Dashboard / CVE-2026-18874

CVE-2026-18874

MEDIUM
MEDIUM Priority: 0.03 BB Relevance: 48/100
Published: 2026-08-19 Modified: 2026-10-26 First seen: 2026-10-29 Status: active

Attack Surface

Network No Interaction Integ. Impact

CVSS Vector Breakdown

AV: Network
AC: High
PR: High
UI: None
S: Unchanged
C: Low
I: High
A: High

Description

A flaw was found in volsync-addon-controller. This vulnerability allows an attacker to inject malicious YAML (Yet Another Markup Language) code into the OpenShift Lifecycle Manager (OLM) Subscription resource. This is due to improper escaping of annotation values when they are rendered into YAML. Successful exploitation could lead to unauthorized modification or control over OLM Subscription configurations, potentially impacting software management within the cluster. This issue primarily affects systems where the 'volsync-addon-deploy-type: olm' annotation is explicitly enabled.

Weakness Classification (1)

References & Advisories (8)

Bug Bounty Relevance

48 / 100
✓ Network accessible
✓ No user interaction

CVSS Score

6.2 / 10.0 v3.1
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:H/A:H

EPSS — Exploitation Probability

0.54%
Raw Score 0.005380
Percentile 45.2%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00538
2026-10-28
0.00538

Intelligence Sources

nvd ref →

External Links