Loading story…
Red Hat OpenShift Pipelines was the subject of multiple security advisories, including one affecting the Fulcio component used by the OpenShift Pipelines Operator. One disclosed flaw was reported to allow denial of service, raising the risk of service disruption in environments that rely on the operator’s signing and pipeline-related functionality.
A later advisory reported multiple vulnerabilities in Red Hat OpenShift Pipelines, indicating broader security exposure beyond the previously disclosed Fulcio issue. Organizations running OpenShift Pipelines should review the affected product versions, assess exposure across pipeline and operator deployments, and prioritize vendor-recommended updates or mitigations to reduce the risk of disruption or further compromise.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
dCERT published advisory 2026-1226 for Red Hat OpenShift Pipelines describing multiple vulnerabilities affecting the product.
dCERT published advisory 2026-0198 covering a vulnerability in the Red Hat OpenShift Pipelines Operator component Fulcio that could allow denial of service.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released Important security updates for Red Hat OpenShift Container Platform and RHEL 9 Podman and Buildah deployments to remediate container-stack vulnerabilities, notably **CVE-2024-9675** and **CVE-2024-9676**. CVE-2024-9675 can permit arbitrary directory mounts through Buildah, while CVE-2024-9676 is a `containers/storage` symlink-traversal flaw affecting Podman, Buildah, and CRI-O. When a malicious image runs with automatically assigned user namespaces, the latter can cause container creation to block indefinitely or CRI-O to exhaust memory and crash; limited error-message disclosure is also possible to the user operating the affected software. Affected OpenShift releases include 4.12, 4.13, 4.14, 4.15, 4.16, 4.17, and 4.18, with related advisories also addressing flaws such as Dockerfile bind-propagation validation, FIPS crypto-policy mounting, Distribution JWT signing-key injection, and denial-of-service issues in Go, BIND, libxml2, GRUB2, and the Linux kernel. Red Hat advises OpenShift customers to update clusters through their supported release channels using the CLI or web console, and RHEL 9 users to deploy the updated Podman or Buildah packages for their supported architecture and subscription channel.
Aug 26, 2026
dCERT issued advisories for **multiple vulnerabilities** affecting **Red Hat Hardened Images RPMs**, identifying the issue in notices `2026-1205` and `2026-1246`. The advisories indicate that security flaws were found in RPM packages used within Red Hat hardened container images, potentially exposing systems that rely on those images to a range of risks depending on the affected packages and deployed workloads. The publication of two separate dCERT notices suggests ongoing or updated vendor guidance around the same product area, and organizations using Red Hat hardened images should review the referenced advisories, determine which RPMs and image versions are affected, and prioritize remediation through updated packages or rebuilt images. Security teams should also verify downstream dependencies in container registries and production environments to ensure vulnerable image layers are replaced.
Jun 29, 2026
Red Hat disclosed two high-severity vulnerabilities in OpenShift AI that could let authenticated attackers access other tenants’ resources and sensitive Kubernetes credentials. **CVE-2025-12805** affects the `llama-stack-operator`, where a missing `NetworkPolicy` left the Llama Stack service endpoint reachable across namespaces. Red Hat said a user in one namespace could directly access another user’s Llama Stack instance and potentially view or manipulate sensitive data, with the issue tracked under **CWE-653** and rated `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N`. A second flaw, **CVE-2026-5483**, impacts the `odh-dashboard` component and can expose Kubernetes Service Account tokens through a Node.js endpoint. Red Hat warned that disclosure of those tokens could enable unauthorized access to Kubernetes resources; the issue is mapped to **CWE-201** and carries the vector `CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H`. Red Hat published CVE records, Bugzilla entries, and errata references for both vulnerabilities, highlighting risks to confidentiality and integrity in multi-tenant OpenShift AI deployments.
Jun 29, 2026