Red Hat vulnerabilities
We track 2,065 vulnerabilities in Red Hat products across 60+ products. 2,057 are rated high or critical, and 99 have been exploited in real attacks. The most recent was published on November 13, 2026.
Latest Red Hat vulnerabilities
- 8.1 High severity
Red Hat OpenShift Container Platform 4: External Control of File Name or Path
A flaw was found in Kata Containers. In configurations utilizing genpolicy for Confidential Containers guest protection, a malicious host operator can exploit insufficient validation of CreateContainer mount and storage rules. This allows them to mount arbitra
- 7.4 High severity
Red Hat Build of Apache Camel 3.33.3.SP2: Improper Handling of Alternate Encoding
A flaw was found in WildFly Elytron. Password hashing and verification normalize input with Unicode NFKC, which can collapse fullwidth characters to ASCII equivalents. A remote attacker can more easily guess affected passwords by using an ASCII-only dictionary
- 7.5 High severity
Red Hat Enterprise Linux 10: Allocation of Resources Without Limits or Throttling
A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit a vulnerability in the `/ipa/i18n_messages` endpoint by sending an arbitrarily large request body. This can cause the service to consume excessive memory, leading to memory exhaustion,
- 7.5 High severity
Red Hat Enterprise Linux 10: Allocation of Resources Without Limits or Throttling
A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit this vulnerability by sending oversized form POST requests to the `/ipa/migration/migration.py` endpoint. This can force the migration handler to read attacker-controlled request bodie
- 8.7 High severity
Red Hat Enterprise Linux 10: Use of Incorrectly-Resolved Name or Reference
A privilege escalation flaw was found in FreeIPA. The uniqueness constraint enforced on Kerberos principal name attributes in the 389-ds directory server does not properly account for equivalent representations of the same principal name, allowing a user with
- 8.1 High severity
Red Hat Enterprise Linux 10: Incorrect Privilege Assignment
A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services, including the portal, SMB server, and LDAP directory. This is possible by imperson
- 7.8 High severity
Red Hat Enterprise Linux 10: Integer Overflow or Wraparound
A flaw was found in libvirt. An unprivileged local user could exploit an integer overflow vulnerability in the NodeGetFreePages RPC handler. This flaw allows crafted values to bypass a size check, leading to an undersized memory buffer. Subsequently, real NUMA
- 8.0 High severity
Red Hat Advanced Cluster Management for…: Inclusion of Functionality from Untrusted Control Sphere
A flaw was found in acm-operator-bundle. The build process for this component downloads and runs a script from a remote source without verifying its authenticity or integrity. This script gains access to sensitive credentials, such as GitHub access tokens and
- 7.7 High severity
multicluster engine for Kubernetes 2.10: Reliance on Insufficiently Trustworthy Component
A flaw was found in mce-operator-bundle. The build process fetches and executes scripts from a remote repository without performing integrity checks, such as commit pinning or signature verification. This allows a malicious actor with write access to the remot
- 9.9 Critical severity
Red Hat Advanced Cluster Management for…: Execution with Unnecessary Privileges
A flaw was found in search-v2-operator. The operator's ClusterRole has permissions equivalent to a cluster administrator, allowing it to impersonate other entities, write Role-Based Access Control (RBAC) configurations, approve Certificate Signing Requests (CS
- 9.3 Critical severity
multicluster engine for Kubernetes 2.10: Server-Side Request Forgery
A flaw was found in the `cluster-proxy-addon` component of Multicluster Engine for Kubernetes. This vulnerability allows an unauthenticated attacker, who can access the user-facing route, to bypass authentication and authorization checks. By manipulating URL p
- 9.1 Critical severity
Red Hat Advanced Cluster Management for…: Improper Control of Dynamically-Managed Code Resources
A flaw was found in the search-v2-operator. This vulnerability allows a privileged user, specifically a Custom Resource (CR) editor, to manipulate Search CR fields such as imageOverride, arguments, and environment variables without proper validation. By exploi
- 7.8 High severity
vim: Improper Control of Generation of Code
A flaw was found in Vim's netrw plugin. A crafted filename containing quote characters and expression fragments can break out of the quoted context during mark/unmark operations, allowing arbitrary Vimscript execution. This can be leveraged to run shell comman
- 7.5 High severity
Red Hat Enterprise Linux 10: Missing Release of Memory after Effective Lifetime
