CVE-2016-8651
A user, with a copy of the manifest associated with an image, can pull an image even if they do not have access to the image normally, resulting in the disclosure of any information contained within the image.
Does this matter?
Lower severity and a low EPSS score (1.33%). Track it; it rarely justifies an emergency change on its own.
Description
An input validation flaw was found in the way OpenShift 3 handles requests for images. A user, with a copy of the manifest associated with an image, can pull an image even if they do not have access to the image normally, resulting in the disclosure of any information contained within the image.
- CVSS 3.0
- 3.5 LOWCVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- EPSS
- 1.33% probability · 71th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Weakness
- CWE-20
- Affected
- redhat/openshift · redhat/openshift container platform
- Source
- secalert@redhat.com
EPSS 1.3% since 27 October 2026; no change recorded yet. Points are recorded when the score first appears and whenever it moves by a percentage point or more.
References
- http://www.securityfocus.com/bid/94935Third Party Advisory, VDB Entry
- https://access.redhat.com/errata/RHSA-2016:2915Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8651Issue Tracking, Third Party Advisory
- http://www.securityfocus.com/bid/94935Third Party Advisory, VDB Entry
- https://access.redhat.com/errata/RHSA-2016:2915Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8651Issue Tracking, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.