CVE-2025-13465VulnerabilityPublished 17 Mar 2026Updated 1 Nov 2026

Red Hat Security Advisory: Cluster Observability Operator 1.4.0

Affects Red HatSource GCVE Database

Compare

Not known to be exploited · fixed in Red Hat package updates : patch Red Hat soon.

Data as of 1 Nov 2026, 08:20 UTC

Severity

High

Rated by Threat Radar · No CVSS score from NVD or the CNA

EPSS: 1.8% chance of exploitation in 30 days – higher than 78% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in 1.4.0

Exploitation evidence

Disclosed: evidence found.
CVE published 17 Mar 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 31 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

AI-suggested

Red Hat has released an official fix in Cluster Observability Operator version 1.4.0. Users should apply this update after confirming that all previously released relevant errata have been installed. Detailed update instructions are available in the Red Hat advisory and linked documentation. No additional mitigation steps are indicated beyond applying the official update.

Description

Red Hat has released version 1.4.0 of the Cluster Observability Operator (COO) for OpenShift Container Platform, addressing multiple issues including a console crash when displaying alerting rules and various UI and API problems. The update also fixes a race condition related to Prometheus pod creation and rolebinding assignment. This release includes a security advisory identified as CVE-2025-13465, classified as high severity. The advisory recommends applying this update after ensuring all prior relevant errata are installed.

Impact

The vulnerability CVE-2025-13465 is rated high severity, indicating a significant security risk if unpatched. The issues fixed include a console crash and race conditions that could affect the stability and reliability of observability components in OpenShift clusters. These could potentially disrupt monitoring and alerting functions, impacting cluster management and incident response capabilities.

Summary

The Cluster Observability Operator (COO) 1.4.0 release for Red Hat OpenShift Container Platform addresses several bugs and a security vulnerability tracked as CVE-2025-13465. The COO manages observability component stacks via custom resource definitions. Fixes include resolving a console crash on alerting rules display, UI rendering issues, API request failures for alerts, and a race condition in Prometheus pod and rolebinding creation. The security advisory RHSA-2026:4782 provides official guidance and references for applying the update. No known exploits in the wild are reported for this vulnerability.

CWE-1321Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution) (opens in a new tab)
Variant weakness
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
Implementation
By freezing the object prototype first (for example, Object.freeze(Object.prototype)), modification of the prototype becomes impossible.
Architecture and Design
By blocking modifications of attributes that resolve to object prototype, such as proto or prototype, this weakness can be mitigated.
Implementation · Input Validation
When handling untrusted objects, validating using a schema can be used.
OWASP Cheat Sheets
Mass Assignment (opens in a new tab)
OWASP ASVS 4.0.3
V5.1.2 (opens in a new tab)
Attack patterns
Accessing Functionality Not Properly Constrained by ACLs (opens in a new tab)
Exploiting Incorrectly Configured Access Control Security Levels (opens in a new tab)
Manipulating User-Controlled Variables (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Description

AI analysisMachine-generated, updated 1 Nov 2026, 06:50 UTC

Public exploits and detectionGitHub proofs of concept

WeaknessesCWE-1321

Technical details

References

Community reviews

Related threats