A memory leak flaw was found in cockpit-ws. The login page handler leaks a heap allocation on every unauthenticated request that carries a CockpitLang cookie, allowing a remote unauthenticated attacker to exhaust memory on the host and cause a denial of servic
- 7.3 High severity
Red Hat build of Keycloak 26.6: Predictable from Observable State
A flaw was found in the legacy client-initiated account-linking endpoint of Keycloak, a widely used open-source identity and access management solution. The mechanism used to protect the account-linking process from unauthorized requests relies on a hash that
- 8.7 High severity
Multicluster Engine for Kubernetes: Improper Privilege Management
A flaw was found in managed-serviceaccount. A compromised addon-manager pod, due to its ClusterRole granting excessive permissions, can read any secret across all namespaces. Additionally, it can approve arbitrary Certificate Signing Requests (CSRs), which cou
- 9.1 Critical severity
Red Hat build of Keycloak 26.4: Weak Password Recovery Mechanism for Forgotten Password
A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for an
- 7.7 High severity
Red Hat Ansible Automation Platform 2.5 for…: Server-Side Request Forgery
A server-side request forgery (SSRF) vulnerability was found in AWX's webhook status callback mechanism. When processing GitHub pull request webhooks, AWX extracts the status callback URL (pull_request.statuses_url) from the incoming webhook payload without va
- 9.6 Critical severity
Red Hat Ansible Automation Platform 2.4 for…: Server-Side Request Forgery
A flaw was found in the AAP Controller's HashiCorp Vault credential plugin. The kubernetes_auth() function in awx_plugins/credentials/hashivault.py reads the controller pod's Kubernetes service account token and sends it to an attacker-controlled URL when a Ha
- 8.8 High severity
A flaw was found in the governance-policy-addon-controller component of Red Hat Advanced…
A flaw was found in the governance-policy-addon-controller component of Red Hat Advanced Cluster Management for Kubernetes. A user with permissions to annotate the namespaced ManagedClusterAddOn resource can override the governance-policy container image. This
- 9.9 Critical severity
multicluster engine for Kubernetes 2.10: Improper Certificate Validation
A flaw was found in the managedcluster-import-controller. The Certificate Signing Request (CSR) auto-approval logic improperly validates incoming CSRs, specifically by not inspecting the signer name or decoding the PEM-encoded x509 CSR. This vulnerability allo
- 9.1 Critical severity
Red Hat Advanced Cluster Management for…: Improper Neutralization of Special Elements used in an OS Command
A flaw was found in acm-search-v2-rhel9. This vulnerability allows an authenticated attacker, such as a hub administrator or a Search Custom Resource (CR) editor, to inject malicious shell commands or SQL statements. This occurs because the WORK_MEM string pro
- 8.8 High severity
Red Hat Advanced Cluster Management for…: Improper Privilege Management
A flaw was found in search-v2-operator. This component's `search-serviceaccount` has overly broad permissions, allowing it to impersonate users and groups across the entire cluster. If an attacker gains access to any of the pods running under this service acco
- 9.9 Critical severity
Multicluster Global Hub 1.4.9: Incorrect Authorization
A flaw was found in the multicloud-operators-subscription component. This vulnerability allows a user on a managed cluster to escalate their privileges by creating a Subscription with specific, crafted annotations. Successful exploitation grants the attacker t
- 7.9 High severity
Red Hat OpenShift AI 3.4: Incorrect Privilege Assignment
A flaw was found in the maas-api and maas-controller ServiceAccounts within Red Hat OpenShift AI. These ServiceAccounts are granted cluster-wide permissions that exceed their operational requirements. An attacker who compromises the identity of these ServiceAc
- 7.1 High severity
Red Hat OpenShift Update Service: Server-Side Request Forgery
A flaw was found in Red Hat Quay. A user with FEATURE_BUILD_SUPPORT enabled and repository write access can exploit a Server-Side Request Forgery (SSRF) vulnerability within the build API. This allows the user to provide a malicious URL, causing the Quay build
- 7.5 High severity
Red Hat OpenShift Update Service: Missing Authentication for Critical Functionality
A flaw was found in Red Hat Quay's exported logs feature. An unauthenticated attacker with a valid file ID could download exported action logs without proper authorization. While file IDs are complex, they can be intercepted from plaintext email or webhook cal
- 7.5 High severity
Red Hat OpenShift Update Service: Improper Verification of Cryptographic Signature
A flaw was found in Red Hat Quay's Stripe billing webhook handler. This vulnerability allows an unauthenticated attacker to forge billing events by sending crafted JSON requests to the `/webhooks/stripe` endpoint without validating the Stripe-Signature header.
