A flaw was found in Open Cluster Management (OCM), the technology underlying Red Hat Advanced Cluster Management (ACM)

The grc-policy-propagator allows security escalation within the cluster

RHACM: unauthenticated SSRF in console API endpoint

Insights-client: insights-client: ccx_token bearer credential logged in clear text at startup via setdefault()

Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge

Nodemailer: nodemailer: denial of service via crafted email address header

A flaw was found in OpenShift API, as admission checks do not enforce "custom-host" permissions

The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker to crash a server in certain circumstances involving AddHostKey

Insights-client-rhel9: insights-client: pull-secret bearer token written to logs on non-200 ccx response

Insights-client-rhel9: insights-client: spoke-controlled clusterid injected unencoded into insights api url path

A container privilege escalation flaw was found in certain Multicluster Engine for Kubernetes images

Insights-client: insights-client: clusterrole grants cluster-wide secrets get/list/watch beyond least privilege

A vulnerability was found in the search-api container in Red Hat Advanced Cluster Management for Kubernetes when a query in the search filter gets parsed by the backend

An issue was discovered in ManagedClusterView API, that could allow secrets to be disclosed to users without the correct permissions

A flaw was found in Red Hat Advanced Cluster Management through versions 2.10, before 2.10.7, 2.11, before 2.11.4, and 2.12, before 2.12.4

A flaw was found in rhacm versions before 2.0.5 and before 2.1.0