5.7
Medium
CVE-2025-25209 The AuthPolicy metadata on Red Hat Connectivity Link contains an object which stores secretes, however it assumes…
Description
The AuthPolicy metadata on Red Hat Connectivity Link contains an object which stores secretes, however it assumes those secretes are already in the kuadrant-system instead of copying it to the referred namespace. This creates space for a malicious actor with a developer persona access to leak those secrets over HTTP connection, as long the attacker knows the name of the targeted secrets and those secrets are limited to one line only.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat Connectivity Link 1 | Versions not published |
Other CVEs of Red Hat Connectivity Link 1
The 38 CVEs of Red Hat Connectivity Link 1 →
CVE-2026-114406
Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns
6.8
Medium
CVE-2026-108334
Github.com/kuadrant/kuadrant-operator/internal/wasm: github.com/rh-api-management/rhcl-operator-product-build/kuadrant-operator: kuadrant-operator: crafted httproute match values can bypass gateway policy overrides
7.4
High
CVE-2026-92925
Redis: redis: out-of-bounds read via crafted cluster bus packets
7.1
High
CVE-2026-13676
fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs
7.5
High