Red Hat Openshift Container Platform 4.22 vulnerabilities

26 CVEs affecting Red Hat Openshift Container Platform 4.22, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-96577, published 2026-10-01.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-16242, published 2026-07-20. Critical severity, CVSS 9.4. EPSS: 0.9% chance of exploitation in the next 30 days. A flaw was found in the Konnectivity proxy-server configuration for hosted control planes. The agent-facing listener was started without --cluster-ca-cert (and without token-based agent…
CVE-2026-49329, published 2026-09-01. High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days. A flaw was found in openshift/oauth-server. The OAuth login and error page endpoints pass the unauthenticated Accept-Language header to golang.org/x/text/language.ParseAcceptLanguage() without input…
CVE-2026-9277, published 2026-05-22. High severity, CVSS 8.1. EPSS: 0.8% chance of exploitation in the next 30 days. shell-quote's `quote()` function did not validate object-token inputs against the operator model used by `parse()`. The `.op` field was backslash-escaped character by character using `/(.)/g`, which…
CVE-2026-75885, published 2026-09-18. Critical severity, CVSS 9.3. EPSS: 0.8% chance of exploitation in the next 30 days. A flaw was found in the OpenShift console. Unauthenticated access to the `/api/devfile/` and `/api/devfile/samples/` endpoints allows a remote attacker to send crafted devfile payloads. This can lead…
CVE-2026-14164, published 2026-06-30. High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days. A double free issue has been identified in libarchive's RAR5 reader. During parsing of a specially crafted RAR5 archive, the filtered_buf pointer may remain stale after being freed during unpacking…
CVE-2026-35469, published 2026-04-16. Medium severity, CVSS 6.5. EPSS: 0.8% chance of exploitation in the next 30 days. spdystream is a Go library for multiplexing streams over SPDY connections. In versions 0.5.0 and below, the SPDY/3 frame parser does not validate attacker-controlled counts and lengths before…
CVE-2026-44990, published 2026-06-12. Critical severity, CVSS 9.3. EPSS: 0.7% chance of exploitation in the next 30 days. ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Under the default configuration, versions of `sanitize-html`…
CVE-2026-12143, published 2026-06-12. High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days. form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the `field` argument to `FormData#append` and the `filename` option are concatenated verbatim into…
CVE-2026-14476, published 2026-07-07. High severity, CVSS 8.0. EPSS: 0.7% chance of exploitation in the next 30 days. A path traversal flaw was found in SSSD's AD GPO provider. The ad_gpo_extract_smb_components() function does not sanitize .. sequences in the gPCFileSysPath LDAP attribute, allowing an attacker with…
CVE-2026-14474, published 2026-07-07. High severity, CVSS 8.8. EPSS: 0.6% chance of exploitation in the next 30 days. A flaw was found in SSSD's LDAP sudo provider. When the ldap_sudo_search_base option is not explicitly configured, SSSD searches the entire LDAP directory tree for sudoRole objects. An authenticated…

Latest

CVE-2026-96577, published 2026-10-01. High severity, CVSS 7.1. EPSS: 0.2% chance of exploitation in the next 30 days. A flaw was found in oc-mirror. During mirroring operations, the embedded local cache registry binds to all network interfaces without authentication or encryption instead of restricting access to the…
CVE-2026-83589, published 2026-10-01. Medium severity, CVSS 6.1. EPSS: 0.2% chance of exploitation in the next 30 days. A flaw was found in oauth-proxy. The application fails to properly validate the destination redirect parameter (`rd`) during post-login redirection. A remote attacker can exploit this vulnerability…
CVE-2026-87114, published 2026-09-28. High severity, CVSS 7.1. EPSS: 0.2% chance of exploitation in the next 30 days. A flaw was found in kube-compare. When processing a 'container://' reference path, the tool incorrectly executes an untrusted container image's entrypoint instead of merely extracting data from a…
CVE-2026-75887, published 2026-09-23. High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days. A flaw was found in the OpenShift console. An unauthenticated attacker can exploit a path traversal vulnerability by manipulating the `lng` and `ns` query parameters in the `/locales/resource.json`…
CVE-2026-75886, published 2026-09-23. High severity, CVSS 7.2. EPSS: 0.3% chance of exploitation in the next 30 days. A flaw was found in openshift/console. An unauthenticated remote attacker can exploit a misconfiguration in the CatalogdHandler, which lacks proper authentication, and the forwarding of the…
CVE-2026-50237, published 2026-08-11. High severity, CVSS 7.4. EPSS: 0.5% chance of exploitation in the next 30 days. A Server-Side Request Forgery and supply chain flaw was found in the OpenShift Console Helm catalog proxy. A namespace tenant can plant a ProjectHelmChartRepository with an arbitrary URL that the…
CVE-2026-50236, published 2026-08-11. High severity, CVSS 7.4. EPSS: 0.5% chance of exploitation in the next 30 days. An authenticated SSRF flaw was found in the OpenShift Console Dev Console webhook helpers. User-supplied target URLs are fetched server-side without validation, with path neutralization enabling…
CVE-2026-72693, published 2026-08-11. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. `openvt -u` is intended to identify the owner of the current VT and then execute `login` as that user from a privileged context. In the documented `kbrequest`/init usage, the ownership test in…