CVE-2026-10079: high-severity vulnerability in Red Hat Advanced Cluster Security 4
Stackrox: stackrox: deploy-time policy enforcement and visibility bypass via label injection
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.5epss 0.2%
A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). When processing Kubernetes Deployments, ACS replaces deployment identity metadata based on the openshift.io/encoded-deployment-config label. A user with permission to create Deployments can set this label to "null", causing ACS to treat the workload as having empty UID, name and labels and namespace "default". This bypasses deploy-time policy detection and enforcement visibility, prevents correct persistence in Central and breaks violation reporting and compliance correlation for the affected deployment.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N
Affected products
Red Hat · Red Hat Advanced Cluster Security 4Related CVEs — Red Hat Advanced Cluster Security 4
In the same product, most dangerous first.
CVE-2024-11831MEDIUMNpm-serialize-javascript: cross-site scripting (xss) in serialize-javascriptEPSS 1.1%CVE-2024-0406MEDIUMMholt/archiver: path traversal vulnerabilityEPSS 0.9%CVE-2026-9165HIGHStackrox: stackrox: unbounded graphql query depth allows authenticated denial of serviceEPSS 0.5%CVE-2025-8556LOWGithub.com/cloudflare/circl: circl-fourq: missing and wrong validation can lead to incorrect resultsEPSS 0.5%CVE-2025-11065MEDIUMGithub.com/go-viper/mapstructure/v2: go-viper's mapstructure may leak sensitive information in logs in github.com/go-viper/mapstructureEPSS 0.4%CVE-2026-19519MEDIUMClaircore: claircore: denial of service via unchecked type assertion in rpm header parserEPSS 0.4%