CVE-2024-7079
Openshift-console: unauthenticated installation of helm charts
- State
- Published
- Severity
- 6.5 Medium
- Published
- Jul 24, 2024
- Updated
- Nov 20, 2025
- Reserved
- Jul 24, 2024
Description
A flaw was found in the Openshift console. The /API/helm/verify endpoint is tasked to fetch and verify the installation of a Helm chart from a URI that is remote HTTP/HTTPS or local. Access to this endpoint is gated by the authHandlerWithUser() middleware function. Contrary to its name, this middleware function does not verify the validity of the user's credentials. As a result, unauthenticated users can access this endpoint.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 6.5 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N | redhat |
Weaknesses
- CWE-306 Missing Authentication for Critical Function
Affected Products
| Product | Versions |
|---|---|
openshift-console |
|
Red Hat OpenShift Container Platform 3.11Red Hat | |
Red Hat OpenShift Container Platform 4Red Hat |
References
- https://access.redhat.com/security/cve/CVE-2024-7079vdb-entry
- RHBZ#2299678issue-tracking
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.