Red Hat Linux OS and other open source products
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in any Red Hat product.
RSS Feeds for Red Hat security vulnerabilities
Create a CVE RSS feed including security vulnerabilities found in Red Hat products with stack.watch. Just hit watch, then grab your custom RSS feed url.
Products by Red Hat Sorted by Most Security Vulnerabilities since 2018
Red Hat Enterprise Linux Server1534 vulnerabilities
RedHat Enterprise Linux (RHEL) Server. Includes software bundeled with RHEL server.
Red Hat Enterprise Linux Workstation1504 vulnerabilities
RedHat Enterprise Linux (RHEL) Workstation. Includes software bundled with RHEL Workstation.
Red Hat Enterprise Linux Desktop1493 vulnerabilities
RedHat Enterprise Linux (RHEL) Desktop. Includes software bundled with RHEL desktop
Recent Red Hat Security Advisories
| Advisory | Title | Published |
|---|---|---|
| RHSA-2026:83427 | (RHSA-2026:83427) Red Hat Hardened Images RPMs bug fix and enhancement update | October 15, 2026 |
| RHSA-2026:83670 | (RHSA-2026:83670) Important: Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 update is now available (RHBQ 3.33.4.GA) | October 15, 2026 |
| RHSA-2026:83663 | (RHSA-2026:83663) MTV RHEL9 Images | October 15, 2026 |
| RHSA-2026:83662 | (RHSA-2026:83662) MTV RHEL9 Images | October 15, 2026 |
| RHSA-2026:83657 | (RHSA-2026:83657) Moderate: wireshark security update | October 15, 2026 |
| RHSA-2026:83520 | (RHSA-2026:83520) Important: Red Hat build of Quarkus 3.33.4 release and security update | October 15, 2026 |
| RHSA-2026:77611 | (RHSA-2026:77611) Important: OpenShift Container Platform 4.16.73 packages and security update | October 15, 2026 |
| RHSA-2026:77612 | (RHSA-2026:77612) Important: OpenShift Container Platform 4.16.73 bug fix and security update | October 15, 2026 |
| RHSA-2026:77547 | (RHSA-2026:77547) Important: OpenShift Container Platform 4.17.59 packages and security update | October 15, 2026 |
| RHSA-2026:77548 | (RHSA-2026:77548) Important: OpenShift Container Platform 4.17.59 bug fix and security update | October 15, 2026 |
By the Year
In 2026 there have been 4497 vulnerabilities in Red Hat with an average score of 7.3 out of ten. Last year, in 2025 Red Hat had 1196 security vulnerabilities published. That is, 3301 more vulnerabilities have already been reported in 2026 as compared to last year. However, the average CVE base score of the vulnerabilities in 2026 is greater by 0.43.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 4497 | 7.30 |
| 2025 | 1196 | 6.87 |
| 2024 | 1704 | 6.82 |
| 2023 | 1208 | 6.74 |
| 2022 | 1362 | 6.97 |
| 2021 | 1123 | 6.54 |
| 2020 | 664 | 6.37 |
| 2019 | 772 | 6.93 |
| 2018 | 762 | 7.17 |
It may take a day or so for new Red Hat vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Red Hat Security Vulnerabilities
| CVE | Date | Vulnerability | Products |
|---|---|---|---|
| CVE-2026-84823 | Oct 15, 2026 |
WildFly Path Traversal in take-snapshot Allows Monitor Role to Read ConfigA flaw was found in WildFly. A user with the `Monitor` role, which is the lowest standard Role-Based Access Control (RBAC) role, can exploit a path traversal vulnerability in the `take-snapshot` operation. By manipulating the `name` parameter, this user can write a copy of the server configuration to an arbitrary location. This allows the `Monitor` role to read back the server configuration, including sensitive credentials, which would otherwise be restricted by RBAC, leading to information disclosure. |
Enterprise Linux (RHEL)
Jboss Fuse
Jboss Enterprise Application Platform
And others... |
| CVE-2026-85634 | Oct 15, 2026 |
WildFly Core Path Traversal in ContentRepositoryImpl Enables PrivEscA flaw was found in the ContentRepositoryImpl.copyExplodedContent function of the wildfly-core library, which is used by WildFly and JBoss EAP to manage server deployments. The issue occurs when the library processes an unsanitized deployment name. Due to a missing containment check, an attacker with the Deployer RBAC role can use path traversal sequences to access files outside the restricted deployment directory. This can allow the attacker to delete arbitrary directories or create files with arbitrary content, leading to a full privilege escalation to the management SuperUser role. |
Jboss Fuse
Jboss Enterprise Application Platform
Jbosseapxp
And others... |
| CVE-2026-92982 | Oct 15, 2026 |
