7.4
Élevée
CVE-2026-46579 A flaw was found in the OpenShift Router
Description
A flaw was found in the OpenShift Router. When a Route has `insecureEdgeTerminationPolicy` set to Allow, the HTTP frontend does not remove `X-SSL-Client-*` headers from incoming requests. This allows an unauthenticated attacker to send plain HTTP requests with crafted `X-SSL-Client-*` headers. As a result, backends relying on these headers for mutual TLS (Transport Layer Security) authentication can be bypassed, enabling the attacker to impersonate client certificate identities.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Red Hat OpenShift Container Platform 4 | Versions non publiées | |
| Red Hat OpenShift Container Platform 5 | Versions non publiées | |
| Red Hat OpenShift Container Platform 4.20 1781639027 | premières → < 1781639027 | 1781639027 |
| Red Hat OpenShift Container Platform 4.21 1781552170 | premières → < 1781552170 | 1781552170 |
| Red Hat OpenShift Container Platform 4.22 1781643967 | premières → < 1781643967 | 1781643967 |
| Red Hat OpenShift Container Platform 4.19 1783445642 | premières → < 1783445642 | 1783445642 |
| Red Hat OpenShift Container Platform 4.2 1781639027 | premières → < 1781639027 | 1781639027 |
| Red Hat OpenShift Container Platform 4.18 1783719377 | premières → < 1783719377 | 1783719377 |
| Red Hat OpenShift Container Platform 4.13 1784056734 | premières → < 1784056734 | 1784056734 |
Afficher les 5 autres branches Masquer les 5 autres branches
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Red Hat OpenShift Container Platform 4.14 1784587649 | premières → < 1784587649 | 1784587649 |
| Red Hat OpenShift Container Platform 4.15 1784580646 | premières → < 1784580646 | 1784580646 |
| Red Hat OpenShift Container Platform 4.16 1784331638 | premières → < 1784331638 | 1784331638 |
| Red Hat OpenShift Container Platform 4.17 1784321465 | premières → < 1784321465 | 1784321465 |
| Red Hat OpenShift Container Platform 4.12 1784323891 | premières → < 1784323891 | 1784323891 |
Références
- RHSA-2026:27009 access.redhat.com
- RHSA-2026:27044 access.redhat.com
- RHSA-2026:27063 access.redhat.com
- RHSA-2026:37580 access.redhat.com
- RHSA-2026:40022 access.redhat.com
- RHSA-2026:40828 access.redhat.com
- RHSA-2026:43227 access.redhat.com
- RHSA-2026:43253 access.redhat.com
- RHSA-2026:43331 access.redhat.com
- RHSA-2026:47703 access.redhat.com
- RHSA-2026:47728 access.redhat.com
- access.redhat.com access.redhat.com
- RHBZ#2483181 bugzilla.redhat.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de Red Hat OpenShift Container Platform 4
Les 629 CVE de Red Hat OpenShift Container Platform 4 →
CVE-2026-82976
Image-customization-controller: unauthenticated plaintext image server with directory listing exposes ignition images containing cluster pull secret
7.1
Élevée
CVE-2026-120831
Libslirp: libslirp: queue pointer corruption in if_output() leading to denial of service
6.5
Moyenne
CVE-2026-120830
Libslirp: libslirp: out-of-bounds heap read in icmp_forward_error() leading to information disclosure
7.4
Élevée
CVE-2026-120194
Json-glib: json-glib: infinite loop in json_path_query() with negative jsonpath slice step
7.5
Élevée