CVE-2025-11393HIGH 8.7EPSS p11.8%

CVE-2025-11393CVE-2025-11393

Description

A flaw was found in runtimes-inventory-rhel8-operator. An internal proxy component is incorrectly configured. Because of this flaw, the proxy attaches the cluster's main administrative credentials to any command it receives, instead of only the specific reports it is supposed to handle. This allows a standard user within the cluster to send unauthorized commands to the management platform, effectively acting with the full permissions of the cluster administrator. This could lead to unauthorized changes to the cluster's configuration or status on the Red Hat platform.

Scoring

CVSS 3.18.7 (HIGH)
VectorCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
EPSS0.21% probability of exploitation · percentile 11.8% · 2026-06-18T12:00:27Z
Published2025-12-15
Last modified2026-04-15

Underlying weaknesses· 1

CWE-441

References

  1. https://access.redhat.com/errata/RHSA-2025:23236
  2. https://access.redhat.com/security/cve/CVE-2025-11393
  3. https://bugzilla.redhat.com/show_bug.cgi?id=2402032

1

TypeTargetConfidenceTier
WeaknessUnintended Proxy or Intermediary ('Confused Deputy')cwe-4410%live

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.

CVE
CVE-2025-10725
CVE
CVE-2025-59359
CVE
CVE-2025-1393
CVE
CVE-2025-10611
CVE
CVE-2025-7388
CVE
CVE-2025-10622
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.