7.4
Élevée
CVE-2026-46579 A flaw was found in the OpenShift Router
Description
A flaw was found in the OpenShift Router. When a Route has `insecureEdgeTerminationPolicy` set to Allow, the HTTP frontend does not remove `X-SSL-Client-*` headers from incoming requests. This allows an unauthenticated attacker to send plain HTTP requests with crafted `X-SSL-Client-*` headers. As a result, backends relying on these headers for mutual TLS (Transport Layer Security) authentication can be bypassed, enabling the attacker to impersonate client certificate identities.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Red Hat OpenShift Container Platform 4 | Versions non publiées | |
| Red Hat OpenShift Container Platform 5 | Versions non publiées | |
| Red Hat OpenShift Container Platform 4.20 1781639027 | premières → < 1781639027 | 1781639027 |
| Red Hat OpenShift Container Platform 4.21 1781552170 | premières → < 1781552170 | 1781552170 |
| Red Hat OpenShift Container Platform 4.22 1781643967 | premières → < 1781643967 | 1781643967 |
| Red Hat OpenShift Container Platform 4.19 1783445642 | premières → < 1783445642 | 1783445642 |
| Red Hat OpenShift Container Platform 4.2 1781639027 | premières → < 1781639027 | 1781639027 |
| Red Hat OpenShift Container Platform 4.18 1783719377 | premières → < 1783719377 | 1783719377 |
| Red Hat OpenShift Container Platform 4.13 1784056734 | premières → < 1784056734 | 1784056734 |
Afficher les 5 autres branches Masquer les 5 autres branches
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Red Hat OpenShift Container Platform 4.14 1784587649 | premières → < 1784587649 | 1784587649 |
| Red Hat OpenShift Container Platform 4.15 1784580646 | premières → < 1784580646 | 1784580646 |
| Red Hat OpenShift Container Platform 4.16 1784331638 | premières → < 1784331638 | 1784331638 |
| Red Hat OpenShift Container Platform 4.17 1784321465 | premières → < 1784321465 | 1784321465 |
| Red Hat OpenShift Container Platform 4.12 1784323891 | premières → < 1784323891 | 1784323891 |
Autres CVE de Red Hat OpenShift Container Platform 4
Les 630 CVE de Red Hat OpenShift Container Platform 4 →
CVE-2026-123876
Podman: containers-common: containers-common: default seccomp af_vsock/netlink_audit deny rules bypassable via 32-bit truncation
4.4
Moyenne
CVE-2026-123037
Ansible-core: user module generate_ssh_key follows a symlinked ~/.ssh enabling local privilege escalation (incomplete fix of cve-2024-9902)
6.7
Moyenne
CVE-2026-82976
Image-customization-controller: unauthenticated plaintext image server with directory listing exposes ignition images containing cluster pull secret
7.1
Élevée
CVE-2026-120831
Libslirp: libslirp: queue pointer corruption in if_output() leading to denial of service
6.5
Moyenne