Known vulnerabilities in Red Hat OpenShift Container Platform 4

Is your version affected?

CVE list

CVE	Summary	Score	Published
CVE-2026-6845	Binutils: binutils: denial of service via crafted elf file	5.0 Medium	Apr 22, 2026
CVE-2026-6842	Nano: nano: local attacker can inject malicious .desktop launcher due to insecure directory permissions	2.5 Low	Apr 22, 2026
CVE-2026-40895	follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows…	6.9 Medium	Apr 21, 2026
CVE-2026-41242	protobufjs compiles protobuf definitions into JavaScript (JS) functions	9.4 Critical	Apr 18, 2026
CVE-2026-6507	Dnsmasq: dnsmasq: denial of service due to out-of-bounds write in dhcp bootreply processing	7.5 High	Apr 17, 2026
CVE-2026-5807	Vault is vulnerable to a denial-of-service condition where an unauthenticated attacker can repeatedly initiate or cancel…	7.5 High	Apr 17, 2026
CVE-2026-4525	If a Vault auth mount is configured to pass through the "Authorization" header, and the "Authorization" header is used…	7.5 High	Apr 17, 2026
CVE-2026-3605	An authenticated user with access to a kvv2 path through a policy containing a glob may be able to delete secrets they…	8.1 High	Apr 17, 2026
CVE-2026-35469	spdystream is a Go library for multiplexing streams over SPDY connections	8.7 High	Apr 16, 2026
CVE-2026-41035	In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort call, leading to a…	7.4 High	Apr 16, 2026
CVE-2026-6245	Sssd: out-of-bounds read in the sssd	5.5 Medium	Apr 15, 2026
CVE-2026-33414	Podman is a tool for managing OCI containers and pods	4.0 Medium	Apr 14, 2026
CVE-2026-1584	Gnutls: gnutls: remote denial of service via crafted clienthello with invalid psk binder	7.5 High	Apr 9, 2026
CVE-2026-39983	basic-ftp is an FTP client for Node.js	8.6 High	Apr 9, 2026
CVE-2026-4878	Libcap: libcap: privilege escalation via toctou race condition in cap_set_file()	6.7 Medium	Apr 9, 2026
CVE-2025-62718	Axios is a promise based HTTP client for the browser and Node.js	6.3 Medium	Apr 9, 2026
CVE-2026-4660	HashiCorp’s go-getter library up to v1.8.5 may allow arbitrary file reads on the file system during certain git…	7.5 High	Apr 9, 2026
CVE-2026-32280	During chain building, the amount of work that is done is not correctly limited when a large number of intermediate…	7.5 High	Apr 8, 2026
CVE-2026-27140	SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code execution…	8.8 High	Apr 8, 2026
CVE-2026-32283	If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection…	7.5 High	Apr 8, 2026
CVE-2026-33810	When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to…	7.5 High	Apr 8, 2026
CVE-2026-39364	Vite is a frontend tooling framework for JavaScript	8.2 High	Apr 7, 2026
CVE-2026-39363	Vite is a frontend tooling framework for JavaScript	8.2 High	Apr 7, 2026
CVE-2025-14821	Libssh: libssh: insecure default configuration leads to local man-in-the-middle attacks on windows	7.8 High	Apr 7, 2026
CVE-2026-5745	Libarchive: a null pointer dereference vulnerability exists in the acl parser of libarchive	5.5 Medium	Apr 7, 2026

Other Red Hat products