7.1
Élevée
CVE-2026-83550 A flaw was found in postgres-exporter
Description
A flaw was found in postgres-exporter. Due to the blank import of `net/http/pprof`, debug endpoints are exposed on the unauthenticated metrics listener. A remote attacker within the cluster network can access these endpoints. This allows for information disclosure, potentially revealing process arguments, full goroutine stacks, and sensitive data like database connection strings or passwords from heap dumps. Additionally, repeated CPU profiling through these endpoints can lead to a denial of service.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Multicluster Global Hub | Versions non publiées |
Références
- access.redhat.com access.redhat.com
- RHBZ#2526444 bugzilla.redhat.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de Multicluster Global Hub
Les 32 CVE de Multicluster Global Hub →
CVE-2026-110744
A flaw was found in multicluster-global-hub-operator-bundle
7.2
Élevée
CVE-2026-66792
A flaw was found in the multicloud-operators-subscription component
9.9
Critique
CVE-2026-71577
A flaw was found in multicluster-global-hub
6.3
Moyenne
CVE-2026-71576
A flaw was found in multicluster-global-hub
8.5
Élevée