Veille CVE

Recherche « Redhat advanced cluster management for kubernetes »

6 CVE

Critique 0 Élevée 3 Moyenne 3 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Redhat advanced cluster management for kubernetes » ✕
  1. CVE-2026-71846 6.5 Moyenne

    Red Hat Advanced Cluster Management for Kubernetes 2.11 · Red Hat Advanced Cluster Management for Kubernetes 2.13 · Red Hat Advanced Cluster Management for Kubernetes 2.14 · Red Hat Advanced Cluster Management for Kubernetes 2.15

    A flaw was found in insights-client. The component's ServiceAccount is bound to a ClusterRole granting cluster-wide secrets get, list, and watch permissions, while the code only requires access to a single specific Secret. This excessive privilege means that a compromise of the insights-client pod or ServiceAccount token would grant an attacker read access to all Secrets across the hub cluster, including managed-cluster kubeconfigs and other sensitive credentials.

  2. CVE-2026-71845 7.7 Élevée

    Red Hat Advanced Cluster Management for Kubernetes 2.11 · Red Hat Advanced Cluster Management for Kubernetes 2.13 · Red Hat Advanced Cluster Management for Kubernetes 2.14 · Red Hat Advanced Cluster Management for Kubernetes 2.15

    A flaw was found in insights-client. The setDefault() function logs the value of every environment variable it processes, including CCX_TOKEN, a bearer credential used in disconnected cluster deployments. When glog verbosity is set to level 2 or higher, the token is written in clear text to the pod log on every startup. An attacker with access to pod logs or centralized logging could obtain the credential, leading to unauthorized access to the CCX API.

  3. CVE-2026-71475 6.8 Moyenne

    Red Hat Advanced Cluster Management for Kubernetes 2.13 · Red Hat Advanced Cluster Management for Kubernetes 2.14 · Red Hat Advanced Cluster Management for Kubernetes 2.15 · Red Hat Advanced Cluster Management for Kubernetes 2.16

    A flaw was found in insights-client. A compromised managed cluster, referred to as a 'spoke', can inject unencoded data into the Insights API URL path. This occurs because the ClusterID, which is controlled by the spoke, is used directly in the request path without proper validation or URL encoding. This vulnerability allows a malicious spoke to redirect authenticated requests to unintended API endpoints, potentially leading to information disclosure or unauthorized access.

  4. CVE-2026-71474 7.1 Élevée

    Red Hat Advanced Cluster Management for Kubernetes 2.11 · Red Hat Advanced Cluster Management for Kubernetes 2.13 · Red Hat Advanced Cluster Management for Kubernetes 2.14 · Red Hat Advanced Cluster Management for Kubernetes 2.15

    A flaw was found in insights-client. When the application receives a non-200 response, it logs the request headers, which can include the cloud.openshift.com pull-secret token. A local user with access to pod logs on the hub could read this long-lived credential. This information disclosure could grant unauthorized access to Red Hat cloud services.

  5. CVE-2026-46625 7.5 Élevée

    js-cookie · Red Hat Cryostat 4 on RHEL 9 · Red Hat Advanced Cluster Security for Kubernetes 4.10 · Red Hat Ansible Automation Platform 2.1

    JavaScript Cookie is a JavaScript API for handling cookies, client-side. Prior to version 3.0.7, js-cookie's internal assign() helper copies properties with for...in + plain assignment. When the source object is produced by JSON.parse, the JSON object's "__proto__" member is an own enumerable property, so the for…in enumerates it and the target[key] = source[key] write triggers the Object.prototype.__proto__ setter on the fresh target ({}). The result is a per-instance prototype hijack: Object.prototype itself is untouched, but the merged attributes object now inherits attacker-controlled keys. Because the consuming set() function then enumerates the merged object with another for...in, every key the attacker placed on the polluted prototype lands in the resulting Set-Cookie string as an attribute pair. The attacker can set domain=, secure=, samesite=, expires=, and path= on cookies whose attributes the developer thought were locked down. This issue has been patched in version 3.0.7.

  6. CVE-2026-7163 5.5 Moyenne

    Red Hat multicluster engine for Kubernetes 2.1 · Red Hat multicluster engine for Kubernetes 2.11 · Red Hat multicluster engine for Kubernetes 2.7 · Red Hat multicluster engine for Kubernetes 2.9

    A vulnerability in the assisted-service REST API, an optional Assisted Installer (assisted-service) component in the Multicluster Engine (MCE), allows an authenticated user with minimal namespace-scoped privileges to obtain administrative credentials for arbitrary clusters provisioned through the hub. The credentials download endpoint (GET /v2/clusters/{cluster_id}/credentials, which returns the kubeadmin password) and the kubeconfig download endpoint are operational in AUTH_TYPE=local mode, the only authentication mode available in on-premises ACM/MCE hub deployments. The local authenticator unconditionally grants full administrative access to any request bearing a valid JWT, with no per-endpoint restrictions. A valid local JWT is embedded as a plaintext query parameter in InfraEnvStatus.ISODownloadURL and is readable by any user who has get rights on an InfraEnv object in their own namespace. The affected components ship as part of Multicluster Engine (MCE). The Red Hat Advanced Cluster Management (ACM) deployments that include MCE are equally affected. This issue does not affect the hosted SaaS offering (console.redhat.com), which uses a different authentication mode. Successful exploitation gives the attacker the kubeadmin password and kubeconfig for any OpenShift cluster provisioned through the affected hub, granting unrestricted root-level administrative access to those spoke clusters.