Red Hat Red Hat Openshift Dev Spaces
14 CVEs affecting Red Hat Red Hat Openshift Dev Spaces. Latest disclosed: 2026-11-06. Critical: 1, High: 4.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-107935 | Critical | 9.3 | 2026-10-09 | A path traversal vulnerability was found in gvproxy, the network forwarder provided by the gvisor-tap-vsock package. The unauthenticated /services/forwarder/ex… |
CVE-2026-50240 | High | 8.8 | 2026-11-06 | A flaw was found in OpenShift Pipelines-as-Code (PAC). PAC does not verify whether the creator of a Repository custom resource has permission to create Pipelin… |
CVE-2024-3727 | High | 8.3 | 2024-05-14 | A flaw was found in the github.com/containers/image library. This flaw allows attackers to trigger unexpected authenticated registry accesses on behalf of a vi… |
CVE-2026-107912 | High | 7.7 | 2026-11-05 | A flaw was found in the management interface of the Quarkus framework, specifically within the quarkus-vertx-http component. The issue occurs when the framewor… |
CVE-2024-1394 | High | 7.5 | 2024-03-21 | A memory leak flaw was found in Golang in the RSA encrypting/decrypting code, which might lead to a resource exhaustion vulnerability using attacker-controlled… |
CVE-2025-57850 | Medium | 6.4 | 2025-12-02 | A container privilege escalation flaw was found in certain CodeReady Workspaces images. This issue stems from the /etc/passwd file being created with group-wri… |
CVE-2026-91147 | Medium | 5.9 | 2026-09-18 | A flaw was found in `cockpit-ws`. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service (DoS) by sending a specially crafte… |
CVE-2025-11395 | Medium | 5.5 | 2026-09-15 | A flaw was found in Podman. If an attacker can pass a crafted tar archive to the `podman load` command, they can create files on the host machine with the priv… |
CVE-2024-11831 | Medium | 5.4 | 2025-02-10 | A flaw was found in npm-serialize-javascript. The vulnerability occurs because the serialize-javascript module does not properly sanitize certain inputs, such… |
CVE-2025-11065 | Medium | 5.3 | 2026-01-26 | A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information… |
CVE-2026-79705 | Medium | 4.5 | 2026-09-15 | A flaw was found in the buildah/copier Go package. When used outside of Buildah by a non-root caller, a crafted tar archive containing malicious symlinks can e… |
CVE-2026-79699 | Medium | 4.4 | 2026-09-15 | A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout header (e.g. victim/.wh.) can cause the extraction de… |
CVE-2026-91142 | Low | 3.6 | 2026-09-18 | A flaw was found in Cockpit. An authenticated local user with a large user identifier (UID) can cause unauthorized modification and disclosure of login records… |
CVE-2026-114236 | Low | 3.3 | 2026-10-21 | storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer may, when processing corrupt or malicious inputs, leak a file descriptor; unbounded repeated calls ca… |