Red Hat Advanced Cluster Management for Kubernetes 2.

Ansible-operator-plugins: ansible operator plugins: arbitrary code execution via jinja2 template injection

• Red Hat Ansible Automation Platform 2.6
• Red Hat Ansible Automation Platform 2.7
• Code injection

Ansible-core: ansible-core: ansible-galaxy collection install symlink path escape allows arbitrary file write / code execution

• Red Hat Migration Toolkit for Applications 8
• Red Hat Migration Toolkit for Virtualization
• Path traversal

Multicluster-observability-addon: multicluster-observability-addon: possible unauthenticated debug/metrics endpoint via cmdfactory.newcontrollercommandconfig (confirmed exposed by engineering)

• Red Hat Advanced Cluster Management for Kubernetes 2
• Information disclosure

Flightctl: flightctl: package-global go-git https transport mutated per-repo -- cross-tenant tls-config bleed

• Red Hat RHEM 1.2 for RHEL 10
• Red Hat RHEM 1.2 for RHEL 9
• CWE-413

Submariner: submariner: ipsec.conf stanza injection via remote-supplied cablename and subnets

• Red Hat Advanced Cluster Management for Kubernetes 2.16
• Red Hat Advanced Cluster Management for Kubernetes 2.17
• Code injection

Submariner: submariner: missing validation of remote endpoint subnets and clusterid enables cross-cluster traffic hijack

• Red Hat Advanced Cluster Management for Kubernetes 2.16
• Red Hat Advanced Cluster Management for Kubernetes 2.17
• CWE-345

Search-v2-operator: search-v2-operator: operator clusterrole is cluster-admin equivalent via impersonate, rbac write, csr approve, and manifestwork

• Red Hat Advanced Cluster Management for Kubernetes 2.11
• Red Hat Advanced Cluster Management for Kubernetes 2.13
• Privilege escalation

Submariner-operator: broker serviceaccount secret (token + ca) logged in full at trace verbosity

• Red Hat Advanced Cluster Management for Kubernetes 2.11
• Red Hat Advanced Cluster Management for Kubernetes 2.13
• Information disclosure

Submariner-operator: release workflow consumes same-org composite action via mutable @devel branch ref

• Red Hat Advanced Cluster Management for Kubernetes 2.16
• Red Hat Advanced Cluster Management for Kubernetes 2.17
• CWE-1357

Submariner-operator: operator clusterrole grants cluster-wide create/update on all configmaps

• Red Hat Advanced Cluster Management for Kubernetes 2.16
• Red Hat Advanced Cluster Management for Kubernetes 2.17
• Privilege escalation

Submariner-operator: pprof debug endpoint enabled by default on 0.0.0.0:8082 without authentication

• Red Hat Advanced Cluster Management for Kubernetes 2.11
• Red Hat Advanced Cluster Management for Kubernetes 2.13
• CWE-749

Managed-serviceaccount: managed-serviceaccount: hub addon-manager clusterrole grants cluster-wide secret read/write and csr approval

• Red Hat Multicluster Engine for Kubernetes
• Red Hat Advanced Cluster Management for Kubernetes 2
• Privilege escalation

Search-v2-operator: search-v2-operator: cluster-wide impersonate on users/groups shared across 4 pods grants hub system:masters

• Red Hat Advanced Cluster Management for Kubernetes 2.11
• Red Hat Advanced Cluster Management for Kubernetes 2.13
• Privilege escalation

Multicloud-operators-subscription: multicloud-operators-subscription: isclusteradmin() trusts user-settable annotations on managed clusters

• Red Hat Multicluster Global Hub 1.4.9
• Red Hat Multicluster Global Hub 1.5.8
• Broken access control

Hypershift: konnectivity proxy-server accepts agent connections without validating client certificates

• Red Hat multicluster engine for Kubernetes 2.1
• Red Hat multicluster engine for Kubernetes 2.11
• Authentication bypass

Nx: nx/devkit: malicious versions of nx and plugins published to npm

• Red Hat Multicluster Global Hub
• Red Hat OpenShift Serverless
• CWE-506

Openshift api admission checks does not enforce "custom-host" permissions

• kubernetes
• Red Hat Advanced Cluster Management for Kubernetes 2
• Broken access control

Ocp & fips mode

• openshift
• Red Hat OpenShift Serverless
• CWE-693