{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "title": "HTTP InputSource allows authenticated users to read data from other sources",
    "tracking": {
      "current_release_date": "2026-08-11T14:54:30+00:00",
      "generator": {
        "date": "2026-08-11T14:54:30+00:00",
        "engine": {
          "name": "CSAF Generator",
          "version": "3.3.0"
        }
      },
      "id": "CVE-2021-26920",
      "initial_release_date": "2021-07-02T00:00:00+00:00",
      "revision_history": [
        {
          "date": "2026-08-11T14:54:30+00:00",
          "number": "1",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "category": "vendor",
        "name": "Red Hat",
        "branches": [
          {
            "category": "product_name",
            "name": "OpenShift Container Platform 4.12",
            "product": {
              "name": "OpenShift Container Platform 4.12",
              "product_id": "openshift-4.12.z",
              "product_identification_helper": {
                "cpe": "cpe:/a:redhat:openshift:4.12"
              }
            }
          },
          {
            "category": "product_name",
            "name": "OpenShift Container Platform 4.13",
            "product": {
              "name": "OpenShift Container Platform 4.13",
              "product_id": "openshift-4.13.z",
              "product_identification_helper": {
                "cpe": "cpe:/a:redhat:openshift:4.13"
              }
            }
          },
          {
            "category": "product_name",
            "name": "OpenShift Container Platform 4.14",
            "product": {
              "name": "OpenShift Container Platform 4.14",
              "product_id": "openshift-4.14.z",
              "product_identification_helper": {
                "cpe": "cpe:/a:redhat:openshift:4.14"
              }
            }
          },
          {
            "category": "product_name",
            "name": "OpenShift Container Platform 4.15.z",
            "product": {
              "name": "OpenShift Container Platform 4.15.z",
              "product_id": "openshift-4.15.z",
              "product_identification_helper": {
                "cpe": "cpe:/a:redhat:openshift:4.15"
              }
            }
          },
          {
            "category": "product_name",
            "name": "OpenShift Container Platform 4.16.z",
            "product": {
              "name": "OpenShift Container Platform 4.16.z",
              "product_id": "openshift-4.16.z",
              "product_identification_helper": {
                "cpe": "cpe:/a:redhat:openshift:4.16"
              }
            }
          },
          {
            "category": "product_name",
            "name": "OpenShift Container Platform 4.17",
            "product": {
              "name": "OpenShift Container Platform 4.17",
              "product_id": "openshift-4.17",
              "product_identification_helper": {
                "cpe": "cpe:/a:redhat:openshift:4.17"
              }
            }
          },
          {
            "category": "product_name",
            "name": "OpenShift Container Platform 4.18",
            "product": {
              "name": "OpenShift Container Platform 4.18",
              "product_id": "openshift-4.18",
              "product_identification_helper": {
                "cpe": "cpe:/a:redhat:openshift:4.18"
              }
            }
          },
          {
            "category": "product_name",
            "name": "OpenShift Container Platform 4.19",
            "product": {
              "name": "OpenShift Container Platform 4.19",
              "product_id": "openshift-4.19",
              "product_identification_helper": {
                "cpe": "cpe:/a:redhat:openshift:4.19"
              }
            }
          },
          {
            "category": "product_name",
            "name": "OpenShift Container Platform 4.20",
            "product": {
              "name": "OpenShift Container Platform 4.20",
              "product_id": "openshift-4.20",
              "product_identification_helper": {
                "cpe": "cpe:/a:redhat:openshift:4.20"
              }
            }
          },
          {
            "category": "product_version",
            "name": "openshift4/ose-metering-hive",
            "product": {
              "name": "openshift4/ose-metering-hive",
              "product_id": "openshift4/ose-metering-hive",
              "product_identification_helper": {
                "purl": "pkg:oci/ose-metering-hive?repository_url=registry.redhat.io/openshift4/ose-metering-hive"
              }
            }
          }
        ]
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift4/ose-metering-hive as a component of OpenShift Container Platform 4.16.z",
          "product_id": "openshift-4.16.z:openshift4/ose-metering-hive"
        },
        "product_reference": "openshift4/ose-metering-hive",
        "relates_to_product_reference": "openshift-4.16.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift4/ose-metering-hive as a component of OpenShift Container Platform 4.19",
          "product_id": "openshift-4.19:openshift4/ose-metering-hive"
        },
        "product_reference": "openshift4/ose-metering-hive",
        "relates_to_product_reference": "openshift-4.19"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift4/ose-metering-hive as a component of OpenShift Container Platform 4.17",
          "product_id": "openshift-4.17:openshift4/ose-metering-hive"
        },
        "product_reference": "openshift4/ose-metering-hive",
        "relates_to_product_reference": "openshift-4.17"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift4/ose-metering-hive as a component of OpenShift Container Platform 4.14",
