Medium severity · published Apr 8, 2026
CVE-2025-14243
Mirror-registry: openshift mirror registry: user enumeration via authentication error messages
5.3
CVSS
0.3%
EPSS
No
On KEV
Description
A flaw was found in the OpenShift Mirror Registry. This vulnerability allows an unauthenticated, remote attacker to enumerate valid usernames and email addresses via different error messages during authentication failures and account creation.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 21% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MR
Mirror Registry For Red Hat Openshift · Redhat
2.0 · source: vendor, NVD
MR
mirror registry for Red Hat OpenShift 2 · Red Hat
All versions, or not specified · source: vendor
Affected product
MR
mirror registry for Red Hat OpenShift
Red Hat
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-14243
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-14243
Vendor Advisory
https://access.redhat.com/security/cve/CVE-2025-14243
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=2419829
More from mirror registry for Red Hat OpenShift
8.8
CVE-2026-32590
Mirror-registry: remote code execution using pickle deserialization
8.2
CVE-2026-33810
Case-sensitive excludedSubtrees name constraints cause Auth Bypass in crypto/x509
7.5
CVE-2026-27137
Incorrect enforcement of email constraints in crypto/x509
7.4
CVE-2026-32589
Mirror-registry: quay: insecure direct object reference in blobupload
6.5
CVE-2026-2377
Mirror-registry: quay: quay: server-side request forgery via log export functionality