PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-14243 Red Hat CVE debrief

A vulnerability was found in the OpenShift Mirror Registry. This flaw allows an unauthenticated, remote attacker to enumerate valid usernames and email addresses via different error messages during authentication failures and account creation. The vulnerability is classified under CWE-209 and has a CVSS score of 5.3, categorized as MEDIUM severity.

Vendor
Red Hat
Product
mirror registry for Red Hat OpenShift
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-08
Original CVE updated
2026-07-25
Advisory published
2026-04-08
Advisory updated
2026-07-25

Who should care

Users of OpenShift Mirror Registry for Red Hat OpenShift should be aware of this vulnerability and take necessary actions to mitigate the risk. This includes reviewing and updating to the latest version, implementing additional security measures, and monitoring authentication logs for suspicious activity.

Technical summary

The OpenShift Mirror Registry is vulnerable to an enumeration attack. An unauthenticated, remote attacker can exploit this vulnerability by sending authentication requests and analyzing error messages to determine valid usernames and email addresses. This issue is related to CWE-209 and has been assigned a CVSS score of 5.3. Affected product deployments should be reviewed for exposure, and owners should be assigned for follow-up. The vulnerability can be mitigated by reviewing and updating to the latest version, implementing additional security measures, and monitoring authentication logs for suspicious activity. OpenShift Mirror Registry users for Red Hat OpenShift should consider implementing rate limiting on authentication requests and perform vulnerability scanning and asset inventory to identify exposed systems.

Defensive priority

Medium priority due to the potential for enumeration attacks.

Recommended defensive actions

  • Review and update OpenShift Mirror Registry to the latest version
  • Implement additional security measures to prevent enumeration attacks
  • Monitor authentication logs for suspicious activity
  • Consider implementing rate limiting on authentication requests
  • Perform vulnerability scanning and asset inventory to identify exposed systems
  • Develop a remediation plan and track exceptions for exposed assets
  • Verify the effectiveness of compensating controls for exposed systems

Evidence notes

The CVE record was published on 2026-04-08T17:20:25.247Z and last modified on 2026-07-25T10:10:00.167Z. The NVD entry is currently Analyzed. This vulnerability affects OpenShift Mirror Registry, allowing unauthenticated remote attackers to enumerate valid usernames and email addresses. Evidence is based on CVE.org and NVD details.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-04-08T17:20:25.247Z and has not been modified since then. The NVD entry is currently Analyzed.