8.7
Élevée
CVE-2025-11393 A flaw was found in runtimes-inventory-rhel8-operator
Description
A flaw was found in runtimes-inventory-rhel8-operator. An internal proxy component is incorrectly configured. Because of this flaw, the proxy attaches the cluster's main administrative credentials to any command it receives, instead of only the specific reports it is supposed to handle. This allows a standard user within the cluster to send unauthorized commands to the management platform, effectively acting with the full permissions of the cluster administrator. This could lead to unauthorized changes to the cluster's configuration or status on the Red Hat platform.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Red Hat Lightspeed (formerly Insights) for Runtimes 1.0 1.0 | premières → < 1.0.0-1765483112 | 1.0.0-1765483112 |
| Red Hat Runtimes Inventory Operator | Versions non publiées | |
| Red Hat Lightspeed (formerly Insights) for Runtimes 1 1.0 | premières → < 1.0.0-1765483112 | 1.0.0-1765483112 |
Autres CVE de Red Hat Lightspeed (formerly Insights) for Runtimes 1.0
Les 11 CVE de Red Hat Lightspeed (formerly Insights) for Runtimes 1.0 →
CVE-2026-27145
(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name…
6.5
Moyenne
CVE-2026-39821
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label
9.6
Critique
CVE-2026-33811
When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a…
7.5
Élevée
CVE-2026-32280
During chain building, the amount of work that is done is not correctly limited when a large number of intermediate…
7.5
Élevée