5.7
Moyenne
CVE-2025-25209 The AuthPolicy metadata on Red Hat Connectivity Link contains an object which stores secretes, however it assumes…
Description
The AuthPolicy metadata on Red Hat Connectivity Link contains an object which stores secretes, however it assumes those secretes are already in the kuadrant-system instead of copying it to the referred namespace. This creates space for a malicious actor with a developer persona access to leak those secrets over HTTP connection, as long the attacker knows the name of the targeted secrets and those secrets are limited to one line only.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Red Hat Connectivity Link 1 | Versions non publiées |
Références
- access.redhat.com access.redhat.com
- RHBZ#2347438 bugzilla.redhat.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de Red Hat Connectivity Link 1
Les 38 CVE de Red Hat Connectivity Link 1 →
CVE-2026-114406
Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns
6.8
Moyenne
CVE-2026-108334
Github.com/kuadrant/kuadrant-operator/internal/wasm: github.com/rh-api-management/rhcl-operator-product-build/kuadrant-operator: kuadrant-operator: crafted httproute match values can bypass gateway policy overrides
7.4
Élevée
CVE-2026-92925
Redis: redis: out-of-bounds read via crafted cluster bus packets
7.1
Élevée
CVE-2026-13676
fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs
7.5
Élevée