Vulnerability in Red Hat Lightspeed (Formerly Insights) For Runtimes 1
CVE-2025-11393
A flaw was found in runtimes-inventory-rhel8-operator. An internal proxy component is incorrectly configured. Because of this flaw, the proxy attaches the cluster's main administrative credentials to any command it receives, instead of onl…
EPSS: 0.000 (0.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.7 (High). Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N.
Affected products
- Red Hat Lightspeed (Formerly Insights) For Runtimes 1 — versions sha256:08f473dec97e110a73e1c9886ee31512bb6937f87bdb95fbe77cb2d85695b936
- Red Hat Lightspeed (Formerly Insights) For Runtimes 1.0 — versions 1.0.0-1765483112
- Red Hat Runtimes Inventory Operator
Weakness classification (CWE)
References
- RHSA-2025:23236 (vendor-advisory, x_refsource_REDHAT)
- access.redhat.com/security/cve/CVE-2025-11393 (vdb-entry, x_refsource_REDHAT)
- RHBZ#2402032 (issue-tracking, x_refsource_REDHAT)
Frequently asked questions
- What is CVE-2025-11393?
- CVE-2025-11393 is a high-severity vulnerability in Red Hat Lightspeed (Formerly Insights) For Runtimes 1, classified under Unintended Proxy or Intermediary (Confused Deputy). CVSS score: 8.7/10. Published 2025-12-15.
- How severe is CVE-2025-11393?
- High severity. CVSS v3 base score is 8.7 out of 10.