CVE-2026-1784
published 2026-06-02CVE-2026-1784: The Route OpenShift resource allows to define routes to make pods reachable at a subdomain through HAProxy. It was found that the checks performed on the…
PriorityP349high8.8CVSS 3.1
AVLACLPRLUINSCCHIHAH
EPSS
0.19%
9.4th percentile
The Route OpenShift resource allows to define routes to make pods reachable at a subdomain through HAProxy. It was found that the checks performed on the spec.path YAML stanza in a Route document was insufficient and could allow a controlled injection of the HAProxy configuration.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| openshift4 | ose-cluster-ingress-operator | — | — |
| openshift4 | ose-cluster-ingress-rhel9-operator | — | — |
| redhat | openshift_container_platform | — | — |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
vendor_redhat8.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Red Hat OpenShift Container Platform 4 Configuration external control of setting (WID-SEC-2026-2072)
vuldb·2026-06-26·CVSS 8.8
CVE-2026-1784 [HIGH] Red Hat OpenShift Container Platform 4 Configuration external control of setting (WID-SEC-2026-2072)
A vulnerability was found in Red Hat OpenShift Container Platform 4. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Configuration Handler. This manipulation causes external control of system or configuration setting.
This vulnerability is registered as CVE-2026-1784. The attack needs to be launched locally. No exploit is available.
GHSA
The Route OpenShift resource allows to define routes to make pods reachable at a subdomain through HAProxy.
ghsa_unreviewed·2026-06-02
CVE-2026-1784 [HIGH] CWE-15 The Route OpenShift resource allows to define routes to make pods reachable at a subdomain through HAProxy.
The Route OpenShift resource allows to define routes to make pods reachable at a subdomain through HAProxy. It was found that the checks performed on the spec.path YAML stanza in a Route document was insufficient and could allow a controlled injection of the HAProxy configuration.
Red Hat
vim: Vim: Arbitrary code execution via crafted zip archive entry names
vendor_redhat·2026-06-25·CVSS 7.3
CVE-2026-57453 [HIGH] CWE-78 vim: Vim: Arbitrary code execution via crafted zip archive entry names
vim: Vim: Arbitrary code execution via crafted zip archive entry names
Vim is an open source, command line text editor. From 9.1.1784 until 9.2.0678, when the bundled zip plugin autoload/zip.vim falls back to PowerShell to browse, read, extract, update or delete entries in a zip archive, it builds the PowerShell command by inserting archive entry names that are quoted only for the shell, not for PowerShell. A crafted entry name can break out of the intended string context and cause PowerShell to execute arbitrary commands with the privileges of the user running Vim, triggered by opening, viewing or extracting the archive. This vulnerability is fixed in 9.2.0678.
A security vulnerability exists in the Vim text editor. If a user opens a specially crafted ZIP file in Vim, it can trick the a
Red Hat
ose-cluster-ingress-operator: Remote Code Execution Through HAProxy Configuration Injection
vendor_redhat·2026-06-02·CVSS 8.8
CVE-2026-1784 [HIGH] CWE-15 ose-cluster-ingress-operator: Remote Code Execution Through HAProxy Configuration Injection
ose-cluster-ingress-operator: Remote Code Execution Through HAProxy Configuration Injection
The Route OpenShift resource allows to define routes to make pods reachable at a subdomain through HAProxy. It was found that the checks performed on the spec.path YAML stanza in a Route document was insufficient and could allow a controlled injection of the HAProxy configuration.
Package: openshift4/ose-cluster-ingress-operator (Red Hat OpenShift Container Platform 4) - Affected
Package: openshift4/ose-cluster-ingress-rhel9-operator (Red Hat OpenShift Container Platform 4) - Affected
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-58379 gimp: gimp: Heap buffer overflow in read_channel_data()
bugzilla·2026-07-01·CVSS 7.8
CVE-2026-58379 [HIGH] CVE-2026-58379 gimp: gimp: Heap buffer overflow in read_channel_data()
CVE-2026-58379 gimp: gimp: Heap buffer overflow in read_channel_data()
A heap buffer overflow write vulnerability exists in GIMP's Paint Shop Pro (PSP) file format parser. In read_channel_data() in file-psp.c, for low bit-depth images (depth=1 or 4), line_width uses a packed formula (8 pixels/byte) but fread() reads width bytes (1 byte/pixel). For example, with width=33 and depth=1: allocates 4 bytes, writes 33 — a 29-byte heap overflow.
This is a variant of CVE-2026-4153 (commit 98cb1371), which fixed read_layer_block() but left the buf allocation in read_channel_data() unpatched.
- Function: read_channel_data()
- File: plug-ins/common/file-psp.c:1558-1784
- Fix: https://gitlab.gnome.org/GNOME/gimp/-/commit/b630f167
- Hardening: https://gitlab.gnome.org/GNOME/gimp/-/commit/20b00d6d
- U
Bugzilla
CVE-2026-57453 vim: Vim: Arbitrary code execution via crafted zip archive entry names
bugzilla·2026-06-25·CVSS 7.3
CVE-2026-57453 [HIGH] CVE-2026-57453 vim: Vim: Arbitrary code execution via crafted zip archive entry names
CVE-2026-57453 vim: Vim: Arbitrary code execution via crafted zip archive entry names
Vim is an open source, command line text editor. From 9.1.1784 until 9.2.0678, when the bundled zip plugin autoload/zip.vim falls back to PowerShell to browse, read, extract, update or delete entries in a zip archive, it builds the PowerShell command by inserting archive entry names that are quoted only for the shell, not for PowerShell. A crafted entry name can break out of the intended string context and cause PowerShell to execute arbitrary commands with the privileges of the user running Vim, triggered by opening, viewing or extracting the archive. This vulnerability is fixed in 9.2.0678.
Bugzilla
CVE-2026-43289 kernel: kexec: derive purgatory entry from symbol
bugzilla·2026-05-08
CVE-2026-43289 [LOW] CVE-2026-43289 kernel: kexec: derive purgatory entry from symbol
CVE-2026-43289 kernel: kexec: derive purgatory entry from symbol
In the Linux kernel, the following vulnerability has been resolved:
kexec: derive purgatory entry from symbol
kexec_load_purgatory() derives image->start by locating e_entry inside an
SHF_EXECINSTR section. If the purgatory object contains multiple
executable sections with overlapping sh_addr, the entrypoint check can
match more than once and trigger a WARN.
Derive the entry section from the purgatory_start symbol when present and
compute image->start from its final placement. Keep the existing e_entry
fallback for purgatories that do not expose the symbol.
WARNING: kernel/kexec_file.c:1009 at kexec_load_purgatory+0x395/0x3c0, CPU#10: kexec/1784
Call Trace:
bzImage64_load+0x133/0xa00
__do_sys_kexec_file_load+0x2b3/0x5c0
Bugzilla
CVE-2026-1784 ose-cluster-ingress-operator: Remote Code Execution Through HAProxy Configuration Injection
bugzilla·2026-02-02·CVSS 8.8
CVE-2026-1784 [HIGH] CVE-2026-1784 ose-cluster-ingress-operator: Remote Code Execution Through HAProxy Configuration Injection
CVE-2026-1784 ose-cluster-ingress-operator: Remote Code Execution Through HAProxy Configuration Injection
The Route OpenShift resource allows to define routes to make pods reachable at a subdomain through HAProxy. These Routes are managed by the openshift-ingress/router-default pods. One of the features of Routes is their ability to match a URI's path and replace it, this is expressed in the Route by the spec.path and metadata.annotations"[haproxy.router.openshift.io/rewrite-target YAML stanzas in a Route document which are in turn (after various checks and sanitization) used as parameters to a HAProxy configuration template. This configuration template is expressed in plaintext, thus the templating engine cannot automatically escape values to enforce the document structure, escaping has
https://access.redhat.com/errata/RHSA-2026:23241https://access.redhat.com/errata/RHSA-2026:23246https://access.redhat.com/errata/RHSA-2026:25045https://access.redhat.com/errata/RHSA-2026:25182https://access.redhat.com/errata/RHSA-2026:25194https://access.redhat.com/errata/RHSA-2026:26543https://access.redhat.com/errata/RHSA-2026:28893https://access.redhat.com/errata/RHSA-2026:28964https://access.redhat.com/security/cve/CVE-2026-1784https://bugzilla.redhat.com/show_bug.cgi?id=2436075https://access.redhat.com/errata/RHSA-2026:23241https://access.redhat.com/errata/RHSA-2026:23246https://access.redhat.com/errata/RHSA-2026:25045https://access.redhat.com/errata/RHSA-2026:25182https://access.redhat.com/errata/RHSA-2026:25194https://access.redhat.com/errata/RHSA-2026:26543https://access.redhat.com/errata/RHSA-2026:28893https://access.redhat.com/errata/RHSA-2026:28964https://access.redhat.com/security/cve/CVE-2026-1784https://bugzilla.redhat.com/show_bug.cgi?id=2436075https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-1784.json
2026-06-02
Published