{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright © Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-5807.json"
      }
    ],
    "title": "Vault: Vault: Denial of Service via unauthenticated root token generation or rekey operations",
    "tracking": {
      "current_release_date": "2026-06-30T03:39:27+00:00",
      "generator": {
        "date": "2026-06-30T03:39:27+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.0"
        }
      },
      "id": "CVE-2026-5807",
      "initial_release_date": "2026-04-17T03:22:13.816000+00:00",
      "revision_history": [
        {
          "date": "2026-04-17T03:22:13.816000+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-04-17T22:37:50.666748+00:00",
          "number": "2",
          "summary": "Current version"
        },
        {
          "date": "2026-06-30T03:39:27+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat OpenShift Container Platform 4",
                "product": {
                  "name": "Red Hat OpenShift Container Platform 4",
                  "product_id": "red_hat_openshift_container_platform_4",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:openshift:4"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat OpenShift Container Platform 4"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Openshift Data Foundation 4",
                "product": {
                  "name": "Red Hat Openshift Data Foundation 4",
                  "product_id": "red_hat_openshift_data_foundation_4",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:openshift_data_foundation:4"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Openshift Data Foundation 4"
          },
          {
            "category": "product_version",
            "name": "openshift4/ose-baremetal-installer-rhel9",
            "product": {
              "name": "openshift4/ose-baremetal-installer-rhel9",
              "product_id": "openshift4/ose-baremetal-installer-rhel9",
              "product_identification_helper": {
                "purl": "pkg:oci/ose-baremetal-installer-rhel9?repository_url=registry.redhat.io/openshift4/ose-baremetal-installer-rhel9"
              }
            }
          },
          {
            "category": "product_version",
            "name": "openshift4/ose-installer-rhel9",
            "product": {
              "name": "openshift4/ose-installer-rhel9",
              "product_id": "openshift4/ose-installer-rhel9",
              "product_identification_helper": {
                "purl": "pkg:oci/ose-installer-rhel9?repository_url=registry.redhat.io/openshift4/ose-installer-rhel9"
              }
            }
          },
          {
            "category": "product_version",
            "name": "cephcsi-rhel8.src",
            "product": {
              "name": "cephcsi-rhel8.src",
              "product_id": "cephcsi-rhel8.src",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/odf4/cephcsi-rhel8?arch=src"
              }
            }
          },
          {
            "category": "product_version",
            "name": "cephcsi-rhel9.src",
            "product": {
              "name": "cephcsi-rhel9.src",
              "product_id": "cephcsi-rhel9.src",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/odf4/cephcsi-rhel9?arch=src"
              }
            }
          },
          {
            "category": "product_version",
            "name": "mcg-cli-rhel9.src",
            "product": {
              "name": "mcg-cli-rhel9.src",
              "product_id": "mcg-cli-rhel9.src",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/odf4/mcg-cli-rhel9?arch=src"
              }
            }
          },
          {
            "category": "product_version",
            "name": "mcg-rhel8-operator.src",
            "product": {
              "name": "mcg-rhel8-operator.src",
              "product_id": "mcg-rhel8-operator.src",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/odf4/mcg-rhel8-operator?arch=src"
              }
            }
          },
          {
            "category": "product_version",
            "name": "mcg-rhel9-operator.src",
            "product": {
              "name": "mcg-rhel9-operator.src",
              "product_id": "mcg-rhel9-operator.src",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/odf4/mcg-rhel9-operator?arch=src"
              }
            }
          },
          {
            "category": "product_version",
            "name": "ocs4/cephcsi-rhel8",
            "product": {
              "name": "ocs4/cephcsi-rhel8",
