The metrics-server package version 0.8.1-r5 includes fixes for six security vulnerabilities, including CVE-2026-42154, CVE-2026-42151, CVE-2026-44431, CVE-2026-44432, CVE-2026-48990, and CVE-2026-45409. These vulnerabilities correspond to CWEs such as CWE-256 (Plaintext Storage of a Password), CWE-770 (Allocation of Resources Without Limits or Throttling), CWE-201 (Information Exposure), CWE-409 (Improper Resource Shutdown or Release), and CWE-915 (Improperly Controlled Modification of Object Prototype Attributes). The affected versions span multiple version ranges of metrics-server and related Red Hat Hardened Images RPMs. Red Hat has published security advisories RHSA-2026:25039 and RHSA-2026:25245 detailing the fixes and providing updated RPM packages. Patch availability is confirmed, and no known exploits are reported in the wild.

The vulnerabilities fixed in metrics-server 0.8.1-r5 and related Red Hat Hardened Images RPMs are rated as high severity. They potentially allow attackers to exploit issues such as improper credential storage, resource exhaustion, information leakage, and improper resource handling. These could lead to unauthorized access, denial of service, or information disclosure in affected environments. However, no active exploitation has been reported to date.

An official fix is available in metrics-server version 0.8.1-r5 and corresponding updated Red Hat Hardened Images RPMs as detailed in Red Hat advisories RHSA-2026:25039 and RHSA-2026:25245. Users should apply these updates promptly to remediate the vulnerabilities. No additional mitigation steps are indicated by the vendor advisories.