Ansible Operator Plugins: Jinja2 Template Injection Enables ClusterWide PrivEscA flaw was found in Ansible Operator Plugins. A low-privileged Kubernetes user can exploit a Jinja2 template injection vulnerability by crafting malicious custom resource (CR) specification values. These values are processed by Ansible without proper sanitization, allowing embedded Jinja2 expressions to be executed within the operator pod. This can lead to arbitrary code execution and privilege escalation, granting the attacker control over the operator's service account with cluster-wide permissions. |
Migration Toolkit Applications
Rhmt
Migration Toolkit Virtualization
And others... |
| CVE-2026-86849 | Oct 14, 2026 |
DPDK vhost-crypto Integer Overflow, Host Buffer OverrunA flaw was found in DPDK lib/vhost vhost-crypto. Integer overflow in chain length checks, and missing length checks on the RSA path, can overflow a host buffer in the vhost-crypto backend. |
Enterprise Linux (RHEL)
Openshift
Openstack
And others... |
| CVE-2026-86856 | Oct 14, 2026 |
DPDK nfp vDPA Driver Buffer Overflow via Excess VirtqueuesA flaw was found in the DPDK nfp vDPA driver. Stack and heap buffers sized for a single queue pair can be overflowed when more virtqueues are configured, leading to a host crash or memory corruption. |
Enterprise Linux (RHEL)
Openshift
Openstack
And others... |
| CVE-2026-86847 | Oct 14, 2026 |
DPDK vhost-crypto Uninitialized Next Pointer Crash in Write-Back ChainA flaw was found in DPDK lib/vhost vhost-crypto. Write-back chain cleanup can follow an uninitialized next pointer when mapping a guest descriptor fails, causing the host vhost-crypto process to hang or crash. |
Enterprise Linux (RHEL)
Openshift
Openstack
And others... |
| CVE-2026-86846 | Oct 14, 2026 |
DPDK vhost-crypto OOB Write via Unchecked Avail-Ring IndexA flaw was found in DPDK lib/vhost vhost-crypto. A guest can supply an avail-ring descriptor index that is used without bounds checking, causing an out-of-bounds write in the host vhost-crypto backend. |
Enterprise Linux (RHEL)
Openshift
Openstack
And others... |
| CVE-2026-86845 | Oct 14, 2026 |
DPDK vhost-crypto Use-after-Free via stale session pointerA flaw was found in DPDK lib/vhost vhost-crypto. Session cleanup can leave a stale cached session pointer, and the data path does not check the session type before attaching it, leading to use-after-free or type confusion in the host vhost-crypto backend. |
Enterprise Linux (RHEL)
Openshift
Openstack
And others... |
| CVE-2026-86566 | Oct 14, 2026 |
DPDK lib/vhost RX Descriptor Underflow Causes VDS in OVSDPDKA flaw was found in DPDK lib/vhost. A guest with runt RX descriptors can underflow the copy length in vhost enqueue, causing a denial of service in a shared vhost backend such as OVS-DPDK. |
Enterprise Linux (RHEL)
Openshift
Openstack
And others... |
| CVE-2026-86848 | Oct 14, 2026 |
DPDK lib/vhost vhost-crypto Indirect-Descriptor OOB via double-fetchA flaw was found in DPDK lib/vhost vhost-crypto. The indirect-descriptor snapshot double-fetches a guest descriptor next index, allowing a malicious guest to cause an out-of-bounds access in the host backend. |
Enterprise Linux (RHEL)
Openshift
Openstack
And others... |
| CVE-2026-86567 | Oct 14, 2026 |
DPDK lib/vhost UAF via IOTLB miss leading to use-after-unmapA flaw was found in DPDK lib/vhost. The VDUSE handler fails to invalidate vring pointers when the IOTLB is invalidated, leading to use-after-unmap. |
Enterprise Linux (RHEL)
Openshift
Openstack
And others... |
| CVE-2026-94200 | Oct 14, 2026 |
Erlang OTP SSL lib DoS: TLS 1.3 Early Data Validation (pre11.7.8)Improper Validation of Consistency within Input vulnerability in Erlang OTP ssl (tls_handshake_1_3, ssl_handshake and tls_client_ticket_store modules) allows a malicious TLS 1.3 server to cause a denial of service of the ssl application on the client node. The TLS 1.3 client decodes the extensions of a NewSessionTicket message as if they came from EncryptedExtensions. It therefore accepts a 0-length early_data extension, a form that is only valid in ClientHello and EncryptedExtensions. With {session_tickets, auto}, the client stores the ticket in the node-global tls_client_ticket_store. On the next automatic resumption, tls_handshake_1_3:get_max_early_data/1 crashes the store with a case_clause. Repeated crashes can exceed the restart intensity of the ssl supervisors, which use the rest_for_one strategy, and take down ssl for all connections on the node. This issue affects OTP from OTP 23.3 before OTP 27.3.4.19, OTP 28.5.0.8, and OTP 29.1.2, corresponding to ssl from 10.3 before 11.2.12.14, 11.6.0.7, and 11.7.8. |
