GHSA-PHWJ-RPRQ-35PP vulnerabilities

Vulnerabilities for packages: ruby3.4-rails, logstash, ruby3.2-rails, gitlab-rails-ce, pact-broker-docker-fips, ruby3.3-rails, kube-logging-operator, ruby4.0-rails, logstash-fips, pact-broker-docker...

CVE-2026-54906 vulnerabilities

Vulnerabilities for packages: ruby3.2-fluentd-kubernetes-daemonset, ruby3.4-rails, ruby3.2-rails, ruby3.3-fluentd-kubernetes-daemonset, ruby3.3-rails, ruby3.4-fluentd-kubernetes-daemonset, ruby4.0-fluentd-kubernetes-daemonset, kube-logging-operator, ruby4.0-rails, kube-fluentd-operator...

GHSA-98M9-HRRM-R99R vulnerabilities

Vulnerabilities for packages: gitlab-cng, logstash, gitlab-rails-ce-fips, ruby3.3-faraday, gitlab-rails-ce, kube-logging-operator, cinc-auditor, kube-fluentd-operator, logstash-fips...

CVE-2026-54297 vulnerabilities

Vulnerabilities for packages: gitlab-cng, logstash, gitlab-rails-ce-fips, ruby3.3-faraday, gitlab-rails-ce, kube-logging-operator, cinc-auditor, kube-fluentd-operator, logstash-fips...

GHSA-CVXM-645Q-P574 vulnerabilities

Vulnerabilities for packages: docker, upwind-agent, kgateway, gitlab-rails-ce, docker-cli-buildx-fips, cluster-api-helm-controller-fips, tekton-pipelines, kaniko, helm-fips, amazon-ecs-agent-fips, skaffold, helm-mapkubeapis, linkerd2, steampipe, buildkitd-fips, amazon-ecs-agent, grype,...

GHSA-WJ3P-5H3X-C74Q vulnerabilities

Vulnerabilities for packages: backup-restore-operator-fips, backup-restore-operator...

CVE-2025-62879 vulnerabilities

Vulnerabilities for packages: backup-restore-operator-fips, backup-restore-operator...

GHSA-JPCC-P29G-P8MQ vulnerabilities

Vulnerabilities for packages: docker, upwind-agent, kgateway, gitlab-rails-ce, docker-cli-buildx-fips, cluster-api-helm-controller-fips, kaniko, helm-fips, amazon-ecs-agent-fips, skaffold, helm-mapkubeapis, linkerd2, steampipe, buildkitd-fips, amazon-ecs-agent, grype, dagger, harvester,...

GHSA-XHF5-7WJV-PQXP vulnerabilities

Vulnerabilities for packages: docker, kgateway, gitlab-rails-ce, docker-cli-buildx-fips, cluster-api-helm-controller-fips, kaniko, helm-fips, amazon-ecs-agent-fips, skaffold, helm-mapkubeapis, linkerd2, steampipe, buildkitd-fips, amazon-ecs-agent, grype, dagger, harvester, kgateway-fips, scorecar...

GHSA-5WRP-CWCJ-Q835 vulnerabilities

Vulnerabilities for packages: restic, cert-manager-openshift-routes-fips, crossplane-provider-aws-opensearch-fips, dex, kubernetes-csi-driver-nfs, crossplane-provider-azure-security, secrets-store-csi-driver-provider-azure-fips, linkerd2, steampipe, gomplate-fips, kubernetes-csi-external-resizer,...

CVE-2026-41178 vulnerabilities

Vulnerabilities for packages: restic, cert-manager-openshift-routes-fips, crossplane-provider-aws-opensearch-fips, dex, kubernetes-csi-driver-nfs, crossplane-provider-azure-security, secrets-store-csi-driver-provider-azure-fips, linkerd2, steampipe, gomplate-fips, kubernetes-csi-external-resizer,...

Security Bulletin: Multiple Vulnerabilities in IBM Operator for PostgreSQL

Summary Multiple vulnerabilities were addressed in IBM Operator for PostgreSQL version v28.3.2. Vulnerability Details CVEID:CVE-2026-27145 DESCRIPTION:x509.Certificate.VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name SAN entries. This caused...

Important: Red Hat Security Advisory: Cost Management Metrics Operator Update

Cost Management Metrics Operator version 4.4.1 release. The Cost Management Metrics Operator is a component of the Red Hat Cost Managment service for Openshift. The operator runs on the latest supported versions of Openshift. This operator obtains OpenShift usage data by querying Prometheus every...

CVE-2026-54100 Windows-machine-config-operator: windows-machine-config-operator: ssh host key not verified enables credential theft

A flaw was found in the Windows Machine Config Operator WMCO for Red Hat OpenShift Container Platform. WMCO establishes SSH connections to Windows worker nodes without verifying the remote server host key. An adjacent-network attacker who can intercept or redirect WMCO's SSH session can capture...

EUVD-2026-38234

A flaw was found in the Windows Machine Config Operator WMCO for Red Hat OpenShift Container Platform. WMCO establishes SSH connections to Windows worker nodes without verifying the remote server host key. An adjacent-network attacker who can intercept or redirect WMCO's SSH session can capture...

CVE-2026-54100 Windows-machine-config-operator: windows-machine-config-operator: ssh host key not verified enables credential theft

A flaw was found in the Windows Machine Config Operator WMCO for Red Hat OpenShift Container Platform. WMCO establishes SSH connections to Windows worker nodes without verifying the remote server host key. An adjacent-network attacker who can intercept or redirect WMCO's SSH session can capture...

CVE-2026-54099

A flaw was found in the Windows Machine Config Operator WMCO for Red Hat OpenShift Container Platform. The WICD CSR auto-approver validates that a Certificate Signing Request contains the organization system:wicd-nodes but does not reject additional organization values such as system:masters. A...

CVE-2026-54099

The CVE-2026-54099 entry describes a vulnerability in the Windows Machine Config Operator (WMCO) for Red Hat OpenShift. The WICD CSR auto-approver only checks that a CSR’s organization includes system:wicd-nodes and does not reject extra organization values such as system:masters. A compromised W...

CVE-2026-54099 Windows-machine-config-operator: windows-machine-config-operator: wicd csr extra-organization allows privilege escalation to system:masters

A flaw was found in the Windows Machine Config Operator WMCO for Red Hat OpenShift Container Platform. The WICD CSR auto-approver validates that a Certificate Signing Request contains the organization system:wicd-nodes but does not reject additional organization values such as system:masters. A...

CVE-2026-54100

A flaw was found in the Windows Machine Config Operator WMCO for Red Hat OpenShift Container Platform. WMCO establishes SSH connections to Windows worker nodes without verifying the remote server host key. An adjacent-network attacker who can intercept or redirect WMCO's SSH session can capture...