Red Hat vulnerabilities
2,566 CVEs and advisories name Red Hat as an affected vendor, 2 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-73267Clusterclaims-controller: managedcluster deletion keyed solely on clusterclaim.spec.namespace with no local ownership check
- CVE-2026-73137Multicloud-operators-subscription: multicloud-operators-subscription: cross-namespace secret exfiltration via helmrelease.repo.secretref.namespace
- CVE-2026-67567Multicloud-operators-subscription: multicloud-operators-subscription: helmrelease chart applied with controller sa without gvk or namespace restriction
- CVE-2026-66788Lighthouse: lighthouse: arbitrary namespace injection via attacker-controlled broker label
- CVE-2026-66787Lighthouse: lighthouse: cross-cluster dns spoofing via unvalidated endpointslice ip addresses
- CVE-2026-66785Submariner: submariner: missing validation of remote endpoint subnets and clusterid enables cross-cluster traffic hijack
- CVE-2026-77176Kata-containers: insufficient validation of createcontainer mount and storage rules in genpolicy
- CVE-2026-19611Wildfly-elytron: org.wildfly.security/wildfly-elytron-password-impl: wildfly-elytron: password keyspace reduction via nfkc fullwidth folding
- CVE-2026-73199Ipa: freeipa: null pointer dereference in `ipa-enrollment` extended operation (`join_oid`) via missing request value
- CVE-2026-11861Freeipa: idm: ipa: freeipa: obtaining tgs with impersonating cname through trust relationships
- CVE-2026-73198Ipa: freeipa: unauthenticated dos in `/ipa/i18n_messages` via unbounded request body read
- CVE-2026-13097Ipa: privilege escalation via krbcanonicalname manipulation due to realm-unaware uniqueness enforcement in freeipa ldap datastore
- CVE-2026-73196Ipa: freeipa: authenticated dos in `otptoken-add` via unbounded otp key decoding/re-encoding
- CVE-2026-73197Ipa: freeipa: unauthenticated dos in `/ipa/migration/migration.py` via unbounded request body read
- CVE-2026-18917Libvirt: integer overflow in nodegetfreepages rpc handler leading to heap buffer overflow
- CVE-2026-77014Libsoup: libsoup: integer truncation in sort_ranges() comparator causes silent omission of http range responses
- CVE-2026-76827Search-indexer: search-indexer: update/delete operations not scoped to caller's cluster (cross-tenant data tampering)
- CVE-2026-76139Acm-operator-bundle: acm-operator-bundle: bundle build execs unpinned stolostron/release@master with full build credentials
- CVE-2026-75569Mce-operator-bundle: all github actions pinned by mutable tag, not commit sha
- CVE-2026-70496Search-v2-operator: search-v2-operator: operator clusterrole is cluster-admin equivalent via impersonate, rbac write, csr approve, and manifestwork
- CVE-2026-18874Volsync-addon-controller: volsync-addon-controller: annotation values rendered into yaml via text/template without escaping allows yaml injection into subscription
- CVE-2026-66794Cluster-proxy-addon: cluster-proxy-addon: unauthenticated ssrf to arbitrary managed-cluster services via public route
- CVE-2026-71470Acm-search-v2-rhel9: search-v2-operator: search cr imageoverride/arguments/envvar flow unsanitized into pods running impersonating sa
- CVE-2026-43961Vim: vimscript injection via unescaped filename in netrw s:netrwmarkfile() filter() expression allows arbitrary code execution
- CVE-2026-76235Cockpit-ws: cockpit: cockpit-ws: unauthenticated remote memory leak via cockpitlang cookie in send_login_html
- CVE-2026-76166Modcluster-core: mod_cluster advertise listener: unauthenticated dos via crafted multicast datagram
- CVE-2026-75900Swtpm: swtpm: out-of-bounds read in swtpm_nvram_checkheader due to sizeof(pointer) vs sizeof(struct) mismatch
- CVE-2026-15571Keycloak-services: keycloak-services: predictable account-linking hash enables account takeover via malicious oidc client
- CVE-2026-66780Submariner-operator: broker serviceaccount secret (token + ca) logged in full at trace verbosity
- CVE-2026-66783Submariner-operator: release workflow consumes same-org composite action via mutable @devel branch ref