CVE-2024-1139: Cluster-monitoring-operator: credentials leak

Severity: high (CVSS 7.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-04-25 · updated 2026-10-08
Weakness: CWE-200

Description

A credentials leak vulnerability was found in the cluster monitoring operator in OCP. This issue may allow a remote attacker who has basic login credentials to check the pod manifest to discover a repository pull secret.

Affected products

Red Hat OpenShift Container Platform 4.12: all versions — fixed in v4.12.0-202405091536.p0.g8906207.assembly.stream.el8
Red Hat OpenShift Container Platform 4.13: all versions — fixed in v4.13.0-202404200313.p0.gb518881.assembly.stream.el8
Red Hat OpenShift Container Platform 4.14: all versions — fixed in v4.14.0-202404161544.p0.g004ecde.assembly.stream.el8, v4.14.0-202404161544.p0.g02471d9.assembly.stream.el8, v4.14.0-202404161544.p0.g06e8ce0.assembly.stream.el8, v4.14.0-202404161544.p0.g074a22c.assembly.stream.el8, v4.14.0-202404161544.p0.g078aee5.assembly.stream.el8, v4.14.0-202404161544.p0.g08fb27e.assembly.stream.el8
Red Hat OpenShift Container Platform 4.15: all versions — fixed in v4.15.0-202404161612.p0.g00d04f5.assembly.stream.el9

How to fix

Upgrade to a fixed version: Red Hat OpenShift Container Platform 4.12 v4.12.0-202405091536.p0.g8906207.assembly.stream.el8; Red Hat OpenShift Container Platform 4.13 v4.13.0-202404200313.p0.gb518881.assembly.stream.el8; Red Hat OpenShift Container Platform 4.14 v4.14.0-202404161544.p0.g004ecde.assembly.stream.el8, v4.14.0-202404161544.p0.g02471d9.assembly.stream.el8, v4.14.0-202404161544.p0.g06e8ce0.assembly.stream.el8, v4.14.0-202404161544.p0.g074a22c.assembly.stream.el8; Red Hat OpenShift Container Platform 4.15 v4.15.0-202404161612.p0.g00d04f5.assembly.stream.el9. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-1139 or the next vulnerability affects your stack