VDB

CVE-2026-42965

CVE-2026-42965 PUBLISHED CVSS 7.7 HIGH

Reported by redhat · Published May 29, 2026

A flaw was found in the OpenShift Router. A user with EndpointSlice write access can exploit this vulnerability by creating a Service backed by an FQDN (Fully Qualified Domain Name) EndpointSlice that resolves to a cloud metadata endpoint. This allows the router to proxy requests to the cloud metadata endpoint, leading to the disclosure of instance credentials and other sensitive metadata. This bypasses previous security measures for validating IP addresses.

Risk Scores

CVSS 3.1
7.7
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Affected Products

VendorProductVersions
Red HatRed Hat OpenShift Container Platform 4.191786771399
Red HatRed Hat OpenShift Container Platform 4.201786496552
Red HatRed Hat OpenShift Container Platform 4.211786498169
Red HatRed Hat OpenShift Container Platform 4.221786584196
Red HatRed Hat OpenShift Container Platform 4
Red HatRed Hat OpenShift Container Platform 4.221786584196, 1786584196, 1786584196
Red HatRed Hat OpenShift Container Platform 5
Red HatRed Hat OpenShift Container Platform 4.211786498169, 1786498169, 1786498169
Red HatRed Hat OpenShift Container Platform 4.211786498169, 1786498169, 1786498169
Red HatRed Hat OpenShift Container Platform 4.21786496552, 1786496552
Red HatRed Hat OpenShift Container Platform 4.201786496552, 1786496552, 1786496552
Red HatRed Hat OpenShift Container Platform 4.191786771399, 1786771399
Red HatRed Hat OpenShift Container Platform 4
Red HatRed Hat OpenShift Container Platform 4
Red HatRed Hat OpenShift Container Platform 4
Red HatRed Hat OpenShift Container Platform 4
Red HatRed Hat OpenShift Container Platform 4.221786584196, 1786584196, 1786584196
Red HatRed Hat OpenShift Container Platform 4
Red HatRed Hat OpenShift Container Platform 4.191786771399
Red HatRed Hat OpenShift Container Platform 4.21786496552, 1786496552

…and 1 more

Timeline

  • May 29, 2026 EPSS Score
  • May 29, 2026 CVE Published
  • May 29, 2026 CVE Updated
  • May 30, 2026 EPSS Score
  • May 31, 2026 EPSS Score
  • Jun 1, 2026 EPSS Score
  • Jun 2, 2026 Security Advisory
  • Jun 5, 2026 EPSS Score
  • Jun 8, 2026 Coalition ESS Score
  • Aug 7, 2026 EPSS Score
  • Aug 20, 2026 Distribution Patch
  • Aug 20, 2026 Distribution Patch

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›