EUVD-2026-57687

A flaw was found in search-v2-api. An unauthenticated attacker can exploit this by sending requests with unique random bearer tokens. Each unique token creates a permanent entry in the unbounded tokenReviews cache, which is not properly cleared. This can lead to memory exhaustion of the search-ap...

CVE-2026-73418

NextAuth.js vulnerability CVE-2026-73418: The getToken() helper in next-auth/jwt and @auth/core/jwt can throw an uncaught exception when parsing a malformed Authorization: Bearer header, leading to a per-request denial of service. This occurs when no session cookie is present and the bearer value...

CVE-2026-70398

A flaw was found in multicloud-integrations, a component of Red Hat Advanced Cluster Management RHACM. This vulnerability allows an authenticated user, referred to as a tenant, to manipulate the GitOpsCluster controller. By exploiting this, a tenant can redirect sensitive spoke cluster bearer...

EUVD-2026-57058

A flaw was found in multicloud-integrations, a component of Red Hat Advanced Cluster Management RHACM. This vulnerability allows an authenticated user, referred to as a tenant, to manipulate the GitOpsCluster controller. By exploiting this, a tenant can redirect sensitive spoke cluster bearer...

CVE-2026-70398

A flaw was found in multicloud-integrations, a component of Red Hat Advanced Cluster Management RHACM. This vulnerability allows an authenticated user, referred to as a tenant, to manipulate the GitOpsCluster controller. By exploiting this, a tenant can redirect sensitive spoke cluster bearer...

PT-2026-70969

A flaw was found in multicloud-integrations, a component of Red Hat Advanced Cluster Management RHACM. This vulnerability allows an authenticated user, referred to as a tenant, to manipulate the GitOpsCluster controller. By exploiting this, a tenant can redirect sensitive spoke cluster bearer...

CVE-2026-71468

A flaw was found in acm-search-v2-api-rhel9. When the getFederationConfig function refreshes its cache, it improperly reuses a user's bearer token for all subsequent federated requests until the cache expires. This allows other authenticated users to gain unauthorized access to remote managed hub...

CVE-2026-71474

CVE-2026-71474 affects insights-client (noted in the CVE record as insights-client-rhel9). The flaw: when insights-client receives a non-200 HTTP response, it logs request headers, which may include the cloud.openshift.com pull-secret token. A local user with access to hub pod logs could read thi...

CVE-2026-71468 Acm-search-v2-api-rhel9: search-v2-api: cross-user bearer-token reuse via global federation-config cache

A flaw was found in acm-search-v2-api-rhel9. When the getFederationConfig function refreshes its cache, it improperly reuses a user's bearer token for all subsequent federated requests until the cache expires. This allows other authenticated users to gain unauthorized access to remote managed hub...

CVE-2026-71468

The CVE-2026-71468 entry concerns acm-search-v2-api-rhel9. When getFederationConfig refreshes its cache, it improperly reuses a single user’s bearer token for all subsequent federated requests until cache expiry. This causes information disclosure by allowing other authenticated users to access r...

CVE-2026-71845 Insights-client: insights-client: ccx_token bearer credential logged in clear text at startup via setdefault()

A flaw was found in insights-client. The setDefault function logs the value of every environment variable it processes, including CCXTOKEN, a bearer credential used in disconnected cluster deployments. When glog verbosity is set to level 2 or higher, the token is written in clear text to the pod...

CVE-2026-71845

A flaw was found in insights-client. The setDefault function logs the value of every environment variable it processes, including CCXTOKEN, a bearer credential used in disconnected cluster deployments. When glog verbosity is set to level 2 or higher, the token is written in clear text to the pod...

PT-2026-70868

A flaw was found in acm-search-v2-api-rhel9. When the getFederationConfig function refreshes its cache, it improperly reuses a user's bearer token for all subsequent federated requests until the cache expires. This allows other authenticated users to gain unauthorized access to remote managed hub...

CVE-2026-47662

Pathling CVE-2026-47662 affects Pathling Server prior to 2.0.0. The vulnerability arises because typed CRUD/search/batch endpoints do not consistently enforce per-resource read/write authorities; an authenticated caller with coarse operation rights can act on attacker-chosen resource families. Th...

CVE-2026-70618

Spacebar Server before commit 51da17c contains a missing authorization vulnerability that allows any authenticated user to enumerate complete guild membership by querying the GET /guilds/guildid/roles/roleid/member-ids endpoint without guild membership verification. Attackers can exploit the...

CVE-2026-70618 Spacebar Server Missing Authorization via member-ids Endpoint

Spacebar Server before commit 51da17c contains a missing authorization vulnerability that allows any authenticated user to enumerate complete guild membership by querying the GET /guilds/guildid/roles/roleid/member-ids endpoint without guild membership verification. Attackers can exploit the...

CVE-2026-70437

Jenkins Webhook Secret Credentials Provider Plugin 16.v0cfaf0215cf5 and earlier does not use a constant-time comparison function when checking whether the provided and expected webhook bearer token are equal, potentially allowing attackers to use statistical methods to obtain a valid webhook bear...

CVE-2026-67331

CVE-2026-67331 affects better-auth SCIM, versions 1.5.0 up to but not including 1.7.0-beta.4. The vulnerability arises because non-organization SCIM providers are not bound to their creator by default, enabling an authenticated user to manage other users’ providers. Attackers can regenerate SCIM ...

EUVD-2026-51846

better-auth SCIM versions from 1.5.0 before 1.7.0-beta.4 fail to bind non-organization SCIM providers to their creator by default, allowing authenticated users to manage other users' providers. Attackers can regenerate SCIM bearer tokens, invalidate legitimate tokens, and authenticate to SCIM API...

CVE-2026-18378

A flaw was found in koku-metrics-operator. The operator's CostManagementMetricsConfig custom resource allows user able to edit the CR to specify an arbitrary upload URL. When authentication.type is set to token the default, the cluster-global Red Hat Cloud pull-secret bearer token is attached to...