Advanced cluster management for kubernetes

This hub aggregates every CVE we track for Advanced cluster management for kubernetes, a product in the operating systems space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Advanced cluster management for kubernetes.

• CVE-2026-71846Insights-client: insights-client: clusterrole grants cluster-wide secrets get/list/watch beyond least privilege6.5Aug 12, 2026
• CVE-2026-71474Insights-client-rhel9: insights-client: pull-secret bearer token written to logs on non-200 ccx response7.1Aug 11, 2026
• CVE-2026-71475Insights-client-rhel9: insights-client: spoke-controlled clusterid injected unencoded into insights api url path6.8Aug 11, 2026
• CVE-2026-71845Insights-client: insights-client: ccx_token bearer credential logged in clear text at startup via setdefault()6.3Aug 11, 2026
• CVE-2026-44495Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge7.0Jun 11, 2026
• CVE-2025-57851Mce: privilege escalation via excessive /etc/passwd permissions6.4Apr 8, 2026
• CVE-2026-4740Rhacm: open cluster management (ocm): cross-cluster privilege escalation via improper kubernetes client certificate renewal validation8.2Apr 7, 2026
• CVE-2025-14874Nodemailer: nodemailer: denial of service via crafted email address header7.5Dec 18, 2025
• CVE-2025-6017Rhacm: users with clusterreader role can see credentials from managed-clusters5.5Jul 2, 2025
• CVE-2023-44487The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.KEV7.5Oct 10, 2023
• CVE-2022-3248Openshift api admission checks does not enforce "custom-host" permissions4.4Oct 5, 2023
• CVE-2023-3027The grc-policy-propagator allows security escalation within the cluster. The propagator allows policies which contain some dynamically obtained values (instead of the policy apply a static manifest...7.8Jun 5, 2023
• CVE-2022-3841RHACM: unauthenticated SSRF in console API endpoint. A Server-Side Request Forgery (SSRF) vulnerability was found in the console API endpoint from Red Hat Advanced Cluster Management for Kubernetes...7.8Jan 11, 2023
• CVE-2022-2238A vulnerability was found in the search-api container in Red Hat Advanced Cluster Management for Kubernetes when a query in the search filter gets parsed by the backend. This flaw allows an attacke...6.5Sep 1, 2022
• CVE-2022-27191The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker to crash a server in certain circumstances involving AddHostKey.7.5Mar 18, 2022