Medium severity · published Apr 3, 2024
CVE-2024-31419
Cnv: information disclosure through the usage of vm-dump-metrics
4.3
CVSS
0.4%
EPSS
No
On KEV
Description
An information disclosure flaw was found in OpenShift Virtualization. The DownwardMetrics feature was introduced to expose host metrics to virtual machine guests and is enabled by default. This issue could expose limited host metrics of a node to any guest in any namespace without being explicitly enabled by an administrator.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 34% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RH
Red Hat OpenShift Virtualization 4 · Red Hat
All versions, or not specified · source: vendor
Affected product
RH
Red Hat OpenShift Virtualization 4
Red Hat
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-31419
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-31419
access.redhat.com
https://access.redhat.com/security/cve/CVE-2024-31419
bugzilla.redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2272948
More from Red Hat OpenShift Virtualization 4
10.0
CVE-2026-46595
Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh
9.9
CVE-2025-62718
Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF
9.3
CVE-2026-25896
fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names
9.1
CVE-2026-42508
Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts
9.1
CVE-2026-39830
Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh