CVE-2018-10866: Red Hat Certification

Critical severity, CVSS 9.1. EPSS: 1% chance of exploitation in the next 30 days.

It was discovered that the /configuration view of redhat-certification 7 does not perform an authorization check and it allows an unauthenticated user to remove a "system" file, that is an xml file with host related information, not belonging to him.

Affected products

• Red Hat Certification: version 7.0 only

Published 2021-05-26. Last modified 2026-06-17.