CVE-2026-10609

A missing authorization flaw was found in the OpenShift Cluster Logging Operator. The operator creates and forwards ServiceAccount tokens to output destinations without verifying that the ClusterLogForwarder creator has permission to use those credentials, allowing a delegated editor to exfiltrat...

CVE-2026-10609

The vulnerability CVE-2026-10609 affects the OpenShift Cluster Logging Operator. The operator creates and forwards ServiceAccount tokens to output destinations without verifying that the ClusterLogForwarder creator has permission to use those credentials, enabling a delegated editor to exfiltrate...

EUVD-2026-38448

A missing authorization flaw was found in the OpenShift Cluster Logging Operator. The operator creates and forwards ServiceAccount tokens to output destinations without verifying that the ClusterLogForwarder creator has permission to use those credentials, allowing a delegated editor to exfiltrat...

CVE-2026-10609 Openshift/cluster-logging-operator: cluster logging operator creates and forwards serviceaccount tokens without verifying clf creator authorization

A missing authorization flaw was found in the OpenShift Cluster Logging Operator. The operator creates and forwards ServiceAccount tokens to output destinations without verifying that the ClusterLogForwarder creator has permission to use those credentials, allowing a delegated editor to exfiltrat...

CVE-2026-10609

A missing authorization flaw was found in the OpenShift Cluster Logging Operator. The operator creates and forwards ServiceAccount tokens to output destinations without verifying that the ClusterLogForwarder creator has permission to use those credentials, allowing a delegated editor to exfiltrat...

Important: Red Hat Security Advisory: Assisted Installer RHEL 9 components for Multicluster Engine for Kubernetes 2.6.12

Assisted installer RHEL 9 components for the multicluster engine for Kubernetes 2.6.12 General Availability release, with updates to container images. Assisted Installer RHEL 9 integrates components for the general multicluster engine for Kubernetes 2.6.12 release that simplify the process of...

GHSA-XHF5-7WJV-PQXP vulnerabilities

Vulnerabilities for packages: cloudbeat, syft-fips, harvester, kubescape-operator-fips, helm-fips, zarf, kube-mgmt, neuvector-scanner-fips, kgateway, docker-compose, helm-exporter, crossplane-fips, kubescape-operator, helm-mapkubeapis, trivy, kube-arangodb-fips, cluster-api-helm-controller-fips,...

CVE-2026-50221: Server-Side Request Forgery (SSRF)

In OpenStack Swift before 2.37.2, proxy-server does not strip internal update headers X-Container-Host, X-Container-Device, X-Delete-At-Host, X-Delete-At-Device from client requests before forwarding them to object-servers. An authenticated user with write access can inject these headers to...

PT-2026-51518

Name of the Vulnerable Software and Affected Versions OpenShift Cluster Logging Operator affected versions not specified Description A missing authorization flaw exists in the OpenShift Cluster Logging Operator. The operator creates and forwards ServiceAccount tokens to output destinations withou...

CVE-2026-10609: Missing Authorization

A missing authorization flaw was found in the OpenShift Cluster Logging Operator. The operator creates and forwards ServiceAccount tokens to output destinations without verifying that the ClusterLogForwarder creator has permission to use those credentials, allowing a delegated editor to exfiltrat...

PT-2026-51572

Name of the Vulnerable Software and Affected Versions OpenStack Swift versions prior to 2.37.2 Description The proxy-server fails to strip internal update headers from client requests before forwarding them to object-servers. An authenticated user with write access can inject the headers...

OpenAM SAML2 Cluster Cookie-Hash-Redirect Path has Pre-authentication Reflected XSS via `FSUtils.postToTarget`

Summary Certain federation endpoints do not consistently apply output encoding when rendering user-supplied parameters into HTML responses. Under a non-default configuration used in some clustered deployments, this inconsistency can result in reflected XSS in the OpenAM origin without...

CVE-2026-54099

A flaw was found in the Windows Machine Config Operator WMCO for Red Hat OpenShift Container Platform. The WICD CSR auto-approver validates that a Certificate Signing Request contains the organization system:wicd-nodes but does not reject additional organization values such as system:masters. A...

EUVD-2026-38233

A flaw was found in the Windows Machine Config Operator WMCO for Red Hat OpenShift Container Platform. The WICD CSR auto-approver validates that a Certificate Signing Request contains the organization system:wicd-nodes but does not reject additional organization values such as system:masters. A...

CVE-2026-54099 Windows-machine-config-operator: windows-machine-config-operator: wicd csr extra-organization allows privilege escalation to system:masters

A flaw was found in the Windows Machine Config Operator WMCO for Red Hat OpenShift Container Platform. The WICD CSR auto-approver validates that a Certificate Signing Request contains the organization system:wicd-nodes but does not reject additional organization values such as system:masters. A...

CVE-2026-54099

A flaw was found in the Windows Machine Config Operator WMCO for Red Hat OpenShift Container Platform. The WICD CSR auto-approver validates that a Certificate Signing Request contains the organization system:wicd-nodes but does not reject additional organization values such as system:masters. A...

CVE-2026-54099

A flaw was found in the Windows Machine Config Operator WMCO for Red Hat OpenShift Container Platform. The WICD CSR auto-approver validates that a Certificate Signing Request contains the organization system:wicd-nodes but does not reject additional organization values such as system:masters. A...

org.apache.nifi:nifi-framework-kubernetes-nar (>=2.0.0-m3, <=2.0.0), org.apache.nifi:nifi-framework-nar (>=2.0.0-m3, <=2.0.0) +13 more potentially affected by CVE-2026-44914 via org.apache.nifi:nifi-framework-cluster (>=2.0.0-m1, <=2.0.0)

org.apache.nifi:nifi-framework-cluster MAVEN version =2.0.0-m1, =2.0.0-m3, =2.0.0-m3, =2.0.0-m3, =2.0.0-m3, =2.0.0-m3, =2.0.0-m3, =2.0.0-m3, =2.0.0-m1, =2.0.0-m4, =2.0.0-m3, =2.0.0-m3, =2.0.0-m3, =2.0.0-m4 - org.apache.nifi:nifi-web-error 2.0.0-m3 - org.apache.nifi:nifi-web-frontend 2.0.0-m3 -...

Missing Authorization

Overview org.apache.nifi:nifi-framework-cluster is a clustering software for NiFi. Affected versions of this package are vulnerable to Missing Authorization when replacing Process Groups containing components marked with the Restricted annotation. An attacker can gain unauthorized access to...

kernel: ceph: kernel: Ceph: exploit of hardcoded IVECs, in a misuse of AES, resulting in authentication bypass

A flaw was found in the CephX authentication protocol used by Ceph, a distributed storage system. CephX uses AES-128-CBC encryption with a hardcoded initialization vector and no message authentication HMAC, making it vulnerable to the same class of unauthenticated-encryption attacks that...