Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.7
CVE-2025-11393: Runtimes-Inventory-Rhel8-Operator Exposes Administrator Credentials
CVE-2025-11393 · published 10 months ago
Summary
The runtimes-inventory-rhel8-operator has a configuration error that allows a standard user to access the cluster's administrative credentials. This could lead to unauthorized changes to the cluster's configuration or status. Affected users should update the operator to the latest version to fix this issue.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| go | github.com | redhatinsights | <= 0.0.0-20251211184433-5123422abee1 |
| – | red hat | red hat lightspeed (formerly insights) for runtimes 1.0 | All versions |
| – | red hat | red hat runtimes inventory operator | All versions |
| – | red hat | red hat lightspeed (formerly insights) for runtimes 1 | All versions |
Original advisory text
A flaw was found in runtimes-inventory-rhel8-operator. An internal proxy component is incorrectly configured. Because of this flaw, the proxy attaches the cluster's main administrative credentials ...
A flaw was found in runtimes-inventory-rhel8-operator. An internal proxy component is incorrectly configured. Because of this flaw, the proxy attaches the cluster's main administrative credentials to any command it receives, instead of only the specific reports it is supposed to handle.
This allows a standard user within the cluster to send unauthorized commands to the management platform, effectively acting with the full permissions of the cluster administrator. This could lead to unauthorized changes to the cluster's configuration or status on the Red Hat platform.
This allows a standard user within the cluster to send unauthorized commands to the management platform, effectively acting with the full permissions of the cluster administrator. This could lead to unauthorized changes to the cluster's configuration or status on the Red Hat platform.
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-441Unintended Proxy or Intermediary ('Confused Deputy')
Timeline
Published15 Dec 2025
Updated29 Oct 2026
First seen6 Mar 2026
Track software like this
Free during beta