CVE-2020-25655

6.5 mediumEPSS 0.6%

Medium (6.5) in redhat advanced cluster management for kubernetes. EPSS 0.6% chance of exploitation in the next 30 days.

An issue was discovered in ManagedClusterView API, that could allow secrets to be disclosed to users without the correct permissions. Views created for an admin user would be made available for a short time to users with only view permission. In this short time window the user with view permission could read cluster secrets that should only be disclosed to admin users.

Severity

CVSS 3.1

6.5 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS: 0.6% chance of exploitation in the next 30 days; higher than 49% of CVEs (scores of 2026-10-31)
CWE: CWE-863
Published: 2020-11-09
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

redhat:advanced_cluster_management_for_kubernetes

References

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-25655
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-25655

Check your stack JSON