HyperShift CVE-2026-101919 — CVSS 8.8 Tenant Isolation Bypass via Kubeconfig Passthrough

·1 views

An authenticated tenant with basic namespace permissions can break out to the host control plane in OpenShift clusters running Multicluster Engine with HyperShift. CVE-2026-101919 (CVSS 3.1 8.8, Red Hat: Important) is an improper input validation flaw in the hypershift-rhel9-operator. The ReconcileCredentials function copies a user-provided kubeconfig Secret verbatim into the privileged control plane namespace: // illustrative — simplified from source No exec-provider stripping, no AuthProvider validation, no InsecureSkipTLSVerify guard. A tenant embeds a malicious exec plugin in their kubecon

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

彻底放弃MicroFeed了

Github因为我发的一些比基尼的图片直接给我删库了，其实用的也不是GitHub的图床了还是被废了。虽然GitHub/GitLab注册很简单，但对这些第三方代码平台有点烦了。 SaaS全托管的最后考虑Mataroa Blog，主要是导出导入很方便，完全支持Markdown，最重要的是可以邮件发博文。不过跟Hatena一样，每次新起一行都需要留一行空行，否则文字都会挤在一起，WordPress跟Blogger没这方面问题。我已经试过了各种博客系统: Jekyll/Hugo/VitePress/Gmeek/SkunkHTML/MDXpress，多数都是GitHub + CloudFlare Page，有些是GitHub，多数更新都比较麻烦，Gmeek还算简单。昨天到今天想试一下只用CloudFlare弄一个简单的MicroFeed，但设置了半天也没成功。考虑了很久，打断自己用Obsidian + Share.Note.Sx 做一个目录页，从Mataroa Blog/Bear Blog/WriteFreely第三方实例/Hatena Blog/PageCord里面选择1-2个做备份用。只要本地保存Markdown文件，博客平台就只是一个空壳罢了，需要展示的时候导入一下即可。昨天其实还试了发多图到Nostr，结果账号他站的图床的链接跟帖子最后都消失了，这也证明了自由是有边界的，掌控

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Install an SSH Public Key on a Server from Linux, macOS, or Windows

Password prompts on every SSH connection get old quickly. Public-key authentication fixes that, but first the server needs your public key in the right place. On Linux, ssh-copy-id handles the common case. On macOS and Windows, you may need to install or use an alternative. You need a key pair and a way to log in to the server already, such as a password or another working key.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Build-Time, End to End - From federation.config to remoteEntry.json

Part 3 of an 8-part series on Native Federation v4 for enterprise architecture teams. New to the series? Start with Part 1: The Mental Model, Revisited. In Part 2, we mapped the four layers of Native Federation v4 and saw that one file, remoteEntry.json, connects the build to the browser. This article zooms in on the build side and answers three questions: What do you write in federation.config.mjs, and what does each setting mean?

0 comments Read more at DEV Community

ProgrammingDEV Community ·

111 and 2049: RPC and NFS Endpoints in an Internet-Facing Population

111 and 2049: RPC and NFS Endpoints in an Internet-Facing Population Services that were never meant to leave the data centre Some protocols exist to make a private network work. Portmapper and NFS are the clearest examples: they assume a trusted network, they historically relied on host-based access control rather than authentication, and they have no business being reachable from the internet. Measurement shows how far that assumption holds. Queried on 25 September 2026 through the ZoomEye SDK: port="1521" is not part of this set, but a set of direct service and port probes was executed at th

0 comments Read more at DEV Community