CVE-2024-7128 - CVE House
Back to Database
Status published Medium CVE-2024-7128

Openshift-console: unauthenticated data exposure

Vulnerability Description

A flaw was found in the OpenShift console. Several endpoints in the application use the authHandler() and authHandlerWithUser() middleware functions. When the default authentication provider ("openShiftAuth") is set, these functions do not perform any authentication checks, relying instead on the targeted service to handle authentication and authorization. This issue leads to various degrees of data exposure due to a lack of proper credential verification.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-7128

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • This issue was discovered by Thibault Guittet (Red Hat).

Affected Vendor

Affected Software

Red Hat OpenShift Container Platform 4.16, Red Hat OpenShift Container Platform 4.17, Red Hat OpenShift Container Platform 4.18, Red Hat OpenShift Container Platform 3.11
Vulnerable Versions:
4.16, v4.16.0-202508060805.p0.gc145016.assembly.stream.el9, v4.17.0-202505061536.p0.gd71a401.assembly.stream.el9, v4.18.0-202504300105.p0.g4294cdd.assembly.stream.el9

Timeline

Official Publish: July 26th, 2024
Last Modified: November 20th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weaknesses (CWE)