CVE-2024-5037

HIGH 7.5

Openshift/telemeter: iss check during jwt authentication can be bypassed

CVSS Score

7.5

EPSS Score

0.0%

EPSS Percentile

0th

A flaw was found in OpenShift's Telemeter. If certain conditions are in place, an attacker can use a forged token to bypass the issue ("iss") check during JSON web token (JWT) authentication.

CWE	CWE-290
Published	Jun 5, 2024
Last Updated	Mar 18, 2026

Stay Ahead of the Next One

Get instant alerts for

Be the first to know when new high vulnerabilities are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Affected Versions

Red Hat / Red Hat OpenShift Container Platform 4.12

All versions affected

Red Hat / Red Hat OpenShift Container Platform 4.13

All versions affected

Red Hat / Red Hat OpenShift Container Platform 4.14

All versions affected

Red Hat / Red Hat OpenShift Container Platform 4.15

All versions affected

Red Hat / Red Hat OpenShift Container Platform 4.16

All versions affected

Red Hat / Logging Subsystem for Red Hat OpenShift

All versions affected

Red Hat / Red Hat OpenShift distributed tracing 2

All versions affected

Red Hat / Red Hat OpenShift distributed tracing 3

All versions affected

References

NVD ↗ CVE.org ↗ EPSS Data ↗

access.redhat.com: https://access.redhat.com/errata/RHSA-2024:4151 access.redhat.com: https://access.redhat.com/errata/RHSA-2024:4156 access.redhat.com: https://access.redhat.com/errata/RHSA-2024:4329 access.redhat.com: https://access.redhat.com/errata/RHSA-2024:4484 access.redhat.com: https://access.redhat.com/errata/RHSA-2024:5200 access.redhat.com: https://access.redhat.com/security/cve/CVE-2024-5037 bugzilla.redhat.com: https://bugzilla.redhat.com/show_bug.cgi?id=2272339 github.com: https://github.com/kubernetes/kubernetes/pull/123540 github.com: https://github.com/openshift/telemeter/blob/a9417a6062c3a31ed78c06ea3a0613a52f2029b2/pkg/authorize/jwt/client_authorizer.go#L78