CVE-2025-11393: Insights-runtimes-tech-preview/runtimes-inventory-rhel8-operator: improper proxy configuration allows unauthorized administrative commands

Vulnerability summary

CVE-2025-11393 is a high (CVSS 8.7) Confused Deputy vulnerability in runtimes-inventory-operator Go. EPSS estimates a 0.20% chance of exploitation in the next 30 days, higher than 8.8% of scored vulnerabilities.

Timeline

1. 15-12-2025
   PublishedVulnerability first disclosed.
2. 22-08-2026
   Last modifiedVulnerability information updated.

Description

A flaw was found in runtimes-inventory-rhel8-operator. An internal proxy component is incorrectly configured. Because of this flaw, the proxy attaches the cluster's main administrative credentials to any command it receives, instead of only the specific reports it is supposed to handle. This allows a standard user within the cluster to send unauthorized commands to the management platform, effectively acting with the full permissions of the cluster administrator. This could lead to unauthorized changes to the cluster's configuration or status on the Red Hat platform.

• CWE-441Unintended Proxy or Intermediary ('Confused Deputy')The product receives a request, message, or directive from an upstream component, but the product does not sufficiently preserve the original source of the request before forwarding the request to an external actor that is outside of the product's control sphere. This causes the product to appear to be the source of the request, leading it to act as a proxy or other intermediary between the upstream component and the external actor.