Red Hat Red Hat OpenShift Container Platform 5

• CVE-2026-82976 High 7.1 Image-customization-controller: unauthenticated plaintext image server with directory listing exposes ignition images containing cluster pull secret 0.2%
• CVE-2026-120831 Medium 6.5 Libslirp: libslirp: queue pointer corruption in if_output() leading to denial of service 0.3%
• CVE-2026-120830 High 7.4 Libslirp: libslirp: out-of-bounds heap read in icmp_forward_error() leading to information disclosure 0.2%
• CVE-2026-120194 High 7.5 Json-glib: json-glib: infinite loop in json_path_query() with negative jsonpath slice step 0.5%
• CVE-2026-115456 Low 3.7 Gcc: out-of-bounds read in std::from_chars 0.2%
• CVE-2026-115455 Medium 6.5 Gcc: stack overflow in std::bitset on libstdc++ 0.3%
• CVE-2026-114691 Medium 5.9 Gcc: integer wrap in `std 0.4%
• CVE-2026-114690 Medium 6.2 Gcc: confirmed out-of-bounds read/write in libstdc++ parallel `std 0.1%
• CVE-2026-118593 Medium 5.9 Kernel: local_bh imbalance in seg6_input_core() drop path (incomplete fix for cve-2026-46099) 0.2%
• CVE-2026-92092 High 7.4 Openshift-ansible: openshift-ansible: installer container downloads and executes remote inventory script without integrity verification 0.2%
• CVE-2026-93009 Medium 4.3 Dnsmasq: dnsmasq: heap out-of-bounds read in dhcpv6 option 39 fqdn decoder 0.2%
• CVE-2026-93010 Medium 4.3 Dnsmasq: dnsmasq: --leasequery without address argument applies no source address check 0.2%
• CVE-2026-93006 Medium 6.8 Dnsmasq: dnsmasq: tftp prefetch cache keyed on stale heap pointer serves wrong file content 0.3%
• CVE-2026-93007 Medium 5.3 Dnsmasq: dnsmasq: tcp/53 child-slot exhaustion starves dnssec validation 0.4%
• CVE-2026-93011 Medium 5.3 Dnsmasq: dnsmasq: heap out-of-bounds write in dnssec validator via to_wire/from_wire transforms 0.6%
• CVE-2026-93008 Medium 6.8 Dnsmasq: dnsmasq: out-of-bailiwick cache injection through cname chase in split-dns configurations 0.1%
• CVE-2026-85498 Low 3.5 Polkit: regression in cve-2026-4897 fix (polkit read_cookie()) - stack buffer underflow 0.3%
• CVE-2026-109411 High 8.1 Samba: access control bypass via vfs_ceph_rgw case-insensitive open 0.6%
• CVE-2026-116497 Medium 5.5 Gssproxy: gssproxy: null pointer dereference in gssx_init_sec_context crashes daemon 0.1%
• CVE-2026-115424 Medium 5.5 Oc: oc: symlink/hardlink target validation bypass in oc image extract allows file write outside destination 0.2%
• CVE-2026-92824 Medium 6.2 Libmodulemd: libmodulemd: out-of-bounds read when emitting rpm-map artifacts 0.1%
• CVE-2026-92822 Medium 6.2 Libmodulemd: libmodulemd: unbounded recursion when parsing nested xmd yaml 0.3%
• CVE-2026-92823 Medium 6.2 Libmodulemd: libmodulemd: missing decompressed-size limit when parsing compressed yaml 0.2%
• CVE-2026-114038 Medium 5.1 Device-mapper-multipath: device-mapper-multipath: information disclosure via malformed format string 0.1%
• CVE-2026-16460 High 7.4 Bootc: ostree: bootc/ostree: staged deployments not revalidated against container signature policy before finalization <0.1%
• CVE-2026-85231 Medium 6.5 Libtirpc: libtirpc: denial of service via unbounded memory allocation during rpcsec_gss decoding 0.3%
• CVE-2026-111555 Medium 6.0 Luksmeta: missing slot-range validation permits out-of-gap device i/o 0.1%
• CVE-2026-104715 High 7.8 Cifs-utils: mount.cifs credential-file option injection allows local privilege boundary bypass 0.3%
• CVE-2026-92982 High 8.5 Ansible-operator-plugins: ansible operator plugins: arbitrary code execution via jinja2 template injection 0.5%
• CVE-2026-109968 Medium 5.5 Clevis: clevis: pkcs#11 luks passphrase logged in plaintext to world-readable file <0.1%
• CVE-2026-104795 High 8.8 Insights-runtime-extractor: insights-runtime-extractor: container escape via privileged binary execution 0.2%
• CVE-2026-109971 Medium 4.7 Clevis: clevis: pkcs#11 token pin exposed on command line via pkcs11-tool 0.2%
• CVE-2026-109970 Medium 4.7 Clevis: clevis: pkcs#11 token pin written to world-readable file 0.1%
• CVE-2026-109969 Medium 4.7 Clevis: clevis: no authentication on pkcs#11 af_unix sockets allows key injection under permissive umask 0.1%
• CVE-2026-109976 Medium 4.7 Clevis: clevis: integer underflow in pkcs#11 data socket handler crashes daemon on unbound client connection 0.1%
• CVE-2026-75888 High 7.7 Openshift/console: openshift/console: authenticated ssrf via helm chart url fetch 0.4%
• CVE-2026-107935 Critical 9.3 Gvisor-tap-vsock: gvisor-tap-vsock: unathenticated arbitrary file deletion on the host via /expose 0.2%
• CVE-2026-107565 Medium 5.1 Luksmeta: incomplete gap-boundary and overlap checks in luks1 metadata allocator allow data corruption 0.1%
• CVE-2026-93017 High 7.7 Insights-operator: gather serviceaccount has cluster-wide secret read plus nodes/proxy and cluster-reader 0.4%
• CVE-2026-107176 Medium 6.8 Cluster-samples-operator: role reads all secrets in openshift-config, not just pull-secret 0.3%
• CVE-2026-107161 High 7.5 Cyrus-sasl: heap buffer overflow in cyrus-sasl add_to_challenge() allows malicious server to crash or compromise digest-md5 clients 0.4%
• CVE-2026-104045 Medium 4.7 Sssd: sssd: denial of service via race condition in autofs responder 0.1%
• CVE-2026-104046 Medium 6.2 Sssd: sssd: denial of service via incomplete identity provider authentication requests 0.2%
• CVE-2026-104048 Medium 6.8 Sssd: sssd: authorization bypass via cross-domain username collision in hbac evaluation 0.3%
• CVE-2026-104047 Medium 5.3 Sssd: sssd: information disclosure via query injection in entra id lookups 0.1%
• CVE-2026-104044 Medium 6.2 Sssd: sssd: denial of service via crafted passkey kerberos authentication request 0.1%
• CVE-2026-104043 Medium 5.5 Sssd: sssd: denial of service via undersized packet parsing in nss responder <0.1%
• CVE-2026-104042 Medium 5.5 Sssd: sssd: denial of service via out-of-bounds read in pam responder 0.2%
• CVE-2026-104041 Medium 5.5 Sssd: sssd: denial of service via unbounded negative cache growth 0.1%
• CVE-2026-104040 Medium 4.4 Sssd: sssd: information disclosure via odata injection in entra id lookups 0.1%