configured to enforce account expiration using LDAP (Lightweight Directory Access Protocol) shadow attributes, SSSD fails to…
CVE-2026-104032 - CVSS 5.5 (medium), 2026-10-06: A flaw was found in SSSD. An unprivileged local user can repeatedly request master automount map updates through the autofs responder due to missing…
CVE-2026-104031 - CVSS 5.5 (medium), 2026-10-06: A flaw was found in SSSD. In configurations where the autofs responder service is enabled, memory allocated during successful request processing is not…
CVE-2026-104029 - CVSS 5.5 (medium), 2026-10-05: A flaw was found in SSSD. A local attacker can exploit this vulnerability by sending a specially crafted request to the autofs responder UNIX socket. Due to…
CVE-2026-104030 - CVSS 5.5 (medium), 2026-10-05: A flaw was found in sssd. This vulnerability allows a local user to cause a Denial of Service (DoS) by submitting a specially crafted passkey authentication…
CVE-2026-96577 - CVSS 7.1 (high), 2026-10-01: A flaw was found in oc-mirror. During mirroring operations, the embedded local cache registry binds to all network interfaces without authentication or…
CVE-2026-83589 - CVSS 6.1 (medium), 2026-10-01: A flaw was found in oauth-proxy. The application fails to properly validate the destination redirect parameter (`rd`) during post-login redirection. A remote…
CVE-2026-101295 - CVSS 7.3 (high), 2026-09-30: Path traversal / arbitrary file write in oc-mirror's operator catalog image extraction. When mirroring operator catalogs using either the legacy v1 path…
CVE-2026-62146 - CVSS 7.8 (high), 2026-09-30: A trust-boundary flaw in CRI-O's sandbox state persistence allows attacker-influenced pod metadata to overwrite CRI-O's own reserved sandbox bookkeeping; once…
CVE-2026-102010 - CVSS 7 (high), 2026-09-28: A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the library reallocates storage but…
CVE-2026-87114 - CVSS 7.1 (high), 2026-09-28: A flaw was found in kube-compare. When processing a 'container://' reference path, the tool incorrectly executes an untrusted container image's entrypoint…
CVE-2026-93834 - CVSS 8.8 (high), 2026-09-25: A use-after-free vulnerability was found in QEMU's 9pfs subsystem. A race condition between the main thread and a worker thread when processing concurrent…
CVE-2026-75887 - CVSS 7.5 (high), 2026-09-23: A flaw was found in the OpenShift console. An unauthenticated attacker can exploit a path traversal vulnerability by manipulating the `lng` and `ns` query…
CVE-2026-75886 - CVSS 7.2 (high), 2026-09-23: A flaw was found in openshift/console. An unauthenticated remote attacker can exploit a misconfiguration in the CatalogdHandler, which lacks proper…
CVE-2026-90462 - CVSS 5.4 (medium), 2026-09-22: A flaw was found in SSSD. When configured with the LDAP access provider and `ldap_access_order` including `ppolicy` or `lockout`, a fail-open condition in the…
CVE-2026-94640 - CVSS 7.5 (high), 2026-09-22: A flaw was found in rpcbind. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service (DoS) by sending a large number of…
CVE-2026-95619 - CVSS 7.7 (high), 2026-09-22: A flaw was found in libstdc++. An integer overflow can occur when processing large inputs to the aligned operator new in the C++ library. This vulnerability…
CVE-2026-95508 - CVSS 7.4 (high), 2026-09-22: A heap-based buffer overflow was found in the DHCPv6 and TFTP response builders of libslirp. When the host is configured with a small interface MTU, a…
CVE-2026-75939 - CVSS 7.4 (high), 2026-09-21: A flaw was found in openshift/oc-mirror. The tool incorrectly verifies PGP (Pretty Good Privacy) release image signatures by checking for signature errors…
CVE-2026-92574 - CVSS 8.8 (high), 2026-09-21: A vulnerability in CRI-O checkpoint restore allows a user who can create a pod from a malicious checkpointed container to bypass the destination Kubernetes…
CVE-2026-15801 - CVSS 8 (high), 2026-09-21: A vulnerability was found in CRI-O related to the container checkpoint and restore feature. When CRI-O is configured to restore containers from checkpoint…
CVE-2026-75885 - CVSS 9.3 (critical), 2026-09-18: A flaw was found in the OpenShift console. Unauthenticated access to the `/api/devfile/` and `/api/devfile/samples/` endpoints allows a remote attacker to…
CVE-2026-81627 - CVSS 8.2 (high), 2026-09-18: A flaw was found in QEMU. The VAPIC setup hypercall in hw/i386/vapic.c does not validate that the writable RAM alias remains within the option ROM window. A…
CVE-2026-76781 - CVSS 5.5 (medium), 2026-09-17: A flaw was found in libxml2. A local user or an attacker providing a specially crafted XML catalog can trigger a NULL pointer dereference during XML catalog…
CVE-2026-42784 - CVSS 7.4 (high), 2026-09-16: A flaw was found in sequoia-openpgp. The library incorrectly infers key flags for older certificates when a key flags subpacket is missing, leading to a…
CVE-2025-11395 - CVSS 5.5 (medium), 2026-09-15: A flaw was found in Podman. If an attacker can pass a crafted tar archive to the `podman load` command, they can create files on the host machine with the…
CVE-2026-79699 - CVSS 4.4 (medium), 2026-09-15: A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout header (e.g. victim/.wh.) can cause the extraction…
CVE-2026-79705 - CVSS 4.5 (medium), 2026-09-15: A flaw was found in the buildah/copier Go package. When used outside of Buildah by a non-root caller, a crafted tar archive containing malicious symlinks can…
CVE-2026-90996 - CVSS 5.5 (medium), 2026-09-14: A flaw was found in sssd. A local unprivileged user could send a specially crafted request with a zero-length body to the Network Security Services (NSS)…
CVE-2026-90995 - CVSS 5.5 (medium), 2026-09-14: A flaw was found in SSSD (System Security Services Daemon). A local attacker with privileges to connect to the PAM (Pluggable Authentication Modules)…
CVE-2026-90994 - CVSS 4 (medium), 2026-09-14: A flaw was found in sssd, specifically within the PAM (Pluggable Authentication Modules) responder's protocol v1 parser, pam_parse_in_data(). A local client…
CVE-2026-90463 - CVSS 4 (medium), 2026-09-14: A flaw was found in the sssd NSS responder. This input validation vulnerability allows a local attacker, by sending specially crafted service lookup requests…
CVE-2026-89329 - CVSS 6.2 (medium), 2026-09-11: A flaw was found in `multipathd`. A local attacker with access to the `multipathd` UNIX control socket can exploit this vulnerability by sending valid…
CVE-2026-84828 - CVSS 6.5 (medium), 2026-09-10: A flaw was found in PCS (Pacemaker Configuration System). A local attacker with membership in the 'haclient' group can exploit the 'pcs host auth --token'…