Summary
generated automatically from NVD dataThe Kubernetes API server, as used in Red Hat OpenShift Enterprise 3.2, has an information exposure flaw (CWE-200) in multi-tenant deployments. Through the watch-cache list, a remote authenticated user who knows the names of other projects can retrieve sensitive project and user information belonging to those tenants. The issue is rated MEDIUM with a CVSS v3.0 score of 6.5, with the impact limited to confidentiality.
NVD description
The API server in Kubernetes, as used in Red Hat OpenShift Enterprise 3.2, in a multi tenant environment allows remote authenticated users with knowledge of other project names to obtain sensitive project and user information via vectors related to the watch-cache list.
EPSS · FIRST.org
2.5%probability of exploitation in the next 30 days
Higher than 84% of scored CVEs
EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-30, recomputed daily by FIRST.org.
CVSS v3.0 Score
Information
- Published
- 5 août 2016
- Updated
- 17 juin 2026
- Status
- Modified
- Source
- secalert@redhat.com
Affected products
Bounds published by NVD: "< 8.4.27" means 8.4.27 is no longer vulnerable. The fixed release to install is in the vendor advisory.
Weaknesses (CWE)
References (6)
- http://www.securityfocus.com/bid/91793Third Party AdvisoryVDB Entry
- https://access.redhat.com/errata/RHSA-2016:1427Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1356195Issue Tracking
- http://www.securityfocus.com/bid/91793Third Party AdvisoryVDB Entry
- https://access.redhat.com/errata/RHSA-2016:1427Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1356195Issue Tracking
Similar CVEs
Other vulnerabilities of type CWE-200
Know which CVEs hit the versions you run.
Add the product and its version: cveo.tech lists the CVEs that affect it right away, then alerts you by email when a new one affects it — including before NVD has finished its analysis. Free, an account is all it takes.