RH
Product
Red Hat Advanced Cluster Management for Kubernetes 2.16
71
CVEs
0
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 21High 35Medium 15Low 0
Watch
Add Red Hat Advanced Cluster Management for Kubernetes 2.16 to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-48431 | 7.5 | Apr 28 | Apache Thrift: Specially crafted input can crash a c_glib Thrift server with invalid pointer error. Affected: All versions, or not specified |
| CVE-2026-42039 | 7.5 | Apr 24 | Axios: unbounded recursion in toFormData causes DoS via deeply nested request data Affected: All versions, or not specified |
| CVE-2026-40895 | 7.5 | Apr 21 | follow-redirects: Custom Authentication Headers Leaked to Cross-Domain Redirect Targets Affected: All versions, or not specified |
| CVE-2026-42033 | 7.4 | Apr 24 | Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking Affected: All versions, or not specified |
| CVE-2026-43869 | 7.3 | May 5 | Apache Thrift: TSSLTransportFactory.java hostname verification Affected: All versions, or not specified |
| CVE-2026-71474 | 7.1 | Aug 11 | Insights-client-rhel9: insights-client: pull-secret bearer token written to logs on non-200 ccx response Affected: All versions, or not specified |
| CVE-2026-76827 | 6.8 | Aug 19 | Search-indexer: search-indexer: update/delete operations not scoped to caller's cluster (cross-tenant data tampering) Affected: All versions, or not specified |
| CVE-2026-71475 | 6.8 | Aug 11 | Insights-client-rhel9: insights-client: spoke-controlled clusterid injected unencoded into insights api url path Affected: All versions, or not specified |
| CVE-2026-66780 | 6.5 | Aug 18 | Submariner-operator: broker serviceaccount secret (token + ca) logged in full at trace verbosity Affected: All versions, or not specified |
| CVE-2026-71846 | 6.5 | Aug 12 | Insights-client: insights-client: clusterrole grants cluster-wide secrets get/list/watch beyond least privilege Affected: All versions, or not specified |
| CVE-2026-27145 | 6.5 | Jun 2 | Inefficient candidate hostname parsing in crypto/x509 Affected: All versions, or not specified |
| CVE-2026-42041 | 6.5 | Apr 24 | Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy Affected: All versions, or not specified |
| CVE-2026-64927 | 6.4 | Aug 12 | Multicloud-operators-channel: multicloud-operators-channel: cross-namespace secret and configmap mutation via spec.secretref.namespace confused deputy Affected: All versions, or not specified |
| CVE-2026-39828 | 6.3 | May 22 | Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh Affected: All versions, or not specified |
| CVE-2026-18874 | 6.2 | Aug 19 | Volsync-addon-controller: volsync-addon-controller: annotation values rendered into yaml via text/template without escaping allows yaml injection into subscription Affected: All versions, or not specified |
| CVE-2026-66782 | 5.8 | Aug 18 | Submariner-operator: operator clusterrole grants cluster-wide create/update on all configmaps Affected: All versions, or not specified |
| CVE-2026-75485 | 5.5 | Aug 18 | Must-gather: /tmp/kubeconfig retention Affected: All versions, or not specified |
| CVE-2026-73834 | 5.5 | Aug 18 | Must-gather: must-gather: embedded secret data in acm wrapper crs collected without redaction Affected: All versions, or not specified |
| CVE-2026-66781 | 5.4 | Aug 18 | Submariner-operator: pprof debug endpoint enabled by default on 0.0.0.0:8082 without authentication Affected: All versions, or not specified |
| CVE-2026-71468 | 5.3 | Aug 11 | Acm-search-v2-api-rhel9: search-v2-api: cross-user bearer-token reuse via global federation-config cache Affected: All versions, or not specified |
| CVE-2026-66783 | 4.4 | Aug 18 | Submariner-operator: release workflow consumes same-org composite action via mutable @devel branch ref Affected: All versions, or not specified |