Skip to content
Fencer Vulns
critical 9.1

CVE-2026-33186 json

gRPC-Go has an authorization bypass via missing leading slash in :path

published 2026-03-18 7 mo ago modified 2026-09-18 51 d ago also EUVD-2026-13830 , GHSA-p77j-4mvh-x3m3 , GO-2026-4762

cvss
9.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.6%
EPSS 1.6% chance of exploitation in 30 days, percentile 76%
public exploits
0
none known

Summary

gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 `:path` pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests where the `:path` omitted the mandatory leading slash (e.g., `Service/Method` instead of `/Service/Method`). While the server successfully routed these requests to the correct handler, authorization interceptors (including the official `grpc/authz` package) evaluated the raw, non-canonical path string. Consequently, "deny" rules defined using canonical paths (starting with `/`) failed to match the incoming request, allowing it to bypass the policy if a fallback "allow" rule was present. This affects gRPC-Go servers that use path-based authorization interceptors, such as the official RBAC implementation in `google.golang.org/grpc/authz` or custom interceptors relying on `info.FullMethod` or `grpc.Method(ctx)`; AND that have a security policy contains specific "deny" rules for canonical paths but allows other requests by default (a fallback "allow" rule). The vulnerability is exploitable by an attacker who can send raw HTTP/2 frames with malformed `:path` headers directly to the gRPC server. The fix in version 1.79.3 ensures that any request with a `:path` that does not start with a leading slash is immediately rejected with a `codes.Unimplemented` error, preventing it from reaching authorization interceptors or handlers with a non-canonical path string. While upgrading is the most secure and recommended path, users can mitigate the vulnerability using one of the following methods: Use a validating interceptor (recommended mitigation); infrastructure-level normalization; and/or policy hardening.

