CVE-2022-1902

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-09-01 · updated 2026-06-17
Weakness: CWE-497

Description

A flaw was found in the Red Hat Advanced Cluster Security for Kubernetes. Notifier secrets were not properly sanitized in the GraphQL API. This flaw allows authenticated ACS users to retrieve Notifiers from the GraphQL API, revealing secrets that can escalate their privileges.

Affected products

Red Hat Advanced Cluster Security for Kubernetes: 3.68, 3.69, 3.70

References

https://access.redhat.com/security/cve/CVE-2022-1902
https://bugzilla.redhat.com/show_bug.cgi?id=2090957
https://github.com/stackrox/stackrox/pull/1803
https://access.redhat.com/security/cve/CVE-2022-1902
https://bugzilla.redhat.com/show_bug.cgi?id=2090957
https://github.com/stackrox/stackrox/pull/1803

Get alerted when CVE-2022-1902 or the next vulnerability affects your stack