Veille CVE

Recherche « Red Hat OpenShift Builds 1.8.1 »

2 CVE

Critique 1 Élevée 1 Moyenne 0 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Red Hat OpenShift Builds 1.8.1 » ✕
  1. CVE-2026-10840 7.1 Élevée

    Red Hat OpenShift Builds 1.7.3 · Red Hat OpenShift Builds 1.8.1 · Red Hat OpenShift Pipelines

    A flaw was found in the OpenShift Pipelines operator. The tekton-scheduler-rolebinding ClusterRoleBinding grants the system:authenticated group write access to Kueue and cert-manager custom resources via the tekton-scheduler-role ClusterRole. When Kueue or cert-manager CRDs are present on the cluster, any authenticated user can disrupt workload scheduling, tamper with scheduling priorities, delete other tenants' Workload objects, or induce cert-manager to overwrite TLS Secrets including the default ingress controller certificate.

  2. CVE-2026-39832 9.1 Critique

    golang.org/x/crypto/ssh/agent · Red Hat Enterprise Linux 10 · Red Hat Enterprise Linux 8 · Red Hat Enterprise Linux 8.8 Telecommunications Update Service

    When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host. The client now serializes all constraint extensions. Additionally, the in-memory keyring returned by NewKeyring() now rejects keys with unsupported constraint extensions instead of silently ignoring them.