Patch / fix

  • go google.golang.org/grpc 1.79.3
  • Red Hat Cryostat 4 on RHEL 9 4.2.0-9, 4.2.0-13
  • Red Hat Red Hat Enterprise Linux 10 0:0.144.0-2.el10_2, 0:52.1-1.el10_2, 0:165.1-2.el10_2
  • Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support 0:0.144.0-2.el10_0, 0:134.1-9.el10_0
  • Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support 0:0.11-1.el7_9
  • Red Hat Red Hat Enterprise Linux 8 0:101.5-1.el8_10, 1:0.2.5-6.el8_10
  • Red Hat Red Hat Enterprise Linux 9 0:0.144.0-2.el9_8, 0:52.1-1.el9_8, 0:165.1-2.el9_8, 1:0.2.7-4.el9_7, 1:0.2.7-5.el9_8
  • Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions 0:76.1-7.el9_2
  • Red Hat Red Hat Enterprise Linux 9.4 Extended Update Support 0:0.144.0-2.el9_4
  • Red Hat Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions 0:101.3-4.el9_4.4
  • Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support 0:0.144.0-2.el9_6, 0:132.2-9.el9_6, 1:0.2.7-1.el9_6.3
  • Red Hat Red Hat OpenShift Container Platform 4.15 0:4.15.0-202606231944.p2.g5638728.assembly.stream.el8, 1777474279, 1779915526, 1779915561, 1779915852, 1779916110, 1779917250, 1779971974, 1781825365, 1781926899, 1781929172, 1781930056, 1781930185, 1784576606, 1784576627, 1784576807, 1784577372, 1784579279, 1787028137
  • Red Hat Red Hat OpenShift Container Platform 4.16 0:4.16.0-202606221818.p2.ga3ebdc0.assembly.stream.el8, 0:4.16.63-202605251227.p0.g1133ac0.assembly.4.16.63.el9, 1776697787, 1779251243, 1779251373, 1779253321, 1779253426, 1780954182, 1780954214, 1780954278, 1780954513, 1780961156, 1780967097, 1782186683, 1782187184, 1782189015, 1782189888, 1782190668, 1782191413, 1782211441
  • Red Hat Red Hat OpenShift Container Platform 4.17 0:4.17.0-202606171749.p2.g5bcfbfd.assembly.stream.el8, 1778700008, 1778707466, 1778707862, 1778707884, 1778711399, 1778711679, 1782185580, 1782185590, 1782185654, 1782185744, 1782185749, 1782185779, 1782185795, 1782186304, 1782186750, 1782187708, 1782187930, 1782187967, 1782189274
  • Red Hat Red Hat OpenShift Container Platform 4.18 0:4.18.0-202606160919.p2.g9795abd.assembly.stream.el8, 0:4.18.42-202605181217.p0.gf4eeb37.assembly.4.18.42.el9, 1776978507, 1777070108, 1777147660, 1778152595, 1778152640, 1778242571, 1779778894, 1779778938, 1779780440, 1779780611, 1779781142, 1779781266, 1779783306, 1779786555, 1779786900, 1779787336, 1779787474, 1779804441
  • Red Hat Red Hat OpenShift Container Platform 4.19 0:4.19.0-202606111920.p2.g6282230.assembly.stream.el9, 0:4.19.32-202605212036.p0.g27d51c3.assembly.4.19.32.el9, 1776668614, 1776673375, 1779249778, 1779249836, 1779249856, 1779249904, 1779250043, 1779250061, 1779250439, 1779250924, 1779251201, 1779251684, 1779251714, 1779252024, 1779253452, 1779254092, 1779254528, 1779261357
  • Red Hat Red Hat OpenStack Platform 16.2 0:3.3.23-22.el8ost
  • Red Hat Red Hat OpenStack Platform 17.1 for RHEL 9 0:3.4.26-9.5.el9ost
  • Red Hat Red Hat Satellite 6.16 for RHEL 8 0:0.0.3-5.el8sat
  • Red Hat Red Hat Satellite 6.16 for RHEL 9 0:0.0.3-5.el9sat
  • Red Hat Red Hat Satellite 6.17 for RHEL 9 0:0.0.4-1.el9sat
  • Red Hat Red Hat Satellite 6.18 for RHEL 9 0:0.0.4-1.el9sat
  • Red Hat Red Hat Satellite 6.19 for RHEL 9 0:0.0.4-1.el9sat
  • Red Hat RHEM 1.0 for RHEL 9 0:1.0.3-1.el9em
  • Red Hat RHEM 1.1 for RHEL 10 0:1.1.3-1.el10em
  • Red Hat RHEM 1.1 for RHEL 9 0:1.1.3-1.el9em
  • Red Hat Builds for Red Hat OpenShift 1.6.0 1776851845, 1776852121, 1776859898
  • Red Hat Cert Manager support for Red Hat OpenShift release 1.19 1786613805
  • Red Hat Compliance Operator 1 1776237332
  • Red Hat DevWorkspace Operator 0.4 1776457293, 1776457327
  • golang-google-grpc Debian 14 1.79.3-1

debian advisories DEBIAN-CVE-2026-33186

  • etcd openstack 16.2 3.3.23-22.el8ost
  • erlang openstack 16.2 23.3.4.18-2.el8ost
  • erlang-ssl openstack 16.2 23.3.4.18-2.el8ost
  • erlang-asn1 openstack 16.2 23.3.4.18-2.el8ost
  • erlang-erts openstack 16.2 23.3.4.18-2.el8ost
  • erlang-hipe openstack 16.2 23.3.4.18-2.el8ost
  • erlang-sasl openstack 16.2 23.3.4.18-2.el8ost
  • erlang-snmp openstack 16.2 23.3.4.18-2.el8ost

red hat advisories RHSA-2026:61245RHSA-2026:56959RHSA-2026:54757RHSA-2026:54191RHSA-2026:48790RHSA-2026:43225

  • containerd Linux Micro 6.0 1.7.29-159998.1.1
  • docker-stable SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +8 more 24.0.9_ce-150000.1.48.1
  • google-guest-agent SLE Module for Public Cloud 12 20260903.01-1.75.1
  • google-guest-agent SLE Module for Public Cloud 15 SP7, SLE Module for Public Cloud 15 SP6, SLE Module for Public Cloud 15 SP5 +2 more 20260903.01-150000.1.85.1
  • google-guest-agent Linux Micro 6.0 20260903.01-2.1
  • google-guest-agent Linux Micro 6.1 20260903.01-slfo.1.1_2.1
  • distribution SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +8 more 3.1.1-150400.9.41.1
  • terraform-provider-susepubliccloud SLE Module for Public Cloud 15 SP5, SLE Module for Public Cloud 15 SP4 0.0.1-150100.3.14.1

suse advisories SUSE-SU-2026:24136-1SUSE-SU-2026:4535-1SUSE-SU-2026:4533-1SUSE-SU-2026:4272-1SUSE-SU-2026:4270-1SUSE-SU-2026:23874-1

  • fortio openSUSE Tumbleweed 1.76.0-1.1
  • kubectl-retina openSUSE Tumbleweed 1.3.1-1.1
  • kumactl openSUSE Tumbleweed 3.0.0-1.1
  • timoni openSUSE Tumbleweed 0.36.0-1.1
  • pvetui openSUSE Tumbleweed 1.4.3-1.1
  • containerized-data-importer1.65 openSUSE Leap 16.0 1.65.0-160000.3.1
  • cf-cli openSUSE Tumbleweed 8.18.4+git.0.3fcd823a1-1.1
  • govulncheck-vulndb openSUSE Leap 16.0 0.0.20260723T184607-160000.1.1

opensuse advisories openSUSE-SU-2026:12321-1openSUSE-SU-2026:12297-1openSUSE-SU-2026:12300-1openSUSE-SU-2026:12309-1openSUSE-SU-2026:11970-1openSUSE-SU-2026:21824-1

  • osbuild-composer AlmaLinux 8 101.5-1.el8_10.alma.1
  • osbuild-composer-core AlmaLinux 8 101.5-1.el8_10.alma.1
  • osbuild-composer-worker AlmaLinux 8 101.5-1.el8_10.alma.1
  • opentelemetry-collector AlmaLinux 10 0.144.0-2.el10_2
  • opentelemetry-collector AlmaLinux 9 0.144.0-2.el9_8

almalinux advisories ALSA-2026:48790ALSA-2026:19135ALSA-2026:19353

  • osbuild-composer Rocky Linux 8 101.5-1.el8_10.rocky.0.6
  • osbuild-composer Rocky Linux 9 165.1-2.el9_8.rocky.0.1
  • osbuild-composer Rocky Linux 10 165.1-2.el10_2.rocky.0.1
  • image-builder Rocky Linux 10 52.1-1.el10_2.rocky.0.1
  • image-builder Rocky Linux 9 52.1-1.el9_8
  • opentelemetry-collector Rocky Linux 10 0.144.0-2.el10_2
  • opentelemetry-collector Rocky Linux 9 0.144.0-2.el9_8

rocky linux advisories RLSA-2026:48790RLSA-2026:22714RLSA-2026:22450RLSA-2026:22937RLSA-2026:23228RLSA-2026:19135

  • rclone Alpine 3.24 1.73.5-r0

alpine advisories ALPINE-CVE-2026-33186

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-33186 updated cvss 9.1

google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation

  • Red Hat Assisted Installer for Red Hat OpenShift Container Platform 2 assisted/agent-preinstall-image-builder-rhel9 Red Hat cert-manager Operator for Red Hat OpenShift cert-manager/cert-manager-operator-bundle Red Hat Cryostat 4 cryostat/cryostat-grafana-dashboard-rhel9 Red Hat Deployment Validation Operator dvo/deployment-validation-rhel8-operator
    affected: workaround, no fix available
  • Red Hat Dynamic Accelerator Slicer Operator for Red Hat OpenShift dynamic-accelerator-slicer-tech-preview/instaslice-webhook-rhel9, dynamic-accelerator-slicer-tech-preview/instaslice-rhel9-operator, dynamic-accelerator-slicer-tech-preview/instaslice-daemonset-rhel9, dynamic-accelerator-slicer-tech-preview/instaslice-operator-bundle, dynamic-accelerator-slicer-tech-preview/instaslice-scheduler-rhel9
    affected: workaround, no fix available, no fix planned “Will not fix”
  • Red Hat ExternalDNS Operator edo/external-dns-rhel9 Red Hat Fence Agents Remediation Operator redhat-user-workloads/rhwa-tenant/fence-agents-remediation/far-operator-0-8 Red Hat File Integrity Operator compliance/openshift-compliance-openscap-rhel8, compliance/openshift-compliance-rhel8-operator, compliance/openshift-compliance-operator-bundle, compliance/openshift-compliance-must-gather-rhel8, compliance/openshift-file-integrity-rhel8-operator, compliance/openshift-file-integrity-operator-bundle
    affected: workaround, no fix available
  • Red Hat Gatekeeper 3 gatekeeper/gatekeeper-rhel9
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Job Set Tech Preview job-set/jobset-rhel9, job-set/jobset-rhel9-operator, job-set/jobset-operator-bundle
    affected: workaround, no fix available
  • Red Hat Kernel Module Management Operator for Red Hat Openshift kmm/kernel-module-management-worker-rhel9, kmm/kernel-module-management-signing-rhel9, kmm/kernel-module-management-rhel9-operator, kmm/kernel-module-management-operator-bundle, kmm/kernel-module-management-must-gather-rhel9, kmm/kernel-module-management-hub-rhel9-operator, +2 more
    affected: workaround, no fix available, no fix planned “Will not fix”
  • Red Hat Kube Descheduler Operator kube-descheduler-operator/descheduler-rhel9, kube-descheduler-operator/kube-descheduler-rhel9-operator Red Hat Leader Worker Set leader-worker-set/lws-rhel9, leader-worker-set/lws-rhel9-operator, leader-worker-set/lws-operator-bundle
    affected: workaround, no fix available
  • Red Hat Logging Subsystem for Red Hat OpenShift openshift-logging/vector-rhel9, openshift-logging/fluentd-rhel9, openshift-logging/eventrouter-rhel9, openshift-logging/logging-loki-rhel9, openshift-logging/loki-rhel9-operator, openshift-logging/opa-openshift-rhel9, +6 more
    affected: workaround, no fix planned “Will not fix”
show 13 more
  • Red Hat Logical Volume Manager Storage lvms4/topolvm-rhel8, lvms4/lvms-operator-bundle, lvms4/lvms-must-gather-rhel8, lvms4/lvms-must-gather-rhel9
    affected: workaround, no fix available
  • Red Hat Migration Toolkit for Containers rhmtc/openshift-migration-rhel8-operator Red Hat Migration Toolkit for Virtualization mtv-candidate/mtv-api-rhel9, mtv-candidate/mtv-rhel9-operator, mtv-candidate/mtv-virt-v2v-rhel9, mtv-candidate/mtv-operator-bundle, mtv-candidate/mtv-ova-proxy-rhel9, mtv-candidate/mtv-controller-rhel9, +10 more
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Multicluster Engine for Kubernetes multicluster-engine/hive-rhel9, multicluster-engine/cluster-proxy-rhel9, multicluster-engine/assisted-installer-rhel8, multicluster-engine/assisted-service-8-rhel8, multicluster-engine/assisted-service-9-rhel9, multicluster-engine/hypershift-rhel9-operator, +7 more Red Hat Multicluster Global Hub multicluster-globalhub/multicluster-globalhub-kessel-inventory-api-rhel9 Red Hat OpenShift Developer Tools and Services openshift4/ose-jenkins, ocp-tools-4/jenkins-rhel8, ocp-tools-4/jenkins-rhel9, ocp-tools-4/jenkins-agent-base-rhel9 Red Hat OpenShift Lightspeed openshift-lightspeed/lightspeed-rhel9-operator
    affected: workaround, no fix available
  • Red Hat OpenShift Pipelines openshift-pipelines-client, openshift-pipelines/pipelines-opc-rhel9, openshift-pipelines/pipelines-cache-rhel9, openshift-pipelines/pipelines-events-rhel8, openshift-pipelines/pipelines-events-rhel9, openshift-pipelines/pipelines-cli-tkn-rhel8, +44 more
    affected: workaround, no fix available, no fix planned “Will not fix”
  • Red Hat OpenShift Run Once Duration Override Operator run-once-duration-override-operator/run-once-duration-override-rhel9, run-once-duration-override-operator/run-once-duration-override-rhel9-operator, run-once-duration-override-operator/run-once-duration-override-operator-bundle Red Hat OpenShift Secondary Scheduler Operator openshift-secondary-scheduler-operator/secondary-scheduler-rhel9-operator
    affected: workaround, no fix available
  • Red Hat OpenShift Serverless openshift-serverless-clients, openshift-serverless-1/kn-client-kn-rhel9, openshift-serverless-1/kn-ekb-receiver-rhel9, openshift-serverless-1/kn-serving-queue-rhel9, openshift-serverless-1/kn-ekb-dispatcher-rhel9, openshift-serverless-1/net-istio-webhook-rhel9, +26 more
    affected: workaround, no fix available, no fix planned “Will not fix”
  • Red Hat OpenShift Service Mesh 2 openshift-service-mesh/proxyv2-rhel9 Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/thanos-rhel9, rhacm2/prometheus-rhel9, rhacm2/acm-prometheus-rhel9, rhacm2/acm-siteconfig-rhel9, rhacm2/kube-rbac-proxy-rhel9, rhacm2/mtv-integrations-rhel9, +14 more
    affected: workaround, no fix available
  • Red Hat AI Inference Server rhaiis/vllm-cpu-rhel9, rhaiis/vllm-tpu-rhel9, rhaiis/vllm-cuda-rhel9, rhaiis/vllm-rocm-rhel9 Red Hat Ansible Automation Platform 2 ansible-automation-platform-24/hub-rhel8-operator, ansible-automation-platform-25/hub-rhel8-operator, ansible-automation-platform-26/hub-rhel9-operator, ansible-automation-platform-24/aap-must-gather-rhel8, ansible-automation-platform-25/gateway-rhel8-operator, ansible-automation-platform-26/gateway-rhel9-operator, +13 more
    affected: workaround, no fix available, no fix planned “Will not fix”
  • Red Hat Build of Podman Desktop podman-desktop-macos-1-0, podman-desktop-windows-1-0 Red Hat Build of Podman Desktop - Tech Preview rhdesktop/rh-podman-desktop-ext-rhel-rhel10, rhdesktop/rh-podman-desktop-ext-bootc-rhel10
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Certification Program for Red Hat Enterprise Linux 9 redhat-certification-preflight Red Hat Connectivity Link 1 rhcl-1/coredns-rhel9, rhcl-1/authorino-rhel9, rhcl-1/dns-rhel9-operator, rhcl-1/dns-operator-bundle, rhcl-1/rhcl-rhel9-operator, rhcl-1/limitador-rhel9-operator, +1 more Red Hat Enterprise Linux 7 rhc
    affected: workaround, no fix available
  • Red Hat Enterprise Linux 9 ignition, ignition-edge, ignition-grub, ignition-validate, rhel9/bootc-image-builder, rhel9-eus/rhel-9.6-bootc-image-builder Red Hat Enterprise Linux 10 ignition, rhel10/bootc-image-builder, rhel10-eus/rhel-10.0-bootc-image-builder
    affected: workaround, no fix available, no fix planned “Will not fix”
  • Red Hat Enterprise Linux AI (RHEL AI) 3 rhelai3/bootc-cuda-rhel9, rhelai3/bootc-rocm-rhel9, rhelai3/bootc-aws-cuda-rhel9, rhelai3/bootc-gcp-cuda-rhel9, rhelai3/bootc-azure-cuda-rhel9, rhelai3/bootc-azure-rocm-rhel9 Red Hat OpenShift AI (RHOAI) rhoai/odh-maas-api-rhel9, rhoai/odh-mlflow-operator-rhel9, rhoai/odh-kueue-controller-rhel9, rhoai/odh-notebook-controller-rhel8, rhoai/odh-kf-notebook-controller-rhel8, rhoai/odh-mod-arch-model-registry-rhel9, +1 more Red Hat OpenShift Cluster Manager CLI ocm-cli-clients/ocm-cli-rhel9
    affected: workaround, no fix available
  • Red Hat OpenShift Container Platform 4 openshift4/ose-ptp-rhel9, openshift4/cnf-tests-rhel8, openshift4/ose-coredns-rhel9, openshift4/ose-dpu-cni-rhel9, openshift4/ose-dpu-daemon-rhel9, openshift4/ose-multus-cni-rhel9, +61 more
    affected: workaround, no fix available, no fix planned “Will not fix”