              "product_id": "ocs4/cephcsi-rhel8",
              "product_identification_helper": {
                "purl": "pkg:oci/cephcsi-rhel8?repository_url=registry.redhat.io/ocs4/cephcsi-rhel8"
              }
            }
          },
          {
            "category": "product_version",
            "name": "odf4/cephcsi-rhel8",
            "product": {
              "name": "odf4/cephcsi-rhel8",
              "product_id": "odf4/cephcsi-rhel8",
              "product_identification_helper": {
                "purl": "pkg:oci/cephcsi-rhel8?repository_url=registry.redhat.io/odf4/cephcsi-rhel8"
              }
            }
          },
          {
            "category": "product_version",
            "name": "odf4/cephcsi-rhel9",
            "product": {
              "name": "odf4/cephcsi-rhel9",
              "product_id": "odf4/cephcsi-rhel9",
              "product_identification_helper": {
                "purl": "pkg:oci/cephcsi-rhel9?repository_url=registry.redhat.io/odf4/cephcsi-rhel9"
              }
            }
          },
          {
            "category": "product_version",
            "name": "odf4/mcg-cli-rhel9",
            "product": {
              "name": "odf4/mcg-cli-rhel9",
              "product_id": "odf4/mcg-cli-rhel9",
              "product_identification_helper": {
                "purl": "pkg:oci/mcg-cli-rhel9?repository_url=registry.redhat.io/odf4/mcg-cli-rhel9"
              }
            }
          },
          {
            "category": "product_version",
            "name": "odf4/mcg-rhel8-operator",
            "product": {
              "name": "odf4/mcg-rhel8-operator",
              "product_id": "odf4/mcg-rhel8-operator",
              "product_identification_helper": {
                "purl": "pkg:oci/mcg-rhel8-operator?repository_url=registry.redhat.io/odf4/mcg-rhel8-operator"
              }
            }
          },
          {
            "category": "product_version",
            "name": "odf4/mcg-rhel9-operator",
            "product": {
              "name": "odf4/mcg-rhel9-operator",
              "product_id": "odf4/mcg-rhel9-operator",
              "product_identification_helper": {
                "purl": "pkg:oci/mcg-rhel9-operator?repository_url=registry.redhat.io/odf4/mcg-rhel9-operator"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift4/ose-baremetal-installer-rhel9 as a component of Red Hat OpenShift Container Platform 4",
          "product_id": "red_hat_openshift_container_platform_4:openshift4/ose-baremetal-installer-rhel9"
        },
        "product_reference": "openshift4/ose-baremetal-installer-rhel9",
        "relates_to_product_reference": "red_hat_openshift_container_platform_4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift4/ose-installer-rhel9 as a component of Red Hat OpenShift Container Platform 4",
          "product_id": "red_hat_openshift_container_platform_4:openshift4/ose-installer-rhel9"
        },
        "product_reference": "openshift4/ose-installer-rhel9",
        "relates_to_product_reference": "red_hat_openshift_container_platform_4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cephcsi-rhel8.src as a component of Red Hat Openshift Data Foundation 4",
          "product_id": "red_hat_openshift_data_foundation_4:cephcsi-rhel8.src"
        },
        "product_reference": "cephcsi-rhel8.src",
        "relates_to_product_reference": "red_hat_openshift_data_foundation_4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cephcsi-rhel9.src as a component of Red Hat Openshift Data Foundation 4",
          "product_id": "red_hat_openshift_data_foundation_4:cephcsi-rhel9.src"
        },
        "product_reference": "cephcsi-rhel9.src",
        "relates_to_product_reference": "red_hat_openshift_data_foundation_4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mcg-cli-rhel9.src as a component of Red Hat Openshift Data Foundation 4",
          "product_id": "red_hat_openshift_data_foundation_4:mcg-cli-rhel9.src"
        },
        "product_reference": "mcg-cli-rhel9.src",
        "relates_to_product_reference": "red_hat_openshift_data_foundation_4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mcg-rhel8-operator.src as a component of Red Hat Openshift Data Foundation 4",
          "product_id": "red_hat_openshift_data_foundation_4:mcg-rhel8-operator.src"
        },
        "product_reference": "mcg-rhel8-operator.src",
        "relates_to_product_reference": "red_hat_openshift_data_foundation_4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mcg-rhel9-operator.src as a component of Red Hat Openshift Data Foundation 4",
