Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
OpenShift Container Platform: Unauthorized Access to Cluster Resources
published 7 months ago
Summary
An attacker could gain unauthorized access to sensitive cluster resources if they exploit a flaw in the OpenShift Container Platform's authentication system. This could lead to data breaches or unauthorized actions within the cluster. To fix this issue, update to the latest version of OpenShift Container Platform.
What to do
- Update redhat skopeo to version 2:1.14.5-5.rhaos4.16.el8.
- Update redhat skopeo-tests to version 2:1.14.5-5.rhaos4.16.el8.
- Update redhat skopeo to version 2:1.14.5-5.rhaos4.16.el9.
- Update redhat skopeo-debuginfo to version 2:1.14.5-5.rhaos4.16.el9.
- Update redhat skopeo-debugsource to version 2:1.14.5-5.rhaos4.16.el9.
- Update redhat skopeo-tests to version 2:1.14.5-5.rhaos4.16.el9.
- Update redhat containernetworking-plugins to version 1:1.4.0-7.rhaos4.16.el8.
- Update redhat containernetworking-plugins-debuginfo to version 1:1.4.0-7.rhaos4.16.el8.
- Update redhat containernetworking-plugins-debugsource to version 1:1.4.0-7.rhaos4.16.el8.
- Update redhat runc to version 4:1.2.9-2.rhaos4.16.el8.
- Update redhat runc-debuginfo to version 4:1.2.9-2.rhaos4.16.el8.
- Update redhat runc-debugsource to version 4:1.2.9-2.rhaos4.16.el8.
- Update redhat runc to version 4:1.2.9-2.rhaos4.16.el9.
- Update redhat runc-debuginfo to version 4:1.2.9-2.rhaos4.16.el9.
- Update redhat runc-debugsource to version 4:1.2.9-2.rhaos4.16.el9.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Red Hat:openshift:4.16::el8 | redhat | skopeo |
< 2:1.14.5-5.rhaos4.16.el8 Fix: upgrade to 2:1.14.5-5.rhaos4.16.el8
|
| Red Hat:openshift:4.16::el8 | redhat | skopeo-tests |
< 2:1.14.5-5.rhaos4.16.el8 Fix: upgrade to 2:1.14.5-5.rhaos4.16.el8
|
| Red Hat:openshift:4.16::el9 | redhat | skopeo |
< 2:1.14.5-5.rhaos4.16.el9 Fix: upgrade to 2:1.14.5-5.rhaos4.16.el9
|
| Red Hat:openshift:4.16::el9 | redhat | skopeo-debuginfo |
< 2:1.14.5-5.rhaos4.16.el9 Fix: upgrade to 2:1.14.5-5.rhaos4.16.el9
|
| Red Hat:openshift:4.16::el9 | redhat | skopeo-debugsource |
< 2:1.14.5-5.rhaos4.16.el9 Fix: upgrade to 2:1.14.5-5.rhaos4.16.el9
|
| Red Hat:openshift:4.16::el9 | redhat | skopeo-tests |
< 2:1.14.5-5.rhaos4.16.el9 Fix: upgrade to 2:1.14.5-5.rhaos4.16.el9
|
| Red Hat:openshift:4.16::el8 | redhat | containernetworking-plugins |
< 1:1.4.0-7.rhaos4.16.el8 Fix: upgrade to 1:1.4.0-7.rhaos4.16.el8
|
| Red Hat:openshift:4.16::el8 | redhat | containernetworking-plugins-debuginfo |
< 1:1.4.0-7.rhaos4.16.el8 Fix: upgrade to 1:1.4.0-7.rhaos4.16.el8
|
| Red Hat:openshift:4.16::el8 | redhat | containernetworking-plugins-debugsource |
< 1:1.4.0-7.rhaos4.16.el8 Fix: upgrade to 1:1.4.0-7.rhaos4.16.el8
|
| Red Hat:openshift:4.16::el8 | redhat | runc |
< 4:1.2.9-2.rhaos4.16.el8 Fix: upgrade to 4:1.2.9-2.rhaos4.16.el8
|
| Red Hat:openshift:4.16::el8 | redhat | runc-debuginfo |
< 4:1.2.9-2.rhaos4.16.el8 Fix: upgrade to 4:1.2.9-2.rhaos4.16.el8
|
| Red Hat:openshift:4.16::el8 | redhat | runc-debugsource |
< 4:1.2.9-2.rhaos4.16.el8 Fix: upgrade to 4:1.2.9-2.rhaos4.16.el8
|
| Red Hat:openshift:4.16::el9 | redhat | runc |
< 4:1.2.9-2.rhaos4.16.el9 Fix: upgrade to 4:1.2.9-2.rhaos4.16.el9
|
| Red Hat:openshift:4.16::el9 | redhat | runc-debuginfo |
< 4:1.2.9-2.rhaos4.16.el9 Fix: upgrade to 4:1.2.9-2.rhaos4.16.el9
|
| Red Hat:openshift:4.16::el9 | redhat | runc-debugsource |
< 4:1.2.9-2.rhaos4.16.el9 Fix: upgrade to 4:1.2.9-2.rhaos4.16.el9
|
Original advisory text
Red Hat Security Advisory: OpenShift Container Platform 4.16.58 packages and security update
References
- https://access.redhat.com/errata/RHSA-2026:4464 Vendor Advisory
- https://access.redhat.com/security/updates/classification/#important Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2407258 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2418462 Third Party Advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_4464.j... Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2025-58183 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2025-58183 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-58183 Vendor Advisory
- https://go.dev/cl/709861 Third Party Advisory
- https://go.dev/issue/75677 Third Party Advisory
- https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI Third Party Advisory
- https://pkg.go.dev/vuln/GO-2025-4014 Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2025-61729 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2025-61729 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-61729 Vendor Advisory
- https://go.dev/cl/725920 Third Party Advisory
- https://go.dev/issue/76445 Third Party Advisory
- https://groups.google.com/g/golang-announce/c/8FJoBkPddm4 Third Party Advisory
- https://pkg.go.dev/vuln/GO-2025-4155 Vendor Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published19 Mar 2026
Updated22 Mar 2026
First seen22 Mar 2026
Sources
RHSA-2026:4464 · OSV
Track software like this
Free during beta