A credentials leak was found in the OpenShift Container Platform.

published 2022-09-01 4 y ago modified 2026-06-17 4 mo ago also EUVD-2022-34666

cvss: 6.5; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 0.6%; EPSS 0.6% chance of exploitation in 30 days, percentile 48%
public exploits: 0; none known

A credentials leak was found in the OpenShift Container Platform. The private key for the external cluster certificate was stored incorrectly in the oauth-serving-cert ConfigMaps, and accessible to any authenticated OpenShift user or service-account. A malicious user could exploit this flaw by reading the oauth-serving-cert ConfigMap in the openshift-config-managed namespace, compromising any web traffic secured using that certificate.

Patch / fix

links 1

bugzilla.redhat.com/show_bug.cgi?id=2101959 advisory

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-2403 updated 2025-11-21 cvss 7.7

openshift: oauth-serving-cert configmap contains cluster certificate private key

Red Hat OpenShift Container Platform 4.9 openshift4/ose-cluster-authentication-operator v4.9.0-202208020055.p0.g265030f.assembly.stream
fixed: vendor fix RHSA-2022:5879
Red Hat OpenShift Container Platform 4.10 openshift4/ose-cluster-authentication-operator v4.10.0-202207160316.p0.g6a015c7.assembly.stream
fixed: vendor fix RHSA-2022:5664
Red Hat OpenShift Container Platform 4.9 openshift4/ose-cli v4.9.0-202208020055.p0.gb49c285.assembly.stream, openshift4/ose-pod v4.9.0-202208020055.p0.g9e95cb9.assembly.stream, openshift4/ose-etcd v4.9.0-202208020055.p0.g9b68298.assembly.stream, openshift4/ose-tests v4.9.0-202208020055.p0.g6ec9a5e.assembly.stream, openshift4/ose-console v4.9.0-202208021435.p0.g43a4326.assembly.stream, openshift4/ose-coredns v4.9.0-202208020055.p0.g3cb11c0.assembly.stream, +148 more Red Hat OpenShift Container Platform 4.10 openshift4/ose-console v4.10.0-202207190927.p0.g340c7b6.assembly.stream, openshift4/ose-ovn-kubernetes v4.10.0-202207191528.p0.gc1cf9f9.assembly.stream, openshift4/network-tools-rhel8 v4.10.0-202207190036.p0.gbcfec9c.assembly.stream, openshift4/ose-operator-registry v4.10.0-202207151137.p0.g69bb8fe.assembly.stream, openshift4/ose-machine-config-operator v4.10.0-202207191237.p0.gbe815b3.assembly.stream, openshift4/ose-cluster-version-operator v4.10.0-202207191449.p0.g288bd4d.assembly.stream, +5 more
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.60% chance of exploitation in the next 30 days, higher than 48% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
NVD	3.1	6.5	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected products

n/a Openshift

Classification

Weakness

CWE-497 Exposure of Sensitive System Information to an Unauthorized Control Sphere
CWE-668 Exposure of Resource to Wrong Sphere

References

bugzilla.redhat.com /show_bug.cgi?id=2101959
issue-tracking, patch, vendor-advisory
access.redhat.com /security/cve/CVE-2022-2403
vendor-advisory

Sources

CVE List CVE-2022-2403
NVD CVE-2022-2403

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary