CVE-2026-42965

HighCVSS 7.7

Published: 29/05/2026(UTC)Updated: 07/09/2026(UTC)Translated: 22/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.26%

18th percentile - higher than 18% of all known CVEs

Summary

A flaw in OpenShift Router allows a user with EndpointSlice write access to create a Service backed by an FQDN EndpointSlice that resolves to a cloud metadata endpoint. The router then proxies requests to this endpoint, leading to disclosure of instance credentials and other sensitive metadata. This bypasses previous IP address validation security measures.

Risk Assessment

The organization is at risk of cloud credential and instance metadata leakage, which could enable an attacker to escalate privileges and access cloud resources.

Recommendation

Immediately update OpenShift Router to a patched version and restrict EndpointSlice write permissions to trusted entities only.

Other vulnerabilities in OpenShift Router

CVE-2026-46579High
In OpenShift Router, when a Route has insecureEdgeTerminationPolicy set to Allow, the HTTP frontend does not remove X-SSL-Client-* headers from incoming requests. An unauthenticated attacker can send crafted HTTP requests with fake headers, bypassing mutual TLS authentication and impersonating client certificate identities.

Original NVD description (English source)

A flaw was found in the OpenShift Router. A user with EndpointSlice write access can exploit this vulnerability by creating a Service backed by an FQDN (Fully Qualified Domain Name) EndpointSlice that resolves to a cloud metadata endpoint. This allows the router to proxy requests to the cloud metadata endpoint, leading to the disclosure of instance credentials and other sensitive metadata. This bypasses previous security measures for validating IP addresses.