CVE-2026-42965
Last modified
CVE-2026-42965 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. A flaw was found in the OpenShift Router. A user with EndpointSlice write access can exploit this vulnerability by creating a Service backed by an FQDN (Fully Qualified Domain Name) EndpointSlice that resolves to a cloud metadata endpoint. EPSS estimates a 0.23% chance of exploitation in the next 30 days.
Description
A flaw was found in the OpenShift Router. A user with EndpointSlice write access can exploit this vulnerability by creating a Service backed by an FQDN (Fully Qualified Domain Name) EndpointSlice that resolves to a cloud metadata endpoint. This allows the router to proxy requests to the cloud metadata endpoint, leading to the disclosure of instance credentials and other sensitive metadata. This bypasses previous security measures for validating IP addresses.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Redhat | Openshift Container Platform | 4.0 |
| Redhat | Openshift Router | All versions |
References
- https://access.redhat.com/security/cve/CVE-2026-42965Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2483184Issue Tracking, Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2026-42965Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2483184Issue Tracking, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2026-42965?
How severe is CVE-2026-42965?
How do I fix CVE-2026-42965?
How Strix Helps
- One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-42955In NLnet Labs Unbound 1.16.2 up to and including 1.25.1, a s…3.7
- CVE-2026-42958The application contains a use-after-free vulnerability that…8.4
- CVE-2026-42959NLnet Labs Unbound up to and including version 1.25.0 has a …7.5
- CVE-2026-4296An incorrect regular expression vulnerability was identified…8.8
- CVE-2026-42960NLnet Labs Unbound up to and including version 1.25.0 is vul…10
- CVE-2026-42961ELECOM wireless LAN access point devices implement CSRF prot…5.1
- CVE-2026-42968Out-of-bounds read in Windows Telephony Service allows an au…5.5
- CVE-2026-42969Use of uninitialized resource in Windows Push Notifications …5.5
- CVE-2026-4297The Welcome Software Publishing plugin for WordPress is vuln…8.8
- CVE-2026-42970Exposure of sensitive information to an unauthorized actor i…5.5
- CVE-2026-42971Exposure of sensitive information to an unauthorized actor i…5.5
- CVE-2026-42972Exposure of sensitive information to an unauthorized actor i…5.5
Are you affected by CVE-2026-42965?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST