CVE-2026-42965
Full vulnerability record from the local CVENow database.
Description
A flaw was found in the OpenShift Router. A user with EndpointSlice write access can exploit this vulnerability by creating a Service backed by an FQDN (Fully Qualified Domain Name) EndpointSlice that resolves to a cloud metadata endpoint. This allows the router to proxy requests to the cloud metadata endpoint, leading to the disclosure of instance credentials and other sensitive metadata. This bypasses previous security measures for validating IP addresses.
Severity
MEDIUM
CVSS score
6.5
(v3.1)
Vulnerability status
Modified
Source identifier
Published
2026-05-29 11:16:16.923000
Last modified
2026-11-04 16:17:51.140000
View original CVE JSON
{
"id": "CVE-2026-42965",
"sourceIdentifier": "[email protected]",
"published": "2026-05-29T11:16:16.923",
"lastModified": "2026-11-04T16:17:51.140",
"vulnStatus": "Modified",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the OpenShift Router. A user with EndpointSlice write access can exploit this vulnerability by creating a Service backed by an FQDN (Fully Qualified Domain Name) EndpointSlice that resolves to a cloud metadata endpoint. This allows the router to proxy requests to the cloud metadata endpoint, leading to the disclosure of instance credentials and other sensitive metadata. This bypasses previous security measures for validating IP addresses."
},
{
"lang": "es",
"value": "Se encontró un fallo en el router de OpenShift. Un usuario con acceso de escritura a EndpointSlice puede explotar esta vulnerabilidad creando un Servicio respaldado por un EndpointSlice FQDN (Fully Qualified Domain Name) que se resuelve a un endpoint de metadatos en la nube. Esto permite al router redirigir solicitudes al endpoint de metadatos en la nube, lo que lleva a la divulgación de credenciales de instancia y otros metadatos sensibles. Esto elude las medidas de seguridad anteriores para la validación de direcciones IP."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift Container Platform 4.17",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "openshift4/ose-haproxy-router-rhel9",
"cpes": [
"cpe:/a:redhat:openshift:4.17::el9"
],
"versions": [
{
"version": "1789938693",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift Container Platform 4.18",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "openshift4/ose-haproxy-router-rhel9",
"cpes": [
"cpe:/a:redhat:openshift:4.18::el9"
],
"versions": [
{
"version": "1788578875",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift Container Platform 4.19",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "openshift4/ose-haproxy-router-rhel9",
"cpes": [
"cpe:/a:redhat:openshift:4.19::el9"
],
"versions": [
{
"version": "1786771399",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift Container Platform 4.20",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "openshift4/ose-haproxy-router-rhel9",
"cpes": [
"cpe:/a:redhat:openshift:4.20::el9"
],
"versions": [
{
"version": "1786496552",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift Container Platform 4.21",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "openshift4/ose-haproxy-router-rhel9",
"cpes": [
"cpe:/a:redhat:openshift:4.21::el9"
],
"versions": [
{
"version": "1786498169",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift Container Platform 4.22",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "openshift4/ose-haproxy-router-rhel9",
"cpes": [
"cpe:/a:redhat:openshift:4.22::el9"
],
"versions": [
{
"version": "1786584196",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift Container Platform 4",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "openshift4/ose-haproxy-router",
"cpes": [
"cpe:/a:redhat:openshift:4"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift Container Platform 5",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "openshift5/ose-haproxy-router-rhel9",
"cpes": [
"cpe:/a:redhat:openshift:5"
]
}
]
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"affectedData": [
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift Container Platform 4.19",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "openshift4/ose-haproxy-router-rhel9",
"cpes": [
"cpe:/a:redhat:openshift:4.19::el9"
],
"versions": [
{
"version": "1786771399",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift Container Platform 4.20",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "openshift4/ose-haproxy-router-rhel9",
"cpes": [
"cpe:/a:redhat:openshift:4.20::el9"
],
"versions": [
{
"version": "1786496552",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift Container Platform 4.21",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "openshift4/ose-haproxy-router-rhel9",
"cpes": [
"cpe:/a:redhat:openshift:4.21::el9"
],
"versions": [
{
"version": "1786498169",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift Container Platform 4.22",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "openshift4/ose-haproxy-router-rhel9",
"cpes": [
"cpe:/a:redhat:openshift:4.22::el9"
],
"versions": [
{
"version": "1786584196",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift Container Platform 4",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "openshift4/ose-haproxy-router",
"cpes": [
"cpe:/a:redhat:openshift:4"
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 3.1,
"impactScore": 4.0
},
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 2.8,
"impactScore": 3.6
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 3.1,
"impactScore": 4.0
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-05-30T02:24:09.743182Z",
"id": "CVE-2026-42965",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-918"
}
]
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-918"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "932D137F-528B-4526-9A89-CD59FA1AB0FE"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:redhat:openshift_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "EB6C1612-6A17-4F3B-B170-7C9F6028FBBB"
}
]
}
]
}
],
"references": [
{
"url": "https://access.redhat.com/errata/RHSA-2026:54583",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:54602",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:54770",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:57408",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:65852",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:70587",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-42965",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2483184",
"source": "[email protected]",
"tags": [
"Issue Tracking",
"Vendor Advisory"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:54583",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:54602",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:54770",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:57408",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-42965",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"tags": [
"Vendor Advisory"
]
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2483184",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"tags": [
"Issue Tracking",
"Vendor Advisory"
]
},
{
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42965.json",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
}
]
}