- 8.2 High severity
Red Hat OpenShift Update Service: Missing Authentication for Critical Functionality
A flaw was found in Red Hat Quay. When the SECURITY_SCANNER_V4_PSK (pre-shared key) is not set, a remote unauthenticated attacker can send POST requests to the security scanner notification endpoint. This allows the attacker to flood the notification queue and
- 7.1 High severity
multicluster engine for Kubernetes 2.10: Unintended Proxy or Intermediary
A flaw was found in the clusterclaims-controller component of Multicluster Engine (MCE). An authenticated tenant can exploit this vulnerability by manipulating ClusterClaim labels. This allows the tenant to force a cluster to join a ManagedClusterSet belonging
- 8.5 High severity
Red Hat Advanced Cluster Management for…: Improperly Controlled Modification of Dynamically-Determined Object Attributes
A flaw was found in the `search-v2-operator` component. A user with specific administrative permissions on a managed cluster can exploit a vulnerability that allows them to inject arbitrary configuration data. This manipulation can override critical settings,
- 9.0 Critical severity
Red Hat Advanced Cluster Management for…: Inclusion of Functionality from Untrusted Control Sphere
A flaw was found in acm-search-v2-rhel9. An attacker with administrative privileges on the hub cluster, specifically with patch access to the Search Custom Resource (CR), could exploit a vulnerability in the `Collector.ImageOverride` field. This allows the att
- 7.5 High severity
Red Hat Advanced Cluster Management for…: Allocation of Resources Without Limits or Throttling
A flaw was found in search-v2-api. An unauthenticated attacker can exploit this by sending requests with unique random bearer tokens. Each unique token creates a permanent entry in the unbounded tokenReviews cache, which is not properly cleared. This can lead
- 7.5 High severity
Red Hat Enterprise Linux 10: Out-of-bounds Read
A unauthenticated remote peer may lead rsyslogd to crash due to a flaw in the optional imptcp module. A crafted input sequence during oversize-frame recovery can cause an invalid internal message length and terminate rsyslogd. No confidentiality or integrity i
- 8.8 High severity
Red Hat Container Native Virtualization 4.12: Improper Limitation of a Pathname to a Restricted Directory
A symlink following vulnerability was found in KubeVirt's virt-handler migration proxy. During live migration, virt-handler dials Unix sockets inside the target virt-launcher pod via /proc/<pid>/root/ paths using net.Dial() without symlink protection. These so
- 9.9 Critical severity
multicluster engine for Kubernetes 2.10: Improper Privilege Management
A flaw was found in the cluster-curator-controller component. A local user, by creating a ClusterCurator resource with a specific naming convention, can trigger the creation of a cluster-scoped ClusterRoleBinding. This allows the user to escalate their privile
- 9.9 Critical severity
multicluster engine for Kubernetes 2.10: Improper Control of Generation of Code
A flaw was found in the cluster-curator-controller component of multicluster engine (MCE). A tenant with create or update permissions on ClusterCurator resources can inject an arbitrary Job specification. This is possible because the CreateJob() function does
- 9.9 Critical severity
Red Hat Advanced Cluster Management for…: Execution with Unnecessary Privileges
A flaw was found in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management (RHACM). This vulnerability allows a namespace-admin tenant to perform a confused-deputy attack by creating Subscription Custom Resources (CRs) that leve
- 7.7 High severity
Red Hat Advanced Cluster Management for…: Improper Privilege Management
A flaw was found in the multicloud-operators-channel component of Red Hat Advanced Cluster Management (RHACM). This vulnerability allows a compromised agent from a managed cluster to gain unauthorized access to sensitive information. Specifically, the agent ca
- 9.9 Critical severity
Red Hat Advanced Cluster Management for…: Unintended Proxy or Intermediary
A flaw was found in the multicloud-integrations component. The Application propagation controller processes the `ocm-managed-cluster` annotation from an Application Custom Resource (CR) without proper validation. A tenant with permissions to create Application