CVE-2024-1139High· 7.7▾ TwilightA credentials leak vulnerability was found in the cluster monitoring operator in OCP. This issue may allow a remote attacker who has basic login credentials to check the pod manifest to discover a repository pull secret.
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 42.4 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Aug 14.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.9%
Last analysed / modified upstream
A credentials leak vulnerability was found in the cluster monitoring operator in OCP. This issue may allow a remote attacker who has basic login credentials to check the pod manifest to discover a repository pull secret.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-116190Low· 3.7github.com/rclone/rclone: rclone: Information disclosure via cross-host HTTP redirects (CVE-2026-116190)
CVE-2026-115449Low· 3.5Libslirp: libslirp: icmp echo reply length desynchronization leaks host ip to guest
CVE-2024-3656High· 8.1A flaw was found in Keycloak
CVE-2021-38554Medium· 5.3vault: UI erroneously cached and exposed user-viewed secrets between sessions in a single shared browser (CVE-2021-38554)
CVE-2021-41092High· 7.5docker: cli leaks private registry credentials to registry-1.docker.io (CVE-2021-41092)
CVE-2026-117574Critical· 9.1Ai-gateway-payload-processing: ai-gateway-payload-processing: tenant/credential selection from client-controlled url path with no in-process authorization