Known vulnerabilities in Red Hat OpenShift Dev Spaces

Is your version affected?

CVE list

CVE	Summary	Score	Published
CVE-2026-50240	Pipelines-as-code: openshift-pipelines-operator-rh: pipelines-as-code: repository users can trigger namespace edit-equivalent execution via auto-provisioned pipeline serviceaccount	8.8 High	Nov 6, 2026
CVE-2026-107912	Io.quarkus/quarkus-vertx-http: quarkus-vertx-http: authorization bypass in management interface via path concatenation flaw	7.7 High	Nov 5, 2026
CVE-2026-114236	Podman: goroutine/file-descriptor leak in storage/pkg/archive.applylayer and applyuncompressedlayer on malformed layers	3.3 Low	Oct 21, 2026
CVE-2026-107935	Gvisor-tap-vsock: gvisor-tap-vsock: unathenticated arbitrary file deletion on the host via /expose	9.3 Critical	Oct 9, 2026
CVE-2026-91142	Cockpit: cockpit: unauthorized modification of login records via integer overflow	3.6 Low	Sep 18, 2026
CVE-2026-91147	Cockpit: cockpit: denial of service in `cockpit-ws` due to url-root handling without a trailing slash	5.9 Medium	Sep 18, 2026
CVE-2026-91149	Cockpit: cockpit: denial of service via unbounded connection thread spawning	7.5 High	Sep 18, 2026
CVE-2026-87743	A flaw was found in Quarkus HTTP security	7.5 High	Sep 18, 2026
CVE-2025-11395	Podman: arbitrary file write when importing oci archive	5.5 Medium	Sep 15, 2026
CVE-2026-79699	Podman: buildah: skopeo: containers/storage: malicious tar whiteout header allows replacement of extraction destination directory	4.4 Medium	Sep 15, 2026
CVE-2026-79705	Podman: buildah: buildah/copier: directory escape via crafted tar symlinks when used outside buildah by non-root callers	4.5 Medium	Sep 15, 2026
CVE-2026-76235	Cockpit-ws: cockpit: cockpit-ws: unauthenticated remote memory leak via cockpitlang cookie in send_login_html	7.5 High	Aug 19, 2026
CVE-2026-19730	Podman: podman: quadlet install --replace non-truncating write retains removed host-access directives	4.2 Medium	Aug 13, 2026
CVE-2026-13676	fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs	7.5 High	Jun 29, 2026
CVE-2026-12856	A flaw was found in the vscode-java extension, which provides Java language support for Visual Studio Code	8.8 High	Jun 29, 2026
CVE-2026-54513	jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor	8.1 High	Jun 23, 2026
CVE-2026-53622	Traefik is an HTTP reverse proxy and load balancer	7.8 High	Jun 23, 2026
CVE-2026-48491	Traefik is an HTTP reverse proxy and load balancer	7.8 High	Jun 23, 2026
CVE-2026-48020	Traefik is an HTTP reverse proxy and load balancer	7.8 High	Jun 23, 2026
CVE-2023-54365	Traefik before 2.10.5 and 3.0.0-beta4 is affected by a denial-of-service vulnerability in HTTP/2 request handling…	8.7 High	Jun 23, 2026
CVE-2026-50559	Quarkus is a Java framework for building cloud-native applications	7.5 High	Jun 19, 2026
CVE-2026-9697	Impact: undici's ProxyAgent silently drops the requestTls option when configured with a SOCKS5 proxy URI (socks5:// or…	7.4 High	Jun 17, 2026
CVE-2026-6734	Impact: When using Socks5ProxyAgent, undici reuses a single connection pool across different origins without verifying…	7.5 High	Jun 17, 2026
CVE-2026-12151	Impact: The undici WebSocket client enforces maxPayloadSize on the cumulative byte count of fragments in a message but…	7.5 High	Jun 17, 2026
CVE-2026-48779	ws is an open source WebSocket client and server for Node.js	7.5 High	Jun 16, 2026

Other Red Hat products