          "product_id": "red_hat_openshift_data_foundation_4:mcg-rhel9-operator.src"
        },
        "product_reference": "mcg-rhel9-operator.src",
        "relates_to_product_reference": "red_hat_openshift_data_foundation_4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ocs4/cephcsi-rhel8 as a component of Red Hat Openshift Data Foundation 4",
          "product_id": "red_hat_openshift_data_foundation_4:ocs4/cephcsi-rhel8"
        },
        "product_reference": "ocs4/cephcsi-rhel8",
        "relates_to_product_reference": "red_hat_openshift_data_foundation_4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "odf4/cephcsi-rhel8 as a component of Red Hat Openshift Data Foundation 4",
          "product_id": "red_hat_openshift_data_foundation_4:odf4/cephcsi-rhel8"
        },
        "product_reference": "odf4/cephcsi-rhel8",
        "relates_to_product_reference": "red_hat_openshift_data_foundation_4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "odf4/cephcsi-rhel9 as a component of Red Hat Openshift Data Foundation 4",
          "product_id": "red_hat_openshift_data_foundation_4:odf4/cephcsi-rhel9"
        },
        "product_reference": "odf4/cephcsi-rhel9",
        "relates_to_product_reference": "red_hat_openshift_data_foundation_4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "odf4/mcg-cli-rhel9 as a component of Red Hat Openshift Data Foundation 4",
          "product_id": "red_hat_openshift_data_foundation_4:odf4/mcg-cli-rhel9"
        },
        "product_reference": "odf4/mcg-cli-rhel9",
        "relates_to_product_reference": "red_hat_openshift_data_foundation_4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "odf4/mcg-rhel8-operator as a component of Red Hat Openshift Data Foundation 4",
          "product_id": "red_hat_openshift_data_foundation_4:odf4/mcg-rhel8-operator"
        },
        "product_reference": "odf4/mcg-rhel8-operator",
        "relates_to_product_reference": "red_hat_openshift_data_foundation_4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "odf4/mcg-rhel9-operator as a component of Red Hat Openshift Data Foundation 4",
          "product_id": "red_hat_openshift_data_foundation_4:odf4/mcg-rhel9-operator"
        },
        "product_reference": "odf4/mcg-rhel9-operator",
        "relates_to_product_reference": "red_hat_openshift_data_foundation_4"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-5807",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-04-17T05:00:53.880683+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "red_hat_openshift_container_platform_4:openshift4/ose-baremetal-installer-rhel9",
            "red_hat_openshift_container_platform_4:openshift4/ose-installer-rhel9"
          ]
        },
        {
          "label": "vulnerable_code_not_in_execute_path",
          "product_ids": [
            "red_hat_openshift_data_foundation_4:cephcsi-rhel8.src",
            "red_hat_openshift_data_foundation_4:cephcsi-rhel9.src",
            "red_hat_openshift_data_foundation_4:ocs4/cephcsi-rhel8",
            "red_hat_openshift_data_foundation_4:odf4/cephcsi-rhel8",
            "red_hat_openshift_data_foundation_4:odf4/cephcsi-rhel9"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2459109"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Vault. An unauthenticated attacker can repeatedly initiate or cancel root token generation or rekey operations. This action occupies the single slot designated for in-progress operations, effectively preventing legitimate operators from completing critical administrative workflows. This vulnerability leads to a denial-of-service condition, impacting the availability of Vault's key management functions.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Vault: Vault: Denial of Service via unauthenticated root token generation or rekey operations",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "known_affected": [
          "red_hat_openshift_data_foundation_4:mcg-cli-rhel9.src",
          "red_hat_openshift_data_foundation_4:mcg-rhel8-operator.src",
          "red_hat_openshift_data_foundation_4:mcg-rhel9-operator.src",
          "red_hat_openshift_data_foundation_4:odf4/mcg-cli-rhel9",
          "red_hat_openshift_data_foundation_4:odf4/mcg-rhel8-operator",
          "red_hat_openshift_data_foundation_4:odf4/mcg-rhel9-operator"
        ],
        "known_not_affected": [
          "red_hat_openshift_container_platform_4:openshift4/ose-baremetal-installer-rhel9",
          "red_hat_openshift_container_platform_4:openshift4/ose-installer-rhel9",
