Red Hat Connectivity Link 1 vulnerabilities

8 CVEs affecting Red Hat Connectivity Link 1, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-108334, published 2026-10-15.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2024-12401, published 2024-12-12. Medium severity, CVSS 4.4. EPSS: 0.7% chance of exploitation in the next 30 days. A flaw was found in the cert-manager package. This flaw allows an attacker who can modify PEM data that the cert-manager reads, for example, in a Secret resource, to use large amounts of CPU in the…
CVE-2026-27145, published 2026-06-02. Medium severity, CVSS 6.5. EPSS: 0.6% chance of exploitation in the next 30 days. (*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, ".") to execute repeatedly on the…
CVE-2025-69873, published 2026-02-11. Low severity, CVSS 2.9. EPSS: 0.5% chance of exploitation in the next 30 days. ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled. The pattern keyword accepts runtime data via JSON…
CVE-2025-25208, published 2025-06-09. Medium severity, CVSS 5.7. EPSS: 0.3% chance of exploitation in the next 30 days. A Developer persona can bring down the Authorino service, preventing the evaluation of all AuthPolicies on the cluster
CVE-2026-108334, published 2026-10-15. High severity, CVSS 7.4. EPSS: 0.3% chance of exploitation in the next 30 days. A flaw was found in the internal WebAssembly (WASM) shim used by the Kuadrant operator. When generating the CEL predicate that determines whether Gateway-level authentication and rate limiting should…
CVE-2026-0775, published 2026-01-23. High severity, CVSS 7.0. EPSS: 0.3% chance of exploitation in the next 30 days. npm cli Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of npm cli. An attacker…
CVE-2025-25207, published 2025-06-09. Medium severity, CVSS 5.7. EPSS: 0.3% chance of exploitation in the next 30 days. The Authorino service in the Red Hat Connectivity Link is the authorization service for zero trust API security. Authorino allows the users with developer persona to add callbacks to be executed to…
CVE-2025-25209, published 2025-06-09. Medium severity, CVSS 5.7. EPSS: 0.2% chance of exploitation in the next 30 days. The AuthPolicy metadata on Red Hat Connectivity Link contains an object which stores secretes, however it assumes those secretes are already in the kuadrant-system instead of copying it to the…