Quarkus REST Data Panache generates CRUD REST endpoints from entities or repositories. If a developer customizes an operation with @MethodProperties without re-declaring security roles, the code generator drops the class-level security requirement, so the endpoint becomes accessible without authentication. An unauthenticated remote attacker can then potentially read or modify data exposed through the affected endpoint.
Red Hat · Quarkus REST Data Panache
openstack-network-exporter in Red Hat OpenStack Platform 18.0 silently skips basic authentication when user authentication is configured but TLS is omitted or misconfigured. An adjacent network attacker can then read Open vSwitch (OVS) and Open Virtual Network (OVN) dataplane metrics without credentials, including bridge names, port counters, OVN controller state and host topology. Red Hat rates the impact as Moderate because the access is read-only; a fixed version is not yet known.
Red Hat · openstack-network-exporter
An authenticated user of the OpenShift web console can supply a crafted Helm chart URL that is not properly validated. The console pod then fetches arbitrary URLs, which can expose sensitive information through error messages or allow blind port scanning of internal cluster services. Any valid console login is sufficient, so the risk depends on how many accounts exist, including developer and shared accounts. The CVSS score is 7.7 (High); the CVE record is still awaiting NVD analysis.
Red Hat · OpenShift Container Platform
ansible-core, the engine behind Ansible and Red Hat Ansible Automation Platform, is affected when ansible-galaxy installs a collection. The archive extractor validates paths lexically and does not check symlinked directory entries, so a crafted collection can chain symlinks to write a later file outside the destination directory. An attacker who can get a victim to install a malicious collection can overwrite arbitrary files with the privileges of that user, which can lead to code execution on the control node. The flaw is described as a bypass of the fix for CVE-2020-10691, and user interaction is required.
Red Hat · ansible-core
The ClusterRole insights-operator-gather grants the Insights Operator service account get and list access to secrets in all namespaces, without restriction. An attacker who can create a pod that runs with this service account can read every secret in the cluster. Red Hat rates the issue with CVSS 7.7 (High), and the attack needs low privileges and network access to the cluster.
Red Hat · OpenShift Container Platform
A flaw in the Candlepin subscription-management component of Red Hat Satellite lets an authenticated low-privilege user bypass authorization checks on multi-object API endpoints. Once the attacker can access the first referenced object, subsequent objects are not properly checked, so consumer data can be read and entitlements or activation keys can be modified, potentially across organizations. Exploitation requires knowledge of target resource identifiers such as consumer UUIDs, pool IDs or certificate serials, which are normally not visible across organizations. Red Hat rates the issue as Important, and the impact is highest in multi-tenant deployments.
Red Hat · Satellite
SSSD evaluates Host-Based Access Control (HBAC) rules in trust-enabled Identity Management environments by comparing only short usernames without domain qualifiers. An authenticated user in a trusted domain who shares a username with an authorized local IdM account can bypass the access policy and reach protected services or hosts. Red Hat rates the issue at 6.8 (Medium) because exploitation requires a non-default trust setup and an account collision, while NVD rates it at 8.1 (High).
Red Hat · SSSD
The postgres-exporter exposes Go net/http/pprof debug endpoints on its unauthenticated metrics listener. A remote attacker with access to the cluster network can read process arguments, goroutine stacks and heap dumps, which may contain database connection strings or passwords. Repeated CPU profiling requests can also cause a denial of service.
Red Hat · Multicluster Global Hub (postgres-exporter)
The HyperShift operator copies user-provided kubeconfig Secrets into the privileged control plane namespace without validation. An authenticated user with permission to create clusters and Secrets can supply a kubeconfig containing unauthorized executable plugins. When downstream controllers consume this configuration, the attacker can execute arbitrary code within the control plane, which can lead to full compromise of confidentiality, integrity and availability. The attack requires valid credentials and tenant-level rights, not anonymous network access.
Red Hat · Multicluster Engine for Kubernetes
A flaw in the EST subsystem of Dogtag PKI (pki-core), the certificate authority software in Red Hat Certificate System, lets an authenticated EST user obtain CA-signed certificates with arbitrary subject names. The CMCAuthForEST plugin fails open for fullcmc enrollment requests sent via HTTP Basic authentication without an end-user TLS client certificate, so downstream checks treat the request as agent-privileged. Exploitation requires EST to be enabled and reachable with Basic authentication; the CVSS score is 8.1 (High).
Red Hat · Dogtag PKI
The LDAP server 389-ds-base (Red Hat Directory Server) keeps plaintext data buffered before a StartTLS upgrade. An on-path attacker can inject a crafted LDAP message that is processed after the TLS upgrade, so the client receives a forged response in place of its own bind response (message ID collision). This can make a client application treat a failed authentication as successful. Exploitation requires an active man-in-the-middle position on the network path during StartTLS negotiation; the server itself is not compromised.
