The vulnerability in OpenSift allows clients to receive raw exception strings from certain endpoints and to view login token material through the UI and token rotation responses. This exposure reveals implementation details and authentication tokens, which could be used by an attacker to gain sensitive information about the system configuration.

OpenSift prior to version 1.6.3‑alpha. All deployments that have the default configuration exposing raw exception messages and token payloads are affected. The vulnerability is limited to OpenSift products; no other vendors are impacted at this time.

The CVSS base score of 5.3 and EPSS below 1% indicate a moderate likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, attackers who can send requests to the affected API endpoints may trigger unhandled exceptions, causing raw exception strings to be returned, and they may also retrieve login token material from the UI and token rotation responses. The exposure enables an attacker to gather sensitive implementation details and user authentication tokens. The risk is elevated when the vulnerable endpoints are accessible over the network, though the description does not specify authentication requirements. No privileged local access is required to exploit the disclosed information.