9 more affected, 117 more fixed, 137 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
7 mo ago

Exploit prediction

1.62% chance of exploitation in the next 30 days, higher than 76% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADP 3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
GitHub 3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected packages

ecosystem package affected fixed in
go google.golang.org/grpc
<1.79.3
1.79.3

Affected products

  • grpc grpc-go
  • Red Hat Cryostat 4 on RHEL 9
  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support
  • Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9.4 Extended Update Support
  • Red Hat Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support
  • Red Hat Red Hat OpenShift Container Platform 4.15
  • Red Hat Red Hat OpenShift Container Platform 4.16
  • Red Hat Red Hat OpenShift Container Platform 4.17
  • Red Hat Red Hat OpenShift Container Platform 4.18
  • Red Hat Red Hat OpenShift Container Platform 4.19
  • Red Hat Red Hat OpenStack Platform 16.2
  • Red Hat Red Hat OpenStack Platform 17.1 for RHEL 9
  • Red Hat Red Hat Satellite 6.16 for RHEL 8
  • Red Hat Red Hat Satellite 6.16 for RHEL 9
  • Red Hat Red Hat Satellite 6.17 for RHEL 9
  • Red Hat Red Hat Satellite 6.18 for RHEL 9
  • Red Hat Red Hat Satellite 6.19 for RHEL 9
  • Red Hat RHEM 1.0 for RHEL 9
  • Red Hat RHEM 1.1 for RHEL 10
  • Red Hat RHEM 1.1 for RHEL 9
  • Red Hat Builds for Red Hat OpenShift 1.6.0
  • Red Hat Cert Manager support for Red Hat OpenShift release 1.19
  • Red Hat Compliance Operator 1
  • Red Hat DevWorkspace Operator 0.4
  • Red Hat Logging for Red Hat OpenShift 6
  • Red Hat Logging for Red Hat OpenShift 6.2
  • Red Hat Logging Subsystem for Red Hat OpenShift 6.4
  • Red Hat multicluster engine for Kubernetes 2.1
  • Red Hat multicluster engine for Kubernetes 2.11
  • Red Hat multicluster engine for Kubernetes 2.6
  • Red Hat multicluster engine for Kubernetes 2.8
  • Red Hat multicluster engine for Kubernetes 2.9
  • Red Hat Multicluster Global Hub 1.3.4
  • Red Hat Multicluster Global Hub 1.4.5
  • Red Hat Multicluster Global Hub 1.6.5
  • Red Hat Network Observability (NETOBSERV) 1.11.0
  • Red Hat OpenShift API for Data Protection 1.3
  • Red Hat OpenShift API for Data Protection 1.4
  • Red Hat OpenShift API for Data Protection 1.5
  • Red Hat OpenShift API for Data Protection 1.6
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.13
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.14
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.15
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.16

Classification

Weakness
  • CWE-285 Improper Authorization
  • CWE-551 Incorrect Behavior Order: Authorization Before Parsing and Canonicalization

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.