Red Hat Red Hat OpenShift Container Platform 5
56 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-115456 | | Gcc: out-of-bounds read in std::from_chars | LOW 3.7 | |||
| CVE-2026-115455 | | Gcc: stack overflow in std::bitset on libstdc++ | MEDIUM 6.5 | |||
| CVE-2026-114691 | | Gcc: integer wrap in `std | MEDIUM 5.9 | |||
| CVE-2026-114690 | | Gcc: confirmed out-of-bounds read/write in libstdc++ parallel `std | MEDIUM 6.2 | |||
| CVE-2026-118593 | | Kernel: local_bh imbalance in seg6_input_core() drop path (incomplete fix for cve-2026-46099) | MEDIUM 5.9 | |||
| CVE-2026-92092 | | Openshift-ansible: openshift-ansible: installer container downloads and executes remote inventory script without integrity verification | HIGH 7.4 | |||
| CVE-2026-93009 | | Dnsmasq: dnsmasq: heap out-of-bounds read in dhcpv6 option 39 fqdn decoder | MEDIUM 4.3 | |||
| CVE-2026-93010 | | Dnsmasq: dnsmasq: --leasequery without address argument applies no source address check | MEDIUM 4.3 | |||
| CVE-2026-93006 | | Dnsmasq: dnsmasq: tftp prefetch cache keyed on stale heap pointer serves wrong file content | MEDIUM 6.8 | |||
| CVE-2026-93007 | | Dnsmasq: dnsmasq: tcp/53 child-slot exhaustion starves dnssec validation | MEDIUM 5.3 | |||
| CVE-2026-93011 | | Dnsmasq: dnsmasq: heap out-of-bounds write in dnssec validator via to_wire/from_wire transforms | MEDIUM 5.3 | |||
| CVE-2026-93008 | | Dnsmasq: dnsmasq: out-of-bailiwick cache injection through cname chase in split-dns configurations | MEDIUM 6.8 | |||
| CVE-2026-85498 | | Polkit: regression in cve-2026-4897 fix (polkit read_cookie()) - stack buffer underflow | LOW 3.5 | 0.3 % | ||
| CVE-2026-109411 | | Samba: access control bypass via vfs_ceph_rgw case-insensitive open | HIGH 8.1 | 0.6 % | ||
| CVE-2026-92824 | | Libmodulemd: libmodulemd: out-of-bounds read when emitting rpm-map artifacts | MEDIUM 6.2 | 0.1 % | ||
| CVE-2026-92823 | | Libmodulemd: libmodulemd: missing decompressed-size limit when parsing compressed yaml | MEDIUM 6.2 | 0.2 % | ||
| CVE-2026-92822 | | Libmodulemd: libmodulemd: unbounded recursion when parsing nested xmd yaml | MEDIUM 6.2 | 0.2 % | ||
| CVE-2026-85231 | | Libtirpc: libtirpc: denial of service via unbounded memory allocation during rpcsec_gss decoding | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-92982 | | Ansible-operator-plugins: ansible operator plugins: arbitrary code execution via jinja2 template injection | HIGH 8.5 | 0.5 % | ||
| CVE-2026-109968 | | Clevis: clevis: pkcs#11 luks passphrase logged in plaintext to world-readable file | MEDIUM 5.5 | 0.1 % | ||
| CVE-2026-104795 | | Insights-runtime-extractor: insights-runtime-extractor: container escape via privileged binary execution | HIGH 8.8 | 0.2 % | ||
| CVE-2026-109971 | | Clevis: clevis: pkcs#11 token pin exposed on command line via pkcs11-tool | MEDIUM 4.7 | 0.2 % | ||
| CVE-2026-109970 | | Clevis: clevis: pkcs#11 token pin written to world-readable file | MEDIUM 4.7 | 0.1 % | ||
| CVE-2026-109969 | | Clevis: clevis: no authentication on pkcs#11 af_unix sockets allows key injection under permissive umask | MEDIUM 4.7 | 0.1 % | ||
| CVE-2026-109976 | | Clevis: clevis: integer underflow in pkcs#11 data socket handler crashes daemon on unbound client connection | MEDIUM 4.7 | 0.1 % | ||
| CVE-2026-75888 | | Openshift/console: openshift/console: authenticated ssrf via helm chart url fetch | HIGH 7.7 | 0.4 % | ||
| CVE-2026-93017 | | Insights-operator: gather serviceaccount has cluster-wide secret read plus nodes/proxy and cluster-reader | HIGH 7.7 | 0.4 % | ||
| CVE-2026-107176 | | Cluster-samples-operator: role reads all secrets in openshift-config, not just pull-secret | MEDIUM 6.8 | 0.2 % | ||
| CVE-2026-107161 | | Cyrus-sasl: heap buffer overflow in cyrus-sasl add_to_challenge() allows malicious server to crash or compromise digest-md5 clients | HIGH 7.5 | 0.3 % | ||
