CVE-2024-1139: Red Hat Advanced Cluster Management For Kubernetes 2

High severity, CVSS 7.7. EPSS: 0.9% chance of exploitation in the next 30 days.

A credentials leak vulnerability was found in the cluster monitoring operator in OCP. This issue may allow a remote attacker who has basic login credentials to check the pod manifest to discover a repository pull secret.

Affected products

• Red Hat Red Hat Advanced Cluster Management For Kubernetes 2
• Red Hat Red Hat Openshift Container Platform 3.11
• Red Hat Red Hat Openshift Container Platform 4.12: before v4.12.0-202405091536.p0.g8906207.assembly.stream.el8 (fixed in v4.12.0-202405091536.p0.g8906207.assembly.stream.el8)
• Red Hat Red Hat Openshift Container Platform 4.13: before v4.13.0-202404200313.p0.gb518881.assembly.stream.el8 (fixed in v4.13.0-202404200313.p0.gb518881.assembly.stream.el8)
• Red Hat Red Hat Openshift Container Platform 4.14: before v4.14.0-202404161544.p0.gf350a68.assembly.stream.el8 (fixed in v4.14.0-202404161544.p0.gf350a68.assembly.stream.el8); before v4.14.0-202404161544.p0.gcafed17.assembly.stream.el9 (fixed in v4.14.0-202404161544.p0.gcafed17.assembly.stream.el9); before v4.14.0-202404161544.p0.gafffdd4.assembly.stream.el8 (fixed in v4.14.0-202404161544.p0.gafffdd4.assembly.stream.el8); before v4.14.0-202404161544.p0.g48fafc4.assembly.stream.el8 (fixed in v4.14.0-202404161544.p0.g48fafc4.assembly.stream.el8); before v4.14.0-202404161544.p0.ge79d817.assembly.stream.el8 (fixed in v4.14.0-202404161544.p0.ge79d817.assembly.stream.el8); before v4.14.0-202404161544.p0.ga0733c1.assembly.stream.el8 (fixed in v4.14.0-202404161544.p0.ga0733c1.assembly.stream.el8); …
• Red Hat Red Hat Openshift Container Platform 4.15: before v4.15.0-202404161612.p0.g00d04f5.assembly.stream.el9 (fixed in v4.15.0-202404161612.p0.g00d04f5.assembly.stream.el9)

Published 2024-04-25. Last modified 2026-10-08.