PT-2025-51254 · Red Hat · Runtimes-Inventory-Rhel8-Operator

Published 2025-12-15 · Updated 2026-01-06 · CVE-2025-11393

Positive Technologies (AI Summary)

CVSS v3.1

8.7

High

Base vector

AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions runtimes-inventory-rhel8-operator (affected versions not specified)

Description A configuration issue exists in an internal proxy component of runtimes-inventory-rhel8-operator. The proxy incorrectly attaches the cluster’s administrative credentials to all commands it receives, rather than limiting access to specific reports. This allows a standard user within the cluster to execute unauthorized commands with the full permissions of the cluster administrator, potentially leading to unauthorized modifications to the cluster’s configuration or status on the Red Hat platform.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-441

Related Identifiers

CVE-2025-11393

GO-2025-4241

SUSE-SU-2026:0037-1

Affected Products

Runtimes-Inventory-Rhel8-Operator

References · 90

• https://osv.dev/vulnerability/SUSE-SU-2026:0037-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-11393 · Security Note
• https://osv.dev/vulnerability/GO-2025-4241 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2025:23236 · Vendor Advisory
• https://twitter.com/CveFindCom/status/2000621670294303104 · Twitter Post
• https://suse.com/security/cve/CVE-2025-68941 · Note
• https://suse.com/security/cve/CVE-2025-67508 · Note
• https://suse.com/security/cve/CVE-2025-10543 · Note
• https://suse.com/security/cve/CVE-2025-60633 · Note
• https://suse.com/security/cve/CVE-2025-68939 · Note
• https://suse.com/security/cve/CVE-2025-65637 · Note
• https://suse.com/security/cve/CVE-2025-66508 · Note
• https://suse.com/security/cve/CVE-2025-64702 · Note
• https://suse.com/security/cve/CVE-2025-64708 · Note
• https://suse.com/security/cve/CVE-2025-67499 · Note