| CVE-2026-83589 | | Oauth-proxy: open redirect via /\ and /\t bypass in post-login redirect | MEDIUM 6.1 | 0.3 % | ||
| CVE-2026-101295 | | Oc-mirror: oc-mirror: path traversal / arbitrary file write in operator catalog image extraction | HIGH 7.3 | 0.1 % | ||
| CVE-2026-62146 | | Cri-o: cri-o: sandbox state poisoning via pod annotations may expose runtime socket | HIGH 7.8 | 0.2 % | ||
| CVE-2026-102010 | | Gcc-toolset-15-gcc: gcc: gcc-toolset-16: gcc: denial of service via use-after-free in binary heap erase_if | HIGH 7.0 | 0.3 % | ||
| CVE-2026-94640 | | Rpcbind: unbounded memory allocation in rpcbind statistics tracking allows unauthenticated remote denial of service | HIGH 7.5 | 0.5 % | ||
| CVE-2026-95619 | | Gcc: libstdc++ integer overflow in `new` operator | HIGH 7.7 | 0.4 % | ||
| CVE-2026-92574 | | Cri-o: cri-o checkpoint restore bypasses destination security context | HIGH 8.8 | 0.7 % | ||
| CVE-2026-15801 | | Cri-o: cri-o: insufficient validation during container checkpoint restore | HIGH 8.0 | 0.5 % | ||
| CVE-2026-81627 | | Qemu-kvm: vapic writable rom alias can escape the option-rom window and expose locked smram | HIGH 8.2 | 0.2 % | ||
| CVE-2026-76781 | | Libxml2: libxml2: null pointer dereference parsing nextcatalog without catalog attribute | MEDIUM 5.5 | 0.2 % | ||
| CVE-2026-79705 | | Podman: buildah: buildah/copier: directory escape via crafted tar symlinks when used outside buildah by non-root callers | MEDIUM 4.5 | 0.4 % | ||
| CVE-2026-78410 | | Util-linux: util-linux: restricted bind mounts do not pin the source, allowing x-mount.owner/group/mode redirection | HIGH 7.8 | 0.2 % | ||
| CVE-2026-78408 | | Util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority | HIGH 7.9 | 0.2 % | ||
| CVE-2026-49329 | | Openshift/oauth-server: openshift/oauth-server: quadratic-time dos via accept-language header underscore bypass on unauthenticated login … | HIGH 7.5 | 0.7 % | ||
| CVE-2026-43961 | | Vim: vimscript injection via unescaped filename in netrw s:netrwmarkfile() filter() expression allows arbitrary code execution | HIGH 7.8 | 0.2 % | ||
| CVE-2026-19730 | | Podman: podman: quadlet install --replace non-truncating write retains removed host-access directives | MEDIUM 4.2 | 0.1 % | ||
| CVE-2026-15816 | | Dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die() | HIGH 7.5 | 0.5 % | ||
| CVE-2026-71226 | | Libkcapi: memory corruption via uncanceled aio requests on error in libkcapi's one-shot aio path | HIGH 7.3 | 0.1 % | ||
| CVE-2026-18477 | | Tar: tar: toctou in incremental dumpdir 'x' rename handling allows restore path escape | MEDIUM 4.4 | 0.1 % | ||
| CVE-2026-18508 | | Tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite | MEDIUM 4.4 | 0.1 % | ||
| CVE-2026-16445 | | Dracut: dracut: root code execution via dhcp options command injection in networkmanager initrd module | HIGH 7.5 | 3.2 % | ||
| CVE-2026-12080 | | Qemu-kvm: qemu-guest-agent: local privilege escalation via symlink attack in guest-ssh-add-authorized-keys | HIGH 7.3 | 0.1 % | ||
| CVE-2026-14476 | | Sssd: sssd: gpo cache path traversal via unsanitized gpcfilesyspath allows kerberos authentication bypass | HIGH 8.0 | 0.7 % | ||
| CVE-2026-14474 | | Sssd: sssd: sudo ldap provider searches entire directory tree for sudorole objects by default, enabling privilege escalation | HIGH 8.8 | 0.6 % | ||
| CVE-2026-13595 | | Util-linux: util-linux: heap use-after-free in libblkid nested partition probing | MEDIUM 6.8 | 0.1 % | ||
| CVE-2026-10843 | | Cloud-credential-operator: cco mint-mode credentialsrequest manifests grant account-wide iam access beyond cluster scope on aws | HIGH 7.2 | 0.3 % | ||
| CVE-2026-1933 | | Samba: missing access check on reparse point operations | HIGH 7.1 | 0.9 % |