CVE-2026-42965 — Security Box Score

CVE · referencelatest edition

Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-42965MEDIUM

Red Hat Red Hat OpenShift Container Platform 4.20 — Openshift/router: openshift/router: cloud metadata ssrf via fqdn-typed endpointslice bypasses destination validation

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  U  H  N  N    6.5   .0026   17.6     —

AFFECTED
  Product                                    Versions     Fixed
  Red Hat OpenShift Container Platform 4.20  unspecified  1786496552
  Red Hat OpenShift Container Platform 4.21  unspecified  1786498169
  Red Hat OpenShift Container Platform 4.22  unspecified  1786584196
  Red Hat OpenShift Container Platform 4     unspecified  —

TIMELINE
  May 28  Reserved by redhat
  May 29  Published (CNA: redhat)
  Aug 18  PATCH SHIPPED — CVE-2026-42965 (Red Hat OpenShift Container Platform 4.20). Fixed in Red Hat OpenShift Container Platform 4.20 1786496552.

CWE-918 · CNA: redhat · CVSS v3.1 · 6 references · NVD status: Modified

Description

A flaw was found in the OpenShift Router. A user with EndpointSlice write access can exploit this vulnerability by creating a Service backed by an FQDN (Fully Qualified Domain Name) EndpointSlice that resolves to a cloud metadata endpoint. This allows the router to proxy requests to the cloud metadata endpoint, leading to the disclosure of instance credentials and other sensitive metadata. This bypasses previous security measures for validating IP addresses.

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
May 28, 2026	Reserved	Reserved by redhat
May 29, 2026	Published	Published (CNA: redhat)
August 18, 2026	PATCH SHIPPED	PATCH SHIPPED — CVE-2026-42965 (Red Hat OpenShift Container Platform 4.20). Fixed in Red Hat OpenShift Container Platform 4.20 1786496552.

Affected

Affected products and packages — 4 rows
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
Red Hat	Red Hat OpenShift Container Platform 4.20	—	—	1786496552
Red Hat	Red Hat OpenShift Container Platform 4.21	—	—	1786498169
Red Hat	Red Hat OpenShift Container Platform 4.22	—	—	1786584196
Red Hat	Red Hat OpenShift Container Platform 4	—	—	—

Weaknesses

CWE-918

References (6)

https://access.redhat.com/errata/RHSA-2026:54583 [vendor-advisory, x_refsource_REDHAT]
https://access.redhat.com/errata/RHSA-2026:54602 [vendor-advisory, x_refsource_REDHAT]
https://access.redhat.com/errata/RHSA-2026:54770 [vendor-advisory, x_refsource_REDHAT]
https://access.redhat.com/security/cve/CVE-2026-42965 [vdb-entry, x_refsource_REDHAT]
https://bugzilla.redhat.com/show_bug.cgi?id=2483184 [issue-tracking, x_refsource_REDHAT]
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42965.json [x_sadp-csaf-vex]

Authoritative record: CVE-2026-42965 at cve.org

Vendors: red hat

Weaknesses: CWE-918

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-42965 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.