Veille CVE

Recherche « Red Hat OpenStack Platform 18.0 »

8 CVE

Critique 1 Élevée 4 Moyenne 2 Faible 1 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Red Hat OpenStack Platform 18.0 » ✕
  1. CVE-2026-114236 3.3 Faible

    Red Hat Confidential Compute Attestation · Red Hat DPU kit for NVIDIA · Red Hat Exploit Intelligence · Red Hat Multicluster Engine for Kubernetes

    storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer may, when processing corrupt or malicious inputs, leak a file descriptor; unbounded repeated calls can exhaust the process’ file descriptor limit

  2. CVE-2026-92982 8.5 Élevée

    Red Hat Ansible Automation Platform 2.6 · Red Hat Ansible Automation Platform 2.7 · Red Hat Migration Toolkit for Applications 8 · Red Hat Migration Toolkit for Containers

    A flaw was found in Ansible Operator Plugins. A low-privileged Kubernetes user can exploit a Jinja2 template injection vulnerability by crafting malicious custom resource (CR) specification values. These values are processed by Ansible without proper sanitization, allowing embedded Jinja2 expressions to be executed within the operator pod. This can lead to arbitrary code execution and privilege escalation, granting the attacker control over the operator's service account with cluster-wide permissions.

  3. CVE-2026-83536 5.3 Moyenne

    Red Hat OpenStack Platform 18.0

    A flaw was found in openstack-network-exporter. The HTTP server within the component is configured without essential timeout settings, such as ReadHeaderTimeout. This vulnerability allows an unauthenticated, remote attacker to initiate multiple slow HTTP header connections. By trickling header bytes, the attacker can exhaust server resources, specifically file descriptors, leading to a Denial of Service (DoS) that prevents legitimate Prometheus metric scraping and alerting.

  4. CVE-2026-83535 7.4 Élevée

    Red Hat OpenStack Platform 18.0

    A flaw was found in openstack-network-exporter. When an operator configures user authentication but omits or misconfigures Transport Layer Security (TLS), the basic authentication mechanism is silently bypassed. This fail-open design allows an adjacent network attacker to access sensitive Open vSwitch (OVS) and Open Virtual Network (OVN) dataplane metrics without credentials. Consequently, an attacker can enumerate bridge names, port counters, OVN controller state, and host topology, leading to information disclosure.

  5. CVE-2026-107935 9.3 Critique

    Red Hat Build of Podman Desktop · Red Hat Certification Program for Red Hat Enterprise Linux 9 · Red Hat Edge Manager 1 · Red Hat Enterprise Linux 10

    A path traversal vulnerability was found in gvproxy, the network forwarder provided by the gvisor-tap-vsock package. The unauthenticated /services/forwarder/expose endpoint does not validate the caller-supplied socket path, allowing an attacker to delete arbitrary files on the host system.

  6. CVE-2026-89091 8.8 Élevée

    Red Hat Migration Toolkit for Applications 8 · Red Hat Migration Toolkit for Virtualization · Red Hat OpenShift Service Mesh 3 · Red Hat Advanced Cluster Management for Kubernetes 2

    A flaw was found in ansible-core. When installing a collection with `ansible-galaxy collection install`, the archive extractor validates member paths using lexical path normalisation (os.path.abspath) instead of resolving symbolic links (os.path.realpath), and it performs no containment check on symlink-typed directory members before creating them. A crafted collection tarball can chain symlink directory entries so that a subsequent file member is written outside the intended destination directory. This allows an attacker who can get a victim to install a malicious collection to overwrite arbitrary files with the privileges of the user running ansible-galaxy, leading to code execution on the control node. This is a bypass of the fix for CVE-2020-10691.

  7. CVE-2026-87874 8.1 Élevée

    Red Hat Ceph Storage 5 · Red Hat Ceph Storage 9 · Red Hat OpenStack Platform 17.1 · Red Hat OpenStack Platform 18.0

    A flaw was found in the memcached cache plugin of the community.general Ansible collection. Although its documentation states that records are stored in JSON format, the plugin performs no explicit serialization and relies on python-memcached, which pickles values on write and unpickles them on read. Because memcached is unauthenticated and cache keys are predictable, an attacker able to reach a network-exposed or shared memcached instance can write a crafted pickle payload that is deserialized and executed on the Ansible controller when the poisoned fact cache is next read, leading to remote code execution.

  8. CVE-2026-87872 6.8 Moyenne

    Red Hat Ceph Storage 5 · Red Hat Ceph Storage 9 · Red Hat OpenStack Platform 17.1 · Red Hat OpenStack Platform 18.0

    A flaw was found in the OCAPI modules (ocapi_command, ocapi_info) of the community.general Ansible collection. The shared OCAPI request helper disables TLS certificate validation on every request and the modules expose no parameter to re-enable it, while sending HTTP Basic-Auth credentials to an https endpoint. An attacker positioned on the network path between the Ansible controller and the OCAPI-managed storage/enclosure device can present any certificate, intercept the session, capture the credentials, and tamper with responses.