What’s Vulnerable › Products
RedHat Data Grid vulnerabilities
25 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 11 published in the last 12 months.
Check whether your RedHat Data Grid version is affected
Latest RedHat Data Grid vulnerabilities
- CVE-2026-16102 — Keycloak-services: keycloak-services: default dcr policy allows role forgery via user property mappers (CVSS 8.1)
- CVE-2026-15573 — Keycloak-services: keycloak-services: authorization bypass via unnormalized uri matching in pathmatcher (CVSS 8.1)
- CVE-2026-16093 — Keycloak-services: keycloak-services: required signed-jwt assertion policy can be bypassed with unsigned assertion headers (CVSS 5.4)
- CVE-2026-15945 — Keycloak-services: keycloak-services: group hierarchy search discloses hidden parent groups under fgap v2 (CVSS 2.7)
- CVE-2026-44495 — Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge (CVSS 7.7)
- CVE-2026-28369 — Undertow: undertow: request smuggling via malformed http request headers (CVSS 9.1)
- CVE-2026-28368 — Undertow: undertow: request smuggling via inconsistent header parsing (CVSS 9.1)
- CVE-2026-28367 — Undertow: undertow: request smuggling via `\r\r\r` as a header block terminator (CVSS 9.1)
- CVE-2025-12543 — Undertow-core: undertow http server fails to reject malformed host headers leading to potential cache poisoning and ssrf (CVSS 9.6)
- CVE-2025-5731 — Infinispan: credential leakage in infinispan cli (CVSS 5.5)
- CVE-2025-23368 — Org.wildfly.core:wildfly-elytron-integration: wildfly elytron brute force attack via cli (CVSS 8.1)
- CVE-2024-7885 — Undertow: improper state management in proxy protocol parsing causes information leakage (CVSS 7.5)
- CVE-2023-5384 — Infinispan: credentials returned from configuration as clear text (CVSS 2.7)
- CVE-2023-5236 — Infinispan: circular reference on marshalling leads to dos (CVSS 6.5)
- CVE-2023-3629 — Infinispan: non-admins should not be able to get cache config via rest api (CVSS 6.5)
- CVE-2023-3628 — Infispan: rest bulk ops don't check permissions (CVSS 6.5)
- CVE-2023-4586 — Hotrod-client: hot rod client does not enable hostname validation when using tls that lead to a mitm attack (CVSS 7.4)
- CVE-2021-31917 — (CVSS 9.8)
- CVE-2021-3642 — (CVSS 5.3)
- CVE-2020-10771 — (CVSS 7.1)
- CVE-2021-3536 — (CVSS 4.8)
- CVE-2020-25711 — (CVSS 6.5)
- CVE-2020-25644 — (CVSS 7.5)
- CVE-2019-14838 — (CVSS 4.9)
- CVE-2015-7501 — (CVSS 9.8)