CVE-2022-1902

8.8 highEPSS 1.4%

A flaw was found in the Red Hat Advanced Cluster Security for Kubernetes. Notifier secrets were not properly sanitized in the GraphQL API. This flaw allows authenticated ACS users to retrieve Notifiers from the GraphQL API, revealing secrets that can escalate their privileges.

Severity

CVSS 3.1

8.8 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 1.4% chance of exploitation in the next 30 days; higher than 72% of CVEs (scores of 2026-10-31)
CWEs: CWE-497, CWE-668
Published: 2022-09-01
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

redhat:advanced_cluster_security

References

https://access.redhat.com/security/cve/CVE-2022-1902
https://bugzilla.redhat.com/show_bug.cgi?id=2090957
https://github.com/stackrox/stackrox/pull/1803
https://access.redhat.com/security/cve/CVE-2022-1902
https://bugzilla.redhat.com/show_bug.cgi?id=2090957

Check your stack JSON