Answer in brief
CVE-2025-11393 records a High severity (CVSS 8.7) vulnerability in Insights-runtimes-tech-preview/runtimes-inventory-rhel8-operator: improper proxy configuration allows unauthorized administrative commands. The current sources do not mark it as known exploited. Affected software not mapped in the current feed; confirm the named product and version against your inventory.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 8.7. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
Affected software not mapped in the current feed; confirm the named product and version against your inventory.
Published upstream
Dec 15, 2025
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 1, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jun 26, 2026
A flaw was found in runtimes-inventory-rhel8-operator. An internal proxy component is incorrectly configured. Because of this flaw, the proxy attaches the cluster's main administrative credentials to any command it receives, instead of only the specific reports it is supposed to handle. This allows a standard user within the cluster to send unauthorized commands to the management platform, effectively acting with the full permissions of the cluster administrator. This could lead to unauthorized changes to the cluster's configuration or status on the Red Hat platform.
Quoted source text, attributed separately from HOL analysis.
Answer in brief
CVE-2025-11393 records a High severity (CVSS 8.7) vulnerability in Insights-runtimes-tech-preview/runtimes-inventory-rhel8-operator: improper proxy configuration allows unauthorized administrative commands. The current sources do not mark it as known exploited. Affected software not mapped in the current feed; confirm the named product and version against your inventory.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 8.7. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
Affected software not mapped in the current feed; confirm the named product and version against your inventory.
Published upstream
Dec 15, 2025
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 1, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jun 26, 2026
A flaw was found in runtimes-inventory-rhel8-operator. An internal proxy component is incorrectly configured. Because of this flaw, the proxy attaches the cluster's main administrative credentials to any command it receives, instead of only the specific reports it is supposed to handle. This allows a standard user within the cluster to send unauthorized commands to the management platform, effectively acting with the full permissions of the cluster administrator. This could lead to unauthorized changes to the cluster's configuration or status on the Red Hat platform.
Quoted source text, attributed separately from HOL analysis.