CVE-2024-7128
Openshift-console: unauthenticated data exposure
CVSS Score
5.3
EPSS Score
0.0%
EPSS Percentile
0th
A flaw was found in the OpenShift console. Several endpoints in the application use the authHandler() and authHandlerWithUser() middleware functions. When the default authentication provider ("openShiftAuth") is set, these functions do not perform any authentication checks, relying instead on the targeted service to handle authentication and authorization. This issue leads to various degrees of data exposure due to a lack of proper credential verification.
| CWE | CWE-200 |
| Published | Jul 26, 2024 |
| Last Updated | Nov 20, 2025 |
Stay Ahead of the Next One
Get instant alerts for
Be the first to know when new medium vulnerabilities are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None
Affected Versions
Red Hat / Red Hat OpenShift Container Platform 4.16
All versions affected Red Hat / Red Hat OpenShift Container Platform 4.17
All versions affected Red Hat / Red Hat OpenShift Container Platform 4.18
All versions affected Red Hat / Red Hat OpenShift Container Platform 3.11
All versions affected References
access.redhat.com: https://access.redhat.com/errata/RHSA-2025:13336 access.redhat.com: https://access.redhat.com/errata/RHSA-2025:4427 access.redhat.com: https://access.redhat.com/errata/RHSA-2025:4723 access.redhat.com: https://access.redhat.com/security/cve/CVE-2024-7128 bugzilla.redhat.com: https://bugzilla.redhat.com/show_bug.cgi?id=2300037
Credits
This issue was discovered by Thibault Guittet (Red Hat).