5.3 Medium

CVE-2025-11065 Github.com/go-viper/mapstructure/v2: go-viper's mapstructure may leak sensitive information in logs in github.com/go-viper/mapstructure

Description

A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in security-critical contexts.

CVSS 3.1 detail

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Exploitable remotely over the network, without an account and if a user takes an action; an attacker can seriously compromise confidentiality, integrity or availability.

Attack vector: Network
Attack complexity: High
Privileges required: None
Interaction: Required
Scope: Unchanged
Confidentiality: High
Integrity: None
Availability: None

Affected products and versions

Product	Affected versions	Fixed in
OpenShift Pipelines	Versions not published
Red Hat Advanced Cluster Management for Kubernetes 2	Versions not published
Red Hat Advanced Cluster Security 4	Versions not published
Red Hat Certification for Red Hat Enterprise Linux 8	Versions not published
Red Hat Certification Program for Red Hat Enterprise Linux 9	Versions not published
Red Hat Enterprise Linux 10	Versions not published
Red Hat Enterprise Linux 9	Versions not published
Red Hat OpenShift AI (RHOAI)	Versions not published
Red Hat OpenShift Container Platform 4	Versions not published

Show the 7 other branches

Product	Affected versions	Fixed in
Red Hat OpenShift Dev Spaces	Versions not published
Red Hat OpenShift distributed tracing 3	Versions not published
Red Hat OpenShift GitOps	Versions not published
Red Hat Trusted Application Pipeline	Versions not published
Red Hat Trusted Artifact Signer	Versions not published
Zero Trust Workload Identity Manager - Tech Preview	Versions not published
Red Hat In-Vehicle Operating System 1	Versions not published

References

access.redhat.com access.redhat.com
RHBZ#2391829 bugzilla.redhat.com
github.com github.com
github.com github.com

Timeline

Published January 26, 2026
Last modified November 5, 2026

The 93 CVEs of OpenShift Pipelines →

CVE-2026-13676 fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs 7.5 High CVE-2026-9697 Impact: undici's ProxyAgent silently drops the requestTls option when configured with a SOCKS5 proxy URI (socks5:// or… 7.4 High CVE-2026-6734 Impact: When using Socks5ProxyAgent, undici reuses a single connection pool across different origins without verifying… 7.5 High CVE-2026-12151 Impact: The undici WebSocket client enforces maxPayloadSize on the cumulative byte count of fragments in a message but… 7.5 High

Track this CVE