|
| CVE-2026-86565 | Oct 14, 2026 |
DPDK lib/vhost OOB write via virtqueue size desyncA flaw was found in DPDK lib/vhost. A guest can desynchronize virtqueue size from inflight descriptor table size, causing an out-of-bounds write in the host vhost process. |
Enterprise Linux (RHEL)
Openshift
Openstack
And others... |
| CVE-2026-86563 | Oct 14, 2026 |
DPDK vhost double-offset bug causes memory access errorA flaw was found in DPDK lib/vhost. A double-offset bug in vhost log mapping calculation can lead to incorrect memory access. |
Enterprise Linux (RHEL)
Openshift
Openstack
And others... |
| CVE-2026-86562 | Oct 14, 2026 |
DPDK VHOST TOCTOU Double-Fetch Heap Overflow VulnerabilityA flaw was found in DPDK lib/vhost. A TOCTOU double-fetch of control-queue descriptors allows a heap buffer overflow with attacker-controlled content in the VDUSE control-queue handler. |
Enterprise Linux (RHEL)
Openshift
Openstack
And others... |
| CVE-2026-86561 | Oct 14, 2026 |
DPDK vhost mmap size validation flaw leads to host crashA flaw was found in DPDK lib/vhost. Memory size is not adequately validated before mmap during vhost memory-region setup, which can lead to a host crash or memory corruption. |
Enterprise Linux (RHEL)
Openshift
Openstack
And others... |
| CVE-2026-93683 | Oct 14, 2026 |
DPDK vhost OOB heap copy via indirect descriptor tableA flaw was found in the DPDK vhost library. When handling a virtio indirect descriptor table, the host reads the table length more than once from guest memory and can allocate a host copy before validating that length. A guest that changes the length between those reads, or that supplies an out-of-range next index on a small host copy in the vDPA relay path, can cause the host vhost process to walk past the validated mapping or heap copy. That can crash or disrupt the vhost process. Out-of-bounds bytes are consumed as descriptor fields for GPA translation and are not returned to the guest as payload. This is a residual issue in the non-contiguous indirect descriptor copy path introduced as part of the CVE-2018-1059 fix. |
Enterprise Linux (RHEL)
Openshift
Openstack
And others... |
| CVE-2026-15176 | Oct 14, 2026 |
NGINX Heap Buffer Overflow via $request_filename in Alias RewriteA vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return directive referencing the $request_filename variable. Alternatively, the same result could be achieved when the $request_filename variable is used in an access log format directive. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. |
|
| CVE-2026-88842 | Oct 14, 2026 |
BusyBox dpkg write_status_file cursor reset flaw causes data corruptionA flaw was found in BusyBox dpkg. The write_status_file() function does not reset a field cursor between package stanzas. When two packages are removed in a single invocation and the first stanza is larger than the second, the second package stanza can be dropped from the status file, causing limited data corruption. |
Hummingbird
|
| CVE-2026-88829 | Oct 14, 2026 |
BusyBox httpd Reverse Proxy Path Bypass via Pipelined RequestsA flaw was found in BusyBox httpd's reverse proxy feature. When the proxy is configured to forward requests matching a URL prefix to a backend server, only the first HTTP request on a TCP connection has its path rewritten. An attacker can send a pipelined second request that is relayed verbatim to the backend, bypassing the configured path restrictions. This allows accessing arbitrary paths on the backend server that were not intended to be exposed through the proxy. |
Hummingbird
|
| CVE-2026-90954 | Oct 14, 2026 |
BusyBox dpkg-deb Symlink Injection via .deb ExtractionA flaw was found in BusyBox's dpkg-deb archive extraction. The ar archive handler flushes deferred symlinks after each archive member, unlike the tar, cpio, and unzip handlers which flush once after the last member. A specially crafted .deb archive with two data.tar members can exploit this ordering: the first member declares a symlink pointing to an absolute path (e.g., '/'), which is deferred as unsafe but flushed after the first member. The second member declares a regular file whose path traverses the now-live symlink, resulting in a file being written outside the intended extraction directory. This could allow an attacker to write arbitrary files to arbitrary locations when a user extracts a crafted .deb package. |