          "red_hat_openshift_data_foundation_4:cephcsi-rhel8.src",
          "red_hat_openshift_data_foundation_4:cephcsi-rhel9.src",
          "red_hat_openshift_data_foundation_4:ocs4/cephcsi-rhel8",
          "red_hat_openshift_data_foundation_4:odf4/cephcsi-rhel8",
          "red_hat_openshift_data_foundation_4:odf4/cephcsi-rhel9"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-5807"
        },
        {
          "category": "external",
          "summary": "RHBZ#2459109",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2459109"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-5807",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-5807"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-5807",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5807"
        },
        {
          "category": "external",
          "summary": "https://discuss.hashicorp.com/t/hcsec-2026-08-vault-vulnerable-to-denial-of-service-via-unauthenticated-root-token-generation-rekey-operations/77345",
          "url": "https://discuss.hashicorp.com/t/hcsec-2026-08-vault-vulnerable-to-denial-of-service-via-unauthenticated-root-token-generation-rekey-operations/77345"
        }
      ],
      "release_date": "2026-04-17T03:22:13.816000+00:00",
      "remediations": [
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "red_hat_openshift_data_foundation_4:mcg-cli-rhel9.src",
            "red_hat_openshift_data_foundation_4:mcg-rhel8-operator.src",
            "red_hat_openshift_data_foundation_4:mcg-rhel9-operator.src",
            "red_hat_openshift_data_foundation_4:odf4/mcg-cli-rhel9",
            "red_hat_openshift_data_foundation_4:odf4/mcg-rhel8-operator",
            "red_hat_openshift_data_foundation_4:odf4/mcg-rhel9-operator"
          ]
        },
        {
          "category": "none_available",
          "details": "Affected",
          "product_ids": [
            "red_hat_openshift_data_foundation_4:mcg-cli-rhel9.src",
            "red_hat_openshift_data_foundation_4:mcg-rhel8-operator.src",
            "red_hat_openshift_data_foundation_4:mcg-rhel9-operator.src",
            "red_hat_openshift_data_foundation_4:odf4/mcg-cli-rhel9",
            "red_hat_openshift_data_foundation_4:odf4/mcg-rhel8-operator",
            "red_hat_openshift_data_foundation_4:odf4/mcg-rhel9-operator"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "red_hat_openshift_container_platform_4:openshift4/ose-baremetal-installer-rhel9",
            "red_hat_openshift_container_platform_4:openshift4/ose-installer-rhel9",
            "red_hat_openshift_data_foundation_4:cephcsi-rhel8.src",
            "red_hat_openshift_data_foundation_4:cephcsi-rhel9.src",
            "red_hat_openshift_data_foundation_4:mcg-cli-rhel9.src",
            "red_hat_openshift_data_foundation_4:mcg-rhel8-operator.src",
            "red_hat_openshift_data_foundation_4:mcg-rhel9-operator.src",
            "red_hat_openshift_data_foundation_4:ocs4/cephcsi-rhel8",
            "red_hat_openshift_data_foundation_4:odf4/cephcsi-rhel8",
            "red_hat_openshift_data_foundation_4:odf4/cephcsi-rhel9",
            "red_hat_openshift_data_foundation_4:odf4/mcg-cli-rhel9",
            "red_hat_openshift_data_foundation_4:odf4/mcg-rhel8-operator",
            "red_hat_openshift_data_foundation_4:odf4/mcg-rhel9-operator"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important",
          "product_ids": [
            "red_hat_openshift_container_platform_4:openshift4/ose-baremetal-installer-rhel9",
            "red_hat_openshift_container_platform_4:openshift4/ose-installer-rhel9",
            "red_hat_openshift_data_foundation_4:cephcsi-rhel8.src",
            "red_hat_openshift_data_foundation_4:cephcsi-rhel9.src",
            "red_hat_openshift_data_foundation_4:mcg-cli-rhel9.src",
            "red_hat_openshift_data_foundation_4:mcg-rhel8-operator.src",
            "red_hat_openshift_data_foundation_4:mcg-rhel9-operator.src",
            "red_hat_openshift_data_foundation_4:ocs4/cephcsi-rhel8",
            "red_hat_openshift_data_foundation_4:odf4/cephcsi-rhel8",
            "red_hat_openshift_data_foundation_4:odf4/cephcsi-rhel9",
            "red_hat_openshift_data_foundation_4:odf4/mcg-cli-rhel9",
            "red_hat_openshift_data_foundation_4:odf4/mcg-rhel8-operator",
            "red_hat_openshift_data_foundation_4:odf4/mcg-rhel9-operator"
          ]
        }
      ],
      "title": "Vault: Vault: Denial of Service via unauthenticated root token generation or rekey operations"
    }
  ]
}