CVE-2024-5037 Openshift/telemeter: iss check during jwt authentication can be bypassed

High 7.5 Published 5 Jun 2024 Updated 30 Apr 2026

Attackers can bypass JWT issuer checks using forged tokens in OpenShift Telemeter under specific conditions, compromising authentication integrity.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2024-5037?

CVE-2024-5037 is a high-severity authentication bypass vulnerability in Redhat Openshift Container Platform, published on 5 Jun 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A flaw was found in OpenShift's Telemeter. If certain conditions are in place, an attacker can use a forged token to bypass the issue ("iss") check during JSON web token (JWT) authentication.

Weakness: CWE-290

Which versions are affected by CVE-2024-5037?

1 open source package ship an affected version, including github.com/openshift/telemeter. It affects 2 products.

Package	Affected	Fixed in
`github.com/openshift/telemeter` Go	All versions	None

Products include Redhat Openshift Container Platform, Redhat Openshift Distributed Tracing.

How do I fix CVE-2024-5037?

No fix has been published for CVE-2024-5037 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2024-5037 being exploited?

There is no known exploitation of CVE-2024-5037 in the wild and no public exploit code.

All Redhat Openshift Container Platform vulnerabilities

Sources

Also known as GHSA-gc8r-pxj9-hhx3, GO-2024-2905.