Hummingbird
|
| CVE-2026-86476 | Oct 14, 2026 |
Gst-plugins-base Heap Buffer Overflow via Unchecked GstVideoMetaA flaw was found in gst-plugins-base. A heap buffer overflow can be triggered when processing video buffers whose attached GstVideoMeta metadata declares plane strides and offsets that exceed the actual backing memory allocation. The metadata is not range-checked during deserialization, and the video frame mapping code does not verify that the declared plane geometry fits within the buffer before allowing consumers to read or write video data. A local attacker who controls the sending side of a GStreamer inter-process IPC pipeline can deliver a crafted buffer carrying fabricated strides, causing the receiving process to read or write beyond heap boundaries. Successful exploitation can cause a denial of service or potentially allow code execution within the affected process. |
Enterprise Linux (RHEL)
|
| CVE-2026-92392 | Oct 14, 2026 |
Curl HTTP/2 RST_STREAM UAF during uploadDuring an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server (with reason `HTTP_1_1_REQUIRED` or `REFUSED_STREAM`) leading to a use after free of a `struct Curl_easy` object. |
|
| CVE-2026-88834 | Oct 13, 2026 |
BusyBox httpd Username Enumeration via System Password AuthA flaw was found in BusyBox's httpd web server. When configured with system password authentication, a user existence oracle may exist in certain build configurations. An attacker could distinguish existing from non-existing usernames by observing authentication failure behavior. Impact is limited to username enumeration and requires non-default compile options or uncommon password file states; default BusyBox builds with shadow password support are not affected. |
Hummingbird
|
| CVE-2026-88838 | Oct 13, 2026 |
BusyBox Mount Bypass via Clearing-Mask OptionsA flaw was found in BusyBox's mount utility. A non-root user can bypass mount security restrictions set in /etc/fstab by specifying clearing-mask options on the command line. These options pass the non-root flag filter and are merged with fstab options as strings; when the combined options are re-parsed, clearing options can override nosuid, nodev, and noexec protections the administrator intended to enforce. |
Hummingbird
|
| CVE-2026-88833 | Oct 13, 2026 |
BusyBox udhcpc DHCP Client Integer Underflow DoSA flaw was found in BusyBox's udhcpc DHCP client. When processing raw DHCP packets, the client replaces the validated packet length with an attacker-controlled value from the IP header without re-validating the minimum size. This leads to an integer underflow when subtracting header sizes, causing a subsequent memory copy with a massively oversized length. An attacker on the same network segment can send a specially crafted packet to crash the DHCP client, resulting in denial of service and loss of network connectivity. |
Hummingbird
|
| CVE-2026-94603 | Oct 13, 2026 |
Podman 4.4.0-5.8.8/6.1.3 Ignoring --cap-drop via checkpoint annotationPodman is a tool for managing OCI containers and pods. From 4.4.0 until 5.8.8 and 6.1.3, podman run treats an image carrying the io.podman.annotations.checkpoint.runtime.name annotation as a checkpoint and silently ignores user-supplied container creation restrictions such as --cap-drop=ALL, allowing image-controlled checkpoint state to select weaker sandbox settings and capabilities. Rootless containers are not affected because checkpoint and restore are unavailable in that mode. This issue is fixed in versions 5.8.8 and 6.1.3. |
|
| CVE-2026-49264 | Oct 13, 2026 |
OAuthLib 0.6.14.0.0 RevocationEndpoint: Unvalidated JSONP XSSOAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 0.6.1 until 4.0.0, OAuthLib's RevocationEndpoint in oauthlib/oauth2/rfc6749/endpoints/revocation.py reflects an unvalidated callback request parameter into success and error response bodies when enable_jsonp=True. The callback can come from the query string or request body and is used without restricting it to a legal JavaScript function name. A browser application that loads the revocation response as trusted JSONP and permits attacker influence over callback can therefore execute attacker-controlled JavaScript in the including application's origin, with access to its DOM and script-accessible data. The feature is disabled by default, so only deployments that explicitly enable JSONP are affected. This issue is fixed in version 4.0.0. |
