CVE-2025-11393High· 8.7▾ TwilightA flaw was found in runtimes-inventory-rhel8-operator. An internal proxy component is incorrectly configured. Because of this flaw, the proxy attaches the cluster's main administrative credentials to any command it receives, instead of o…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 47.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 3.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.2%
Last analysed / modified upstream
A flaw was found in runtimes-inventory-rhel8-operator. An internal proxy component is incorrectly configured. Because of this flaw, the proxy attaches the cluster's main administrative credentials to any command it receives, instead of only the specific reports it is supposed to handle.
This allows a standard user within the cluster to send unauthorized commands to the management platform, effectively acting with the full permissions of the cluster administrator. This could lead to unauthorized changes to the cluster's configuration or status on the Red Hat platform.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-118687Medium· 6.5Coder before 2.29.21, 2.34.12, 2.35.9, 2.36.7, and 2.37.4 Missing Audience Validation in GCP Instance-Identity Authentication
CVE-2026-67077Medium· 4.2HCL BigFix AEX is affected by multiple security vulnerabilities.
CVE-2026-44945Critical· 9.1A privilege escalation vulnerability exists in Rancher's impersonation middleware (pkg/auth/requests/impersonate.go)
CVE-2026-114612Critical· 9.9LiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Key
CVE-2026-114125High· 8.6Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites
CVE-2026-114478Medium· 5.9Unintended Proxy or Intermediary ('Confused Deputy') in hMailServer