CVE-2026-13083: Red Hat Pen Drive

Medium severity, CVSS 6.9. EPSS: 0.3% chance of exploitation in the next 30 days.

A flaw was found in the Pen Drive report generator. Cluster-sourced data is rendered into HTML reports without proper escaping or sanitization. An attacker with cluster administrator privileges can inject a stored cross-site scripting (XSS) payload into cluster objects (such as ClusterVersion spec.channel) that executes in the browser of any user who opens the generated HTML report.

Affected products

• Red Hat Pen Drive: before 1.0.0-2 (fixed in 1.0.0-2)

Published 2026-06-26. Last modified 2026-07-08.