Red Hat vulnerabilities
2,566 CVEs and advisories name Red Hat as an affected vendor, 2 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-66782Submariner-operator: operator clusterrole grants cluster-wide create/update on all configmaps
- CVE-2026-66781Submariner-operator: pprof debug endpoint enabled by default on 0.0.0.0:8082 without authentication
- CVE-2026-18963Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass
- CVE-2026-75924Managed-serviceaccount: managed-serviceaccount: hub addon-manager clusterrole grants cluster-wide secret read/write and csr approval
- CVE-2026-71365Awx: webhook status callback ssrf leaks the git pat
- CVE-2026-12564Automation-controller: automation-controller: kubernetes service account token exfiltration via hashicorp vault credential ssrf
- CVE-2026-75485Must-gather: /tmp/kubeconfig retention
- CVE-2026-73834Must-gather: must-gather: embedded secret data in acm wrapper crs collected without redaction
- CVE-2026-66793Governance-policy-addon-controller: governance-policy-addon-controller: arbitrary container image override via managedclusteraddon annotation enables rce on spoke
- CVE-2026-75032Bluez: bluez: out-of-bounds read in avrcp parse_media_element and parse_media_folder
- CVE-2026-19608Keycloak-services: keycloak-services: name-only group claims let same-name groups satisfy path-specific group policies
- CVE-2026-66795Managedcluster-import-controller: csr auto-approver does not validate certificate subject or signername (spoke→hub cluster-admin)
- CVE-2026-71472Acm-search-v2-rhel9: search-v2-operator: shell-command and sql injection in postgresql-start.sh via cr-supplied work_mem
- CVE-2026-70495Search-v2-operator: search-v2-operator: cluster-wide impersonate on users/groups shared across 4 pods grants hub system:masters
- CVE-2026-66792Multicloud-operators-subscription: multicloud-operators-subscription: isclusteradmin() trusts user-settable annotations on managed clusters
- CVE-2026-15218Models-as-a-service: red hat openshift ai: maas-api and maas-controller serviceaccounts with excessive permissions lead to privilege escalation
- CVE-2026-74247Quay: ssrf via build archive_url in quay build api
- CVE-2026-74245Quay: unauthenticated exported logs download in quay
- CVE-2026-74244Quay: stripe webhook accepts forged events without signature verification in quay
- CVE-2026-74243Quay: unauthenticated secscan notification endpoint in quay when psk is unset
- CVE-2026-74242Quay: repository notification uuid idor in quay api
- CVE-2026-74241Quay: ldap referral filter injection in quay external ldap authentication
- CVE-2026-74240Quay: jwt claim validation bypasses in quay federated robot and sso authentication
- CVE-2026-13002Dnsmasq: infinite loop dos in dnssec nsec/nsec3 type bitmap parsing
- CVE-2026-19879Io.undertow/undertow: undertow: http response header integrity issue due to character truncation
- CVE-2026-58224Samba: ctdb fails to do integrity checking of received packets
- CVE-2026-19617Libdm: lvm2: libdm: denial of service via uncontrolled recursion in config parser
- CVE-2026-19730Podman: podman: quadlet install --replace non-truncating write retains removed host-access directives
- CVE-2026-73266Clusterclaims-controller: confused deputy: tenant-controlled clusterclaim labels propagated to managedcluster, enabling cross-tenant managedclusterset join
- CVE-2026-73584Sblim-sfcb: sblim-sfcb: privileged file corruption and denial of service via insecure temporary file handling