Red Hat Openshift Container Platform 4.20 vulnerabilities

31 CVEs affecting Red Hat Openshift Container Platform 4.20, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-96577, published 2026-10-01.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2025-49796, published 2025-06-16. Critical severity, CVSS 9.1. EPSS: 1.6% chance of exploitation in the next 30 days. A vulnerability was found in libxml2. Processing certain sch:name elements from the input XML file can trigger a memory corruption issue. This flaw allows an attacker to craft a malicious XML input…
CVE-2025-9566, published 2025-09-05. High severity, CVSS 8.1. EPSS: 1.2% chance of exploitation in the next 30 days. There's a vulnerability in podman where an attacker may use the kube play command to overwrite host files when the kube file container a Secrete or a ConfigMap volume mount and such volume contains a…
CVE-2026-16242, published 2026-07-20. Critical severity, CVSS 9.4. EPSS: 0.9% chance of exploitation in the next 30 days. A flaw was found in the Konnectivity proxy-server configuration for hosted control planes. The agent-facing listener was started without --cluster-ca-cert (and without token-based agent…
CVE-2026-49329, published 2026-09-01. High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days. A flaw was found in openshift/oauth-server. The OAuth login and error page endpoints pass the unauthenticated Accept-Language header to golang.org/x/text/language.ParseAcceptLanguage() without input…
CVE-2025-49794, published 2025-06-16. Critical severity, CVSS 9.1. EPSS: 0.8% chance of exploitation in the next 30 days. A use-after-free vulnerability was found in libxml2. This issue occurs when parsing XPath elements under certain circumstances when the XML schematron has the <sch:name path="..."/> schema elements.…
CVE-2026-9277, published 2026-05-22. High severity, CVSS 8.1. EPSS: 0.8% chance of exploitation in the next 30 days. shell-quote's `quote()` function did not validate object-token inputs against the operator model used by `parse()`. The `.op` field was backslash-escaped character by character using `/(.)/g`, which…
CVE-2026-75885, published 2026-09-18. Critical severity, CVSS 9.3. EPSS: 0.8% chance of exploitation in the next 30 days. A flaw was found in the OpenShift console. Unauthenticated access to the `/api/devfile/` and `/api/devfile/samples/` endpoints allows a remote attacker to send crafted devfile payloads. This can lead…
CVE-2025-11561, published 2025-10-09. High severity, CVSS 8.8. EPSS: 0.8% chance of exploitation in the next 30 days. A flaw was found in the integration of Active Directory and the System Security Services Daemon (SSSD) on Linux systems. In default configurations, the Kerberos local authentication plugin…
CVE-2026-14164, published 2026-06-30. High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days. A double free issue has been identified in libarchive's RAR5 reader. During parsing of a specially crafted RAR5 archive, the filtered_buf pointer may remain stale after being freed during unpacking…
CVE-2026-35469, published 2026-04-16. Medium severity, CVSS 6.5. EPSS: 0.8% chance of exploitation in the next 30 days. spdystream is a Go library for multiplexing streams over SPDY connections. In versions 0.5.0 and below, the SPDY/3 frame parser does not validate attacker-controlled counts and lengths before…

Latest

CVE-2026-96577, published 2026-10-01. High severity, CVSS 7.1. EPSS: 0.2% chance of exploitation in the next 30 days. A flaw was found in oc-mirror. During mirroring operations, the embedded local cache registry binds to all network interfaces without authentication or encryption instead of restricting access to the…
CVE-2026-83589, published 2026-10-01. Medium severity, CVSS 6.1. EPSS: 0.2% chance of exploitation in the next 30 days. A flaw was found in oauth-proxy. The application fails to properly validate the destination redirect parameter (`rd`) during post-login redirection. A remote attacker can exploit this vulnerability…
CVE-2026-87114, published 2026-09-28. High severity, CVSS 7.1. EPSS: 0.2% chance of exploitation in the next 30 days. A flaw was found in kube-compare. When processing a 'container://' reference path, the tool incorrectly executes an untrusted container image's entrypoint instead of merely extracting data from a…
CVE-2026-75887, published 2026-09-23. High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days. A flaw was found in the OpenShift console. An unauthenticated attacker can exploit a path traversal vulnerability by manipulating the `lng` and `ns` query parameters in the `/locales/resource.json`…
CVE-2026-75886, published 2026-09-23. High severity, CVSS 7.2. EPSS: 0.3% chance of exploitation in the next 30 days. A flaw was found in openshift/console. An unauthenticated remote attacker can exploit a misconfiguration in the CatalogdHandler, which lacks proper authentication, and the forwarding of the…
CVE-2026-50237, published 2026-08-11. High severity, CVSS 7.4. EPSS: 0.5% chance of exploitation in the next 30 days. A Server-Side Request Forgery and supply chain flaw was found in the OpenShift Console Helm catalog proxy. A namespace tenant can plant a ProjectHelmChartRepository with an arbitrary URL that the…
CVE-2026-50236, published 2026-08-11. High severity, CVSS 7.4. EPSS: 0.5% chance of exploitation in the next 30 days. An authenticated SSRF flaw was found in the OpenShift Console Dev Console webhook helpers. User-supplied target URLs are fetched server-side without validation, with path neutralization enabling…
CVE-2026-15816, published 2026-08-07. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. A flaw was found in dracut. The die() error-handling function writes its message into a shell script under the initramfs emergency-hook directory without properly shell-quoting it. When the message…