Red Hat Openshift Data Foundation 4 vulnerabilities

9 CVEs affecting Red Hat Openshift Data Foundation 4, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-86330, published 2026-09-28.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-86330, published 2026-09-28. High severity, CVSS 7.2. EPSS: 2.2% chance of exploitation in the next 30 days. An OS command injection flaw was found in the set_hostname_internal function of NooBaa's cluster_internal_api. This component is responsible for managing the Multi-Cloud Object Gateway in OpenShift…
CVE-2026-66792, published 2026-08-17. Critical severity, CVSS 9.9. EPSS: 0.7% chance of exploitation in the next 30 days. A flaw was found in the multicloud-operators-subscription component. This vulnerability allows a user on a managed cluster to escalate their privileges by creating a Subscription with specific,…
CVE-2024-12401, published 2024-12-12. Medium severity, CVSS 4.4. EPSS: 0.7% chance of exploitation in the next 30 days. A flaw was found in the cert-manager package. This flaw allows an attacker who can modify PEM data that the cert-manager reads, for example, in a Secret resource, to use large amounts of CPU in the…
CVE-2026-27145, published 2026-06-02. Medium severity, CVSS 6.5. EPSS: 0.6% chance of exploitation in the next 30 days. (*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, ".") to execute repeatedly on the…
CVE-2026-15416, published 2026-07-14. High severity, CVSS 8.9. EPSS: 0.5% chance of exploitation in the next 30 days. A flaw was identified in Argo CD, the GitOps engine used by Red Hat OpenShift GitOps, that could allow an unauthenticated attacker with network access to the Argo CD repo-server to achieve remote…
CVE-2026-43824, published 2026-05-02. High severity, CVSS 7.7. EPSS: 0.3% chance of exploitation in the next 30 days. In Argo CD 3.2.0 before 3.2.11 and 3.3.0 before 3.3.9, ServerSideDiff allows reading cleartext Kubernetes Secret data.
CVE-2026-0775, published 2026-01-23. High severity, CVSS 7.0. EPSS: 0.3% chance of exploitation in the next 30 days. npm cli Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of npm cli. An attacker…
CVE-2024-9355, published 2024-10-01. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may…
CVE-2026-94368, published 2026-09-21. High severity, CVSS 7.1. EPSS: 0.2% chance of exploitation in the next 30 days. A flaw was found in the signature verification logic of noobaa-core, the core component of the NooBaa Multicloud Object Gateway. The issue occurs when the service processes S3 presigned URLs using…