Red Hat vulnerabilities
2,566 CVEs and advisories name Red Hat as an affected vendor, 2 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-18982Odh-training-operator-rhel9: rhoai fork aggregates training job create onto native edit/admin clusterroles
- CVE-2026-18951Odh-training-operator-rhel9: [trainer v2 security] trn-02: rhoai overlay aggregates trainjobs crud into standard edit clusterrole
- CVE-2026-18950Odh-dashboard: odh-dashboard: confused-deputy privilege escalation via unchecked roleref in rolebinding creation
- CVE-2026-18949Odh-dashboard: odh-dashboard: clusterrole grants cluster-wide crud on secrets and rbac management resources
- CVE-2026-18948Feast: feast: unsafe dill deserialization of registry-stored udfs — rce on feature server and registry server
- CVE-2026-18947Feast: feast: authorization bypass in /materialize endpoints enables dos via unauthorized full re-materialization
- CVE-2026-18942Feast-operator: feast: feast apply cronjob runs user python with feature-server sa — tenant code to sa token escalation
- CVE-2026-18941Feast: feast-operator: feast: default authentication mode is no_auth — shared multi-tenant instances deployed without authentication
- CVE-2026-18621Data-sciences-pipeline: dsp: v1 argo template path accepts arbitrary workflow spec, bypassing all v2 security hardening
- CVE-2026-18617Data-science-pipelines-operator: dspo: mysql dsn parameter injection via customextraparams enables local infile file exfiltration from operator pod
- CVE-2026-18608Data-science-pipelines-operator: dspo: operator clusterrole grants pods/exec:*, kubeflow.org */*, and clusterrole/binding crud cluster-wide
- CVE-2026-16456Odh-model-controller: odh-model-controller: cross-namespace secret read via nim account crd confused deputy
- CVE-2026-15581Trustyai-service-operator: trustyai-service-operator: tas internal service bypasses kube-rbac-proxy, exposing unauthenticated quarkus api cluster-wide
- CVE-2026-15467Trustyai-service-operator: trustyai-service-operator: lmevaljob sidecar containers bypass protected environment variable filtering, allowing trust_remote_code policy override
- CVE-2026-14450Maas-billing: maas api: privilege escalation via forged http headers due to missing authentication
- CVE-2026-13717Rhoai maas: llm-d: maas/llm-d inference gateway: default allowedroutes.namespaces.from: all allows namespace users to hijack shared model-serving traffic (tokens, prompts, outputs)
- CVE-2026-59091Gimp: gimp: multiple vulnerabilities in file format plugins via crafted image file
- CVE-2026-71577Multicluster-global-hub: multicluster-global-hub: spec-topic read acl leaks bootstrap kubeconfigs to all managed hubs during migration
- CVE-2026-63623Libvirt: information disclosure via world-readable storage volume images during clone/convert
- CVE-2026-71576Multicluster-global-hub: multicluster-global-hub: manager trusts self-asserted evt.source() for leaf-hub identity in all status handlers
- CVE-2026-19278Stackrox: stackrox: privilege escalation via unanchored regular expressions in auth m2m role mappings
- CVE-2026-59090Gimp: gimp: arbitrary code execution in psd plugin due to unsigned underflow
- CVE-2026-59088Gimp: gimp: denial of service via signed integer overflow in fli file processing
- CVE-2026-59087Gimp: heap buffer overflow in `file-seattle-filmworks` load — `fread` writes attacker-controlled length into undersized allocation
- CVE-2026-19404389-ds-base: 389-ds-base: missing authorization allows anonymous clients to start or abort cleanallruv replication maintenance
- CVE-2026-19389Gstreamer: gstreamer1-plugins-ugly-free: gstreamer: integer overflow/underflow in asfdemux bounds checks leading to out-of-bounds read
- CVE-2026-19387Gstreamer: gstreamer1-plugins-bad-free: gstreamer: heap out-of-bounds write in adpcmdec ima/dvi adpcm decoder
- CVE-2026-42170Gimp: gimp dds plug-in heap-based buffer overflow via bpp mismatch in load_layer() (ddsread.c)
- CVE-2026-61477Libvirt: libvirt: newline injection in network xml dns txt/srv fields allows dnsmasq config directive injection
- CVE-2026-15816Dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die()