Red Hat · 389-ds-base
An unauthenticated remote attacker can exhaust the worker-thread pool of the 389 Directory Server (389-ds-base) LDAP server. By sending a complete LDAP operation followed by the first bytes of an incomplete LDAPMessage on the same connection, the attacker blocks worker threads using only a small number of connections. This works against the default configuration and denies service to all clients, anonymous and authenticated, over plaintext and TLS, for as long as the attacker keeps the connections open. Confidentiality and integrity of directory data are not affected, and service recovers within about a second after the connections are released.
Red Hat · 389 Directory Server
Red Hat Satellite (based on Foreman) contains an OS command injection flaw in the foreman-tail utility. The utility passes user-supplied arguments unsanitized and unquoted to eval when expanding file paths. A local attacker with a low-privilege account can inject shell metacharacters to run arbitrary system commands on the Satellite or Foreman server, which manages many hosts. The CVSS score differs between sources: the CVE data lists 7.8, while the Foreman project and OpenCVE list 5.3.
Red Hat · Satellite
A flaw in Foreman, which Red Hat Satellite is built on, allows an authenticated user with only the Viewer role to submit requests to template preview endpoints. This can expose sensitive host data, such as host root passwords. If Safemode is disabled or bypassed, the user may also execute arbitrary commands as the Foreman system account.
Red Hat · Satellite
Red Hat Satellite, which is based on the Foreman project, contains a flaw in its template rendering engine. An authenticated attacker with low-level read permissions can manipulate the permitted methods list to bypass the Safemode sandbox and execute arbitrary commands on the Satellite server. Successful exploitation would give the attacker control over a server that holds credentials and manages provisioning and patching of managed hosts.
Red Hat · Satellite
Red Hat Satellite 6 includes Foreman, whose foreman-rake configuration logic processes configuration data through two execution layers. This enables Server-Side Template Injection (SSTI) and insecure deserialization. An attacker with high privileges and user interaction can achieve remote code execution, which may lead to a full compromise of the managed infrastructure.
Red Hat · Satellite
Foreman, the basis of Red Hat Satellite, contains OS command injection flaws in the foreman-rake db:dump and db:import_dump tasks. User-supplied values in the destination and file parameters are passed unsanitized to a Ruby system() call. An attacker who may run foreman-rake, for example through a restricted sudo rule, can append shell commands and have them executed with high impact on the host and its database. Exploitation requires local access and high privileges.
Red Hat · Satellite (Foreman)
Red Hat Satellite, which is built on the upstream Foreman project, contains a command injection flaw in the foreman-rake errors:fetch_log task. The request_id parameter reaches a shell command without adequate neutralization. A local user with sudo permission to run this rake task can inject shell metacharacters and execute arbitrary code, potentially escalating to root on managed hosts (CVSS 3.1: 8.2).
Red Hat · Satellite
The /unattended/provision endpoint of Red Hat Satellite (upstream Foreman) does not properly verify the provisioning token in the HTTP request. It only checks whether a host is currently being provisioned, so a request without any token can retrieve the kickstart provisioning template. Reported impact includes root password hashes, internal network details and build tokens, which can enable follow-on attacks. The attack requires only network access to the Satellite instance and a host in the provisioning phase.
Red Hat · Satellite
The rubygem-foreman_remote_execution component of Red Hat Satellite contains a command injection flaw in the /api/v2/job_invocations API. If a job template has the effective_user property marked as overridable, the effective_user value supplied in an API request is not properly sanitized. An authenticated user who is allowed to execute job templates can run arbitrary shell commands with the privileges of the execution user on the target hosts.
Red Hat · Satellite
oc-mirror, the OpenShift CLI tool for mirroring container images into disconnected environments, starts an embedded local cache registry that listens on all network interfaces without authentication or encryption. An attacker on an adjacent network can connect to this service to push tampered container images, delete cached images or access mirrored content. No credentials or user interaction are required, but the attacker must be on the same network segment.
Red Hat · oc-mirror
oc-mirror, the tool that mirrors OpenShift operator catalogs into disconnected environments, does not check that extracted tar entries stay inside the target directory. A malicious or compromised operator catalog image can therefore write arbitrary files on the host running oc-mirror, with that process's privileges. The flaw is triggered when mirroring a crafted catalog through the legacy --v1 path or the --use-oci-feature path, and an attacker needs local access to the mirroring workflow.
Red Hat · oc-mirror
A trust-boundary flaw in CRI-O's sandbox state persistence lets attacker-influenced pod annotations or labels overwrite CRI-O's reserved sandbox bookkeeping. After a CRI-O restart or node reboot, a later container recreate in that sandbox can expose a host-side runtime-management socket inside the container, which may enable container escape. Exploitation requires the ability to create or update pods, plus a restart and container recreate, and the attack complexity is high.
Red Hat · CRI-O
A heap-based buffer overflow in the RPM Package Manager allows a crafted, unsigned RPM package to write attacker-controlled data past a heap allocation. The flaw is triggered when a user or automated job runs rpm -qlvp, rpm2cpio or rpm2archive against the untrusted package. Red Hat reports a reliable crash, but code execution has not been demonstrated, and the flaw is not exposed as a network service.
Red Hat · rpm
