{"cve":"CVE-2024-7079","nvd":{"published":"2024-07-24T16:15:07.613","modified":"2026-06-17T08:19:19.347","status":"Modified","description":"A flaw was found in the Openshift console. The /API/helm/verify endpoint is tasked to fetch and verify the installation of a Helm chart from a URI that is remote HTTP/HTTPS or local. Access to this endpoint is gated by the authHandlerWithUser() middleware function. Contrary to its name, this middleware function does not verify the validity of the user's credentials. As a result, unauthenticated users can access this endpoint.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","score":6.5},"cwes":["CWE-306"],"references":["https://access.redhat.com/security/cve/CVE-2024-7079","https://bugzilla.redhat.com/show_bug.cgi?id=2299678","https://access.redhat.com/security/cve/CVE-2024-7079","https://bugzilla.redhat.com/show_bug.cgi?id=2299678"],"products":["redhat:openshift_container_platform"],"source":"nvd","synced_at":"2026-10-19T21:52:42.518321223+00:00"},"epss":{"cve":"CVE-2024-7079","score":0.00361,"percentile":0.29938,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}