Filtered by vendor Red Hat Subscriptions
Total 239 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2026-87743 2 Red Hat, Redhat 19 Red Hat Openshift Ai (rhoai), Apicurio Registry, Build Keycloak and 16 more 2026-10-29 7.5 High
A flaw was found in Quarkus HTTP security. An unauthenticated attacker can exploit a discrepancy in how paths are normalized between the security matcher and HTTP request dispatchers. This allows the attacker to craft a URL that the security matcher considers public, but which is then routed to a protected endpoint, leading to an authorization bypass and potential unauthorized access to sensitive information.
CVE-2026-103869 2 Red Hat, Redhat 3 Red Hat Satellite 6, Ansible Automation Platform, Satellite 2026-10-26 6.5 Medium
A flaw was found in pulp-ansible's bearer-token refresh for collection remotes. The access token is kept in one module-level variable and reused for every token download in that worker. A user who can sync an Ansible remote that uses token refresh, and can point that remote at a server they control, receives an access token obtained for a different remote, and can reuse it at the service that issued it. Content stored in Pulp is not changed, and the service is not stopped.
CVE-2026-109194 2 Red Hat, Redhat 3 Red Hat Quay 3, Quay, Red Hat Quay 3 2026-10-25 6.4 Medium
A flaw was found in Red Hat Quay. The build trigger management application programming interface (API) fails to verify whether a requested trigger belongs to the specified repository. An authenticated user with administrative access to any repository can view, modify, or permanently delete build triggers and associated write tokens of another repository if they know the victim trigger's universally unique identifier (UUID).
CVE-2026-17557 2 Red Hat, Redhat 2 Red Hat Openshift Ai (rhoai), Openshift Ai 2026-10-22 6.5 Medium
A flaw was found in the `lm-evaluation-harness` component of Red Hat OpenShift AI. An authenticated user, able to submit an evaluation job, could exploit this by providing a malicious model URL in the `JobSpec`. This vulnerability allows for the disclosure of the tenant's model authentication secret to an attacker-controlled external listener. Additionally, it enables Server-Side Request Forgery (SSRF) attacks against internal network endpoints reachable from the evaluation job pod.
CVE-2026-86332 2 Red Hat, Redhat 2 Red Hat Openshift Ai (rhoai), Openshift Ai 2026-10-22 6.5 Medium
A flaw was found in odh-dashboard in Red Hat OpenShift AI. The backend-for-frontend route GET /api/nim-serving/:nimResource reads Kubernetes Secrets using the dashboard service account and returns the full Secret object, including .data, without an authorization check. Any authenticated dashboard user can retrieve the cluster NVIDIA NGC API key Secret (apiKeySecret) and the NIM image pull secret (nimPullSecret). Create and delete of the same NIM credential are admin-gated; the read path is not. This is missing authorization (CWE-862) and insufficiently protected credentials (CWE-522). It is distinct from CVE-2026-5483 (service-account token leak in the Kubernetes client response wrapper on the same route) and CVE-2026-16456 (odh-model-controller cross-namespace confused deputy).
CVE-2026-15574 2 Red Hat, Redhat 2 Red Hat Openshift Ai (rhoai), Openshift Ai 2026-10-22 7.5 High
A flaw was found in the vllm-orchestrator-gateway component. The system's production binary logs all incoming authorization headers and full chat payloads, which may contain personally identifiable information (PII) and secrets, to persistent logs. This sensitive data, including bearer tokens and chat content, can be accessed by any user with logging privileges. This vulnerability leads to information disclosure, potentially allowing an attacker to harvest credentials and sensitive conversation content.
CVE-2026-18949 2 Red Hat, Redhat 2 Red Hat Openshift Ai (rhoai), Openshift Ai 2026-10-22 8.8 High
A flaw was found in odh-dashboard. This vulnerability allows an attacker, who has compromised the dashboard's Service Account (SA) token, to exploit overly broad permissions granted to the SA. This enables the attacker to escalate their privileges to cluster-administrator level, gain access to sensitive data like credentials and keys across the entire cluster, and disrupt multi-tenant isolation.
CVE-2026-15143 2 Red Hat, Redhat 2 Red Hat Openshift Ai (rhoai), Openshift Ai 2026-10-22 9.3 Critical
A flaw was found in the file_type content detector of guardrails-detectors. This vulnerability allows a remote attacker to supply an arbitrary XML Schema Definition (XSD) string, which is processed without proper restrictions. This can lead to server-side requests to arbitrary URLs or local file reads, potentially resulting in sensitive information disclosure, such as cloud provider credentials or access to internal network services.
CVE-2026-1961 3 Red Hat, Redhat, Theforeman 7 Red Hat Satellite 6, Enterprise Linux, Satellite and 4 more 2026-10-20 8 High
A flaw was found in Foreman. A remote attacker could exploit a command injection vulnerability in Foreman's WebSocket proxy implementation. This vulnerability arises from the system's use of unsanitized hostname values from compute resource providers when constructing shell commands. By operating a malicious compute resource server, an attacker could achieve remote code execution on the Foreman server when a user accesses VM VNC console functionality. This could lead to the compromise of sensitive credentials and the entire managed infrastructure.
CVE-2026-15218 2 Red Hat, Redhat 2 Red Hat Openshift Ai (rhoai), Openshift Ai 2026-10-19 7.9 High
A flaw was found in the maas-api and maas-controller ServiceAccounts within Red Hat OpenShift AI. These ServiceAccounts are granted cluster-wide permissions that exceed their operational requirements. An attacker who compromises the identity of these ServiceAccounts, either through a remote code execution vulnerability or by creating a malicious pod in the same namespace, could exploit these excessive permissions. This could lead to full cluster administrator privileges through the creation of new ClusterRoleBindings or the disclosure of sensitive information by accessing all secrets across the cluster.
CVE-2026-18947 2 Red Hat, Redhat 2 Red Hat Openshift Ai (rhoai), Openshift Ai 2026-10-19 8.5 High
A flaw was found in Feast. An authorization bypass vulnerability exists in the /materialize and /materialize-incremental endpoints. By sending a specially crafted request that omits the feature_views field, an attacker can bypass intended permission checks. This allows an unauthenticated remote attacker, or any authenticated user, to trigger a full re-materialization of all feature views. The consequence is a Denial of Service (DoS) due to data corruption and significant resource consumption across all tenants.
CVE-2026-18941 2 Red Hat, Redhat 2 Red Hat Openshift Ai (rhoai), Openshift Ai 2026-10-19 7.7 High
A flaw was found in Feast and feast-operator. The default configuration for both the Feast SDK and the feast-operator is "no_auth," meaning no security manager is installed. This default allows unauthenticated and unauthorized access to feature-server, registry-server, and offline-server endpoints. A remote attacker, by exploiting this missing authentication, could achieve remote code execution (RCE) by storing a malicious User-Defined Function (UDF) on the feature-server, trigger a denial of service (DoS) by forcing re-materialization of all tenant features, and gain unauthorized access to cross-tenant data.
CVE-2026-18621 2 Red Hat, Redhat 3 Red Hat Openshift Ai (rhoai), Ai Inference Server, Openshift Ai 2026-10-19 7.6 High
A flaw was found in Data Science Pipelines (DSP). An attacker with namespace editor privileges can bypass security hardening by submitting a malicious Argo Workflow through the V1 API path. This allows the API server to create pods with elevated privileges, acting as a 'confused deputy' on behalf of the attacker. Successful exploitation grants the attacker node-root access, enabling arbitrary code execution and full control over the underlying node.
CVE-2026-85471 2 Red Hat, Redhat 4 Red Hat Quay 3, Mirror Registry, Mirror Registry For Red Hat Openshift and 1 more 2026-10-14 6.4 Medium
A flaw was found in Quay. An authenticated repository administrator could bypass the hostname blacklist in webhook notifications, leading to a Server-Side Request Forgery (SSRF) vulnerability. This allows the Quay application to be tricked into sending requests to internal network resources, such as cloud metadata services or other services within the cluster. Consequently, this could lead to the disclosure of sensitive information from these internal services.
CVE-2026-109195 2 Red Hat, Redhat 2 Red Hat Quay 3, Quay 2026-10-14 3.1 Low
A flaw was found in Quay. An authenticated attacker can access repository auto-prune configurations from other namespaces, leading to unauthorized information disclosure. This issue occurs because the application does not properly enforce namespace scoping when retrieving policy details by repository name and policy identifier. To exploit the vulnerability, the attacker must manage a repository sharing the target's name and know the target policy's unique identifier.
CVE-2026-18382 2 Red Hat, Redhat 3 Cost Management Metrics Operator, Cost Management, Cost Management Metrics Operator 2026-10-12 6.8 Medium
A flaw was found in koku-metrics-operator. The operator's CostManagementMetricsConfig custom resource allows a user able to edit the CR to specify an arbitrary OAuth token endpoint. When authentication.type is set to service-account, the operator sends the tenant's Red Hat SSO client_id and client_secret to this user-controlled URL, allowing the attacker to obtain the credentials.
CVE-2026-18381 2 Red Hat, Redhat 3 Cost Management Metrics Operator, Cost Management, Cost Management Metrics Operator 2026-10-12 7.6 High
A flaw was found in the koku-metrics-operator for Red Hat OpenShift. The operator's CostManagementMetricsConfig custom resource allows a user able to edit the CR to specify an arbitrary upload URL. The operator attaches its own Kubernetes service-account bearer token to queries sent to this user-controlled URL, allowing the attacker to obtain the token.
CVE-2026-18378 2 Red Hat, Redhat 3 Cost Management Metrics Operator, Cost Management, Cost Management Metrics Operator 2026-10-12 7.6 High
A flaw was found in koku-metrics-operator. The operator's CostManagementMetricsConfig custom resource allows user able to edit the CR to specify an arbitrary upload URL. When authentication.type is set to token (the default), the cluster-global Red Hat Cloud pull-secret bearer token is attached to HTTP requests sent to this user-controlled URL, allowing the attacker to obtain the token.
CVE-2026-107151 2 Red Hat, Redhat 2 Red Hat Satellite 6, Satellite 2026-10-10 5.9 Medium
Missing authentication has been found in remote-execution task updates in the smart_proxy_dynflow package. The progress and completion callbacks accept a report when the one-time token is missing. A network attacker or user must already know the identifier of a running job. This applies when remote execution is set to pull or pull-mqtt mode. They can send their own job output and mark the job as a success or a failure. The job is then recorded with that result.
CVE-2026-102295 2 Red Hat, Redhat 2 Red Hat Quay 3, Quay 2026-10-06 5.4 Medium
A flaw was found in Quay. A cross-site scripting (XSS) vulnerability in the OAuth callback handler allows a remote attacker to execute arbitrary JavaScript code within a user's browser session. By tricking a logged-in user into visiting a specially crafted link, an attacker can exploit improper input sanitization to run client-side scripts in the application context. Successful exploitation could allow the attacker to compromise the user's session, access sensitive registry information, or perform unauthorized actions on their behalf.