          "product_id": "openshift-4.14.z:openshift4/ose-metering-hive"
        },
        "product_reference": "openshift4/ose-metering-hive",
        "relates_to_product_reference": "openshift-4.14.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift4/ose-metering-hive as a component of OpenShift Container Platform 4.15.z",
          "product_id": "openshift-4.15.z:openshift4/ose-metering-hive"
        },
        "product_reference": "openshift4/ose-metering-hive",
        "relates_to_product_reference": "openshift-4.15.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift4/ose-metering-hive as a component of OpenShift Container Platform 4.13",
          "product_id": "openshift-4.13.z:openshift4/ose-metering-hive"
        },
        "product_reference": "openshift4/ose-metering-hive",
        "relates_to_product_reference": "openshift-4.13.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift4/ose-metering-hive as a component of OpenShift Container Platform 4.20",
          "product_id": "openshift-4.20:openshift4/ose-metering-hive"
        },
        "product_reference": "openshift4/ose-metering-hive",
        "relates_to_product_reference": "openshift-4.20"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift4/ose-metering-hive as a component of OpenShift Container Platform 4.12",
          "product_id": "openshift-4.12.z:openshift4/ose-metering-hive"
        },
        "product_reference": "openshift4/ose-metering-hive",
        "relates_to_product_reference": "openshift-4.12.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift4/ose-metering-hive as a component of OpenShift Container Platform 4.18",
          "product_id": "openshift-4.18:openshift4/ose-metering-hive"
        },
        "product_reference": "openshift4/ose-metering-hive",
        "relates_to_product_reference": "openshift-4.18"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2021-26920",
      "cwe": {
        "id": "CWE-200",
        "name": "Exposure of Sensitive Information to an Unauthorized Actor"
      },
      "discovery_date": "2021-07-06T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "openshift-4.12.z:openshift4/ose-metering-hive",
            "openshift-4.13.z:openshift4/ose-metering-hive",
            "openshift-4.14.z:openshift4/ose-metering-hive",
            "openshift-4.15.z:openshift4/ose-metering-hive",
            "openshift-4.16.z:openshift4/ose-metering-hive",
            "openshift-4.17:openshift4/ose-metering-hive",
            "openshift-4.18:openshift4/ose-metering-hive",
            "openshift-4.19:openshift4/ose-metering-hive",
            "openshift-4.20:openshift4/ose-metering-hive"
          ]
        }
      ],
      "notes": [
        {
          "category": "other",
          "text": "OpenShift Container Platform (OCP) shipped Druid in the ose-metering-hive container, however InputSources such as HTTP and HDFS are not included, hence OCP is not affected by this vulnerability.",
          "title": "Statement"
        },
        {
          "category": "description",
          "text": "A flaw was found in druid. The HTTP InputSource allows authenticated users to read data from other sources than intended, such as the local file system, with the privileges of the druid server process. The highest threat from this vulnerability is to data confidentiality.",
          "title": "Vulnerability description"
        }
      ],
      "product_status": {
        "known_not_affected": [
          "openshift-4.12.z:openshift4/ose-metering-hive",
          "openshift-4.13.z:openshift4/ose-metering-hive",
          "openshift-4.14.z:openshift4/ose-metering-hive",
          "openshift-4.15.z:openshift4/ose-metering-hive",
          "openshift-4.16.z:openshift4/ose-metering-hive",
          "openshift-4.17:openshift4/ose-metering-hive",
          "openshift-4.18:openshift4/ose-metering-hive",
          "openshift-4.19:openshift4/ose-metering-hive",
          "openshift-4.20:openshift4/ose-metering-hive"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-26920"
        },
        {
          "category": "external",
          "summary": "nvd.nist.gov",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-26920"
        },
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-26920"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "version": "3.1",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM"
          },
          "products": [
            "openshift-4.12.z:openshift4/ose-metering-hive",
            "openshift-4.13.z:openshift4/ose-metering-hive",
            "openshift-4.14.z:openshift4/ose-metering-hive",
            "openshift-4.15.z:openshift4/ose-metering-hive",
            "openshift-4.16.z:openshift4/ose-metering-hive",
            "openshift-4.17:openshift4/ose-metering-hive",
            "openshift-4.18:openshift4/ose-metering-hive",
            "openshift-4.19:openshift4/ose-metering-hive",
            "openshift-4.20:openshift4/ose-metering-hive"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate",
          "product_ids": [
            "openshift-4.12.z:openshift4/ose-metering-hive",
            "openshift-4.13.z:openshift4/ose-metering-hive",
            "openshift-4.14.z:openshift4/ose-metering-hive",
            "openshift-4.15.z:openshift4/ose-metering-hive",
            "openshift-4.16.z:openshift4/ose-metering-hive",
            "openshift-4.17:openshift4/ose-metering-hive",
            "openshift-4.18:openshift4/ose-metering-hive",
            "openshift-4.19:openshift4/ose-metering-hive",
            "openshift-4.20:openshift4/ose-metering-hive"
          ]
        }
      ],
      "title": "HTTP InputSource allows authenticated users to read data from other sources"
    }
  ]
}