Red Hat Openshift Router vulnerabilities

2 CVEs affecting Red Hat Openshift Router, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-46579, published 2026-05-29.

More from Red Hat.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2026-46579, published 2026-05-29. High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days. A flaw was found in the OpenShift Router. When a Route has `insecureEdgeTerminationPolicy` set to Allow, the HTTP frontend does not remove `X-SSL-Client-*` headers from incoming requests. This allows…
• CVE-2026-42965, published 2026-05-29. Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days. A flaw was found in the OpenShift Router. A user with EndpointSlice write access can exploit this vulnerability by creating a Service backed by an FQDN (Fully Qualified Domain Name) EndpointSlice…