Red Hat Openshift Container Platform 4.15 vulnerabilities

39 CVEs affecting Red Hat Openshift Container Platform 4.15, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-50237, published 2026-08-11.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2024-6409, published 2024-07-08. High severity, CVSS 7.0. EPSS: 27.9% chance of exploitation in the next 30 days. A race condition vulnerability was discovered in how signals are handled by OpenSSH's server (sshd). If a remote attacker does not authenticate within a set time period, then sshd's SIGALRM handler…
CVE-2026-6893, published 2026-06-10. High severity, CVSS 7.5. EPSS: 3.1% chance of exploitation in the next 30 days. A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP (Dynamic Host Configuration Protocol) options, such as a…
CVE-2024-7387, published 2024-09-17. Critical severity, CVSS 9.1. EPSS: 2.3% chance of exploitation in the next 30 days. A flaw was found in openshift/builder. This vulnerability allows command injection via path traversal, where a malicious user can execute arbitrary commands on the OpenShift node running the builder…
CVE-2025-49796, published 2025-06-16. Critical severity, CVSS 9.1. EPSS: 1.6% chance of exploitation in the next 30 days. A vulnerability was found in libxml2. Processing certain sch:name elements from the input XML file can trigger a memory corruption issue. This flaw allows an attacker to craft a malicious XML input…
CVE-2024-1394, published 2024-03-21. High severity, CVSS 7.5. EPSS: 1.5% chance of exploitation in the next 30 days. A memory leak flaw was found in Golang in the RSA encrypting/decrypting code, which might lead to a resource exhaustion vulnerability using attacker-controlled inputs. The memory leak happens in…
CVE-2024-3154, published 2024-04-26. High severity, CVSS 7.2. EPSS: 1.4% chance of exploitation in the next 30 days. A flaw was found in cri-o, where an arbitrary systemd property can be injected via a Pod annotation. Any user who can create a pod with an arbitrary annotation may perform an arbitrary action on the…
CVE-2025-0624, published 2025-02-19. High severity, CVSS 7.6. EPSS: 1.4% chance of exploitation in the next 30 days. A flaw was found in grub2. During the network boot process, when trying to search for the configuration file, grub copies data from a user controlled environment variable into an internal buffer…
CVE-2024-3727, published 2024-05-14. High severity, CVSS 8.3. EPSS: 1.3% chance of exploitation in the next 30 days. A flaw was found in the github.com/containers/image library. This flaw allows attackers to trigger unexpected authenticated registry accesses on behalf of a victim user, causing resource exhaustion,…
CVE-2025-9566, published 2025-09-05. High severity, CVSS 8.1. EPSS: 1.2% chance of exploitation in the next 30 days. There's a vulnerability in podman where an attacker may use the kube play command to overwrite host files when the kube file container a Secrete or a ConfigMap volume mount and such volume contains a…
CVE-2026-33846, published 2026-05-04. High severity, CVSS 7.5. EPSS: 1.1% chance of exploitation in the next 30 days. A heap buffer overflow vulnerability exists in the DTLS handshake fragment reassembly logic of GnuTLS. The issue arises in merge_handshake_packet() where incoming handshake fragments are matched and…

Latest

CVE-2026-50237, published 2026-08-11. High severity, CVSS 7.4. EPSS: 0.5% chance of exploitation in the next 30 days. A Server-Side Request Forgery and supply chain flaw was found in the OpenShift Console Helm catalog proxy. A namespace tenant can plant a ProjectHelmChartRepository with an arbitrary URL that the…
CVE-2026-50236, published 2026-08-11. High severity, CVSS 7.4. EPSS: 0.5% chance of exploitation in the next 30 days. An authenticated SSRF flaw was found in the OpenShift Console Dev Console webhook helpers. User-supplied target URLs are fetched server-side without validation, with path neutralization enabling…
CVE-2026-15816, published 2026-08-07. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. A flaw was found in dracut. The die() error-handling function writes its message into a shell script under the initramfs emergency-hook directory without properly shell-quoting it. When the message…
CVE-2026-49332, published 2026-07-28. High severity, CVSS 8.5. EPSS: 0.5% chance of exploitation in the next 30 days. A flaw was found in openshift/oauth-proxy. The proxy sets authenticated identity headers using only dash-variant keys (X-Forwarded-User) but does not strip underscore-variant keys (X_Forwarded_User)…
CVE-2026-16242, published 2026-07-20. Critical severity, CVSS 9.4. EPSS: 0.9% chance of exploitation in the next 30 days. A flaw was found in the Konnectivity proxy-server configuration for hosted control planes. The agent-facing listener was started without --cluster-ca-cert (and without token-based agent…
CVE-2026-15809, published 2026-07-15. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. A flaw was found in CRI-O. The fix for a previous vulnerability (CVE-2022-4318) was incorrect, allowing it to be bypassed. An attacker capable of setting environment variables on a container can…
CVE-2026-14476, published 2026-07-07. High severity, CVSS 8.0. EPSS: 0.7% chance of exploitation in the next 30 days. A path traversal flaw was found in SSSD's AD GPO provider. The ad_gpo_extract_smb_components() function does not sanitize .. sequences in the gPCFileSysPath LDAP attribute, allowing an attacker with…
CVE-2026-14474, published 2026-07-07. High severity, CVSS 8.8. EPSS: 0.6% chance of exploitation in the next 30 days. A flaw was found in SSSD's LDAP sudo provider. When the ldap_sudo_search_base option is not explicitly configured, SSSD searches the entire LDAP directory tree for sudoRole objects. An authenticated…
CVE-2026-14164, published 2026-06-30. High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days. A double free issue has been identified in libarchive's RAR5 reader. During parsing of a specially crafted RAR5 archive, the filtered_buf pointer may remain stale after being freed during unpacking…