|
| CVE-2026-49265 | Oct 13, 2026 |
OAuthLib PKCE Timing Side-Channel <4.0.0OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 3.0.0 until 4.0.0, OAuthLib's PKCE checks in oauthlib/oauth2/rfc6749/grant_types/authorization_code.py compare attacker-supplied code_verifier values with stored challenges using ordinary string equality in code_challenge_method_plain and code_challenge_method_s256. Because the comparison can return after a length difference or the first mismatching character, repeated token endpoint measurements can reveal common-prefix timing information that could potentially allow recovery of the code_verifier, unauthorized access-token acquisition, and account takeover. Practical exploitation requires an intercepted, single-use authorization code and enough measurements to overcome real-world network noise; the local timing benchmark does not establish practical remote account takeover, so the weakness remains a defense-in-depth concern. This issue is fixed in version 4.0.0. |
|
| CVE-2026-83535 | Oct 12, 2026 |
OpenStack Network Exporter Basic Auth Bypass via TLS MisconfigA flaw was found in openstack-network-exporter. When an operator configures user authentication but omits or misconfigures Transport Layer Security (TLS), the basic authentication mechanism is silently bypassed. This fail-open design allows an adjacent network attacker to access sensitive Open vSwitch (OVS) and Open Virtual Network (OVN) dataplane metrics without credentials. Consequently, an attacker can enumerate bridge names, port counters, OVN controller state, and host topology, leading to information disclosure. |
Openstack
|
| CVE-2026-83536 | Oct 12, 2026 |
openstack-network-exporter DoS via missing ReadHeaderTimeoutA flaw was found in openstack-network-exporter. The HTTP server within the component is configured without essential timeout settings, such as ReadHeaderTimeout. This vulnerability allows an unauthenticated, remote attacker to initiate multiple slow HTTP header connections. By trickling header bytes, the attacker can exhaust server resources, specifically file descriptors, leading to a Denial of Service (DoS) that prevents legitimate Prometheus metric scraping and alerting. |
Openstack
|
| CVE-2026-85471 | Oct 12, 2026 |
Quay SSRF: Hostname blacklist bypass in webhook notificationsA flaw was found in Quay. An authenticated repository administrator could bypass the hostname blacklist in webhook notifications, leading to a Server-Side Request Forgery (SSRF) vulnerability. This allows the Quay application to be tricked into sending requests to internal network resources, such as cloud metadata services or other services within the cluster. Consequently, this could lead to the disclosure of sensitive information from these internal services. |
Mirror Registry
Quay
|
| CVE-2026-87744 | Oct 12, 2026 |
Quarkus REST Panache unauth access via @MethodPropsA flaw was found in Quarkus REST Data Panache. This vulnerability allows unauthenticated attackers to bypass security controls on generated endpoints. When a developer customizes a specific operation using @MethodProperties without explicitly re-declaring security roles, the code generator silently drops class-level security requirements. This results in the affected endpoint defaulting to permissive, unauthenticated access, potentially leading to unauthorized information disclosure or data modification. |
Exploit Intelligence
Quarkus
|
| CVE-2026-75888 | Oct 12, 2026 |
OpenShift Console SSRF via Helm Chart URL (CVE-2026-75888)A flaw was found in the OpenShift console. An authenticated console user can exploit a Server-Side Request Forgery (SSRF) vulnerability by providing a specially crafted Helm chart URL without proper validation. This allows the user to make the console pod fetch arbitrary URLs, potentially leading to the disclosure of sensitive information through error messages or enabling blind port scanning within the cluster. |
Openshift
|
| CVE-2026-94451 | Oct 12, 2026 |
Quarkus REST Data Panache Sort Param Bypass Allows Data Leak & DoSQuarkus REST Data Panache provides a way to