RHSA-2025:21146HighCVSS 8.8

Red Hat Security Advisory: Cluster Observability Operator 1.3.0

Published
November 12, 2025
Last Modified
August 22, 2026

🔗 CVE IDs covered (2)

CVE-2025-2843 →CVE-2025-7783 →

📋 Description

CVE-2025-2843 — observability-operator: Observability Operator privilege escalation CVE-2025-7783 — form-data: Unsafe random function in form-data

🎯 Affected products82

  • Cluster Observability Operator 1.3.1
  • registry.redhat.io/cluster-observability-operator/alertmanager-rhel9@sha256:0bd5b053ab1f18e96ec4cea0a3fd2dc5d34d8d7cf2f092d4aafa2d00c37d1ddc_arm64 as a component of Cluster Observability Operator 1.3.1
  • registry.redhat.io/cluster-observability-operator/alertmanager-rhel9@sha256:570b02fe7fcca69b8a7d89ae6c56d4b553d6275e7f9c6de0ff236ccf3e021ad2_s390x as a component of Cluster Observability Operator 1.3.1
  • registry.redhat.io/cluster-observability-operator/alertmanager-rhel9@sha256:b74309ee51bc7a94f3a573b5063c4b997c3b89723588cdb4ac141cea42630715_ppc64le as a component of Cluster Observability Operator 1.3.1
  • registry.redhat.io/cluster-observability-operator/alertmanager-rhel9@sha256:e648f9620cf9652fa3cb0672c03979f6bcc872047c86e7b811607929ae5aee37_amd64 as a component of Cluster Observability Operator 1.3.1
  • registry.redhat.io/cluster-observability-operator/cluster-health-analyzer-rhel9@sha256:27f7c0df02f09e3c58735ba811b539b89143f6e743d65fafeda13e45dbc9db22_arm64 as a component of Cluster Observability Operator 1.3.1
  • registry.redhat.io/cluster-observability-operator/cluster-health-analyzer-rhel9@sha256:9f873e05d6829073f36636417671ea20b98a272c0242610e3b9113f635bf598d_s390x as a component of Cluster Observability Operator 1.3.1
  • registry.redhat.io/cluster-observability-operator/cluster-health-analyzer-rhel9@sha256:eb4e1ce2205db323479c81351c6682b1a7fb6202051f87d22894c92da8c9d48e_amd64 as a component of Cluster Observability Operator 1.3.1
  • registry.redhat.io/cluster-observability-operator/cluster-health-analyzer-rhel9@sha256:fd0910201e8e02d2896930dfda07ba52840601fccd764593a5c7fc71830e9ff8_ppc64le as a component of Cluster Observability Operator 1.3.1
  • registry.redhat.io/cluster-observability-operator/cluster-observability-operator-bundle@sha256:04d900c45998f21ccf96af1ba6b8c7485d13c676ca365d70b491f7dcc48974ac_amd64 as a component of Cluster Observability Operator 1.3.1
  • registry.redhat.io/cluster-observability-operator/cluster-observability-rhel9-operator@sha256:72399f92466171b1603b16e0a25325269eb95c19bf98188ad8c61d268788a327_ppc64le as a component of Cluster Observability Operator 1.3.1
  • registry.redhat.io/cluster-observability-operator/cluster-observability-rhel9-operator@sha256:84a281b3cd370cd42b89489c770f8b31d13e9aa570dc1b6cda6042bfba4824f8_arm64 as a component of Cluster Observability Operator 1.3.1
  • registry.redhat.io/cluster-observability-operator/cluster-observability-rhel9-operator@sha256:8f98a4af8900a3b9437177b792d582e842172b25dfdd29c6d8393dd1277bc2d5_s390x as a component of Cluster Observability Operator 1.3.1
  • registry.redhat.io/cluster-observability-operator/cluster-observability-rhel9-operator@sha256:efff0f5b6835286172ae99dd368dcc48aca98398c382cb4c38d02533afee8670_amd64 as a component of Cluster Observability Operator 1.3.1
  • registry.redhat.io/cluster-observability-operator/dashboards-console-plugin-rhel9@sha256:411c54955d0a8f7efe7ed944ca7d4734ec23e584b72ca05ee9f12162b59b2e78_ppc64le as a component of Cluster Observability Operator 1.3.1
  • registry.redhat.io/cluster-observability-operator/dashboards-console-plugin-rhel9@sha256:64811a050d2949323a06d434a2c667bb2717f883e0464d6d1f11f52d5f900679_s390x as a component of Cluster Observability Operator 1.3.1
  • registry.redhat.io/cluster-observability-operator/dashboards-console-plugin-rhel9@sha256:78c04e2ea2703383356315c57a49154dae7c7474ae30138c9a153ee7d862d11a_amd64 as a component of Cluster Observability Operator 1.3.1
  • registry.redhat.io/cluster-observability-operator/dashboards-console-plugin-rhel9@sha256:afd6baccf283135fd0fb35d93f85b7322c837434b3ea360a122ea81df95757f4_arm64 as a component of Cluster Observability Operator 1.3.1
  • registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9@sha256:0fcf36560b3c599f95ac1448f5579fb92f2b6e947ce1dd39920fb5097ccf253d_amd64 as a component of Cluster Observability Operator 1.3.1
  • registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9@sha256:17568d9818aa03be18e9dc6ae805f56fe37da70c410e938fad7b8b01d4fb25d1_arm64 as a component of Cluster Observability Operator 1.3.1
  • registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9@sha256:5e592c944a3ade66da76d08eaabfe984df5ae7c80752d83482baa4b5a42cb787_s390x as a component of Cluster Observability Operator 1.3.1
  • registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9@sha256:c6673c9227515f0224fdc255efed8c3e8fec9cf59177079a6f446d3c75bbffe1_ppc64le as a component of Cluster Observability Operator 1.3.1
  • registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf5-rhel9@sha256:22a667673c70a98e121ed9a02087815e2f30d28265ff457bad90a2afaee6fb0f_amd64 as a component of Cluster Observability Operator 1.3.1
  • registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf5-rhel9@sha256:864902d6c50afcce1579522620b1048b0f5c2d97da759c4ba70716fc57f90fae_ppc64le as a component of Cluster Observability Operator 1.3.1
  • registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf5-rhel9@sha256:9ed86bbd21a9cffa8aba1104476bec43084ccfa6357057163d6117a59591d545_arm64 as a component of Cluster Observability Operator 1.3.1
  • registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf5-rhel9@sha256:b96de86604e936daecfa1e9763fe41866f816a9fd1742d8619e8a8082827a3f2_s390x as a component of Cluster Observability Operator 1.3.1
  • registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-rhel9@sha256:10edfcd2d3188c2878e45ac04095eda642bc212ed91ac7a0b3890e9939fa38a6_amd64 as a component of Cluster Observability Operator 1.3.1
  • registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-rhel9@sha256:2b9005684195e96a99777918a5d84061cdcb077b319705ab0a0632e3d9f35f00_s390x as a component of Cluster Observability Operator 1.3.1
  • registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-rhel9@sha256:9176834f5c90959faeb24bb669c28897c05a3a399812e5273a4943999e311a01_ppc64le as a component of Cluster Observability Operator 1.3.1
  • registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-rhel9@sha256:cbb95a8f485949a96922963ebf6b93945b1f727ca722df41733c3b225723a988_arm64 as a component of Cluster Observability Operator 1.3.1
  • +52 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Currently, no mitigation is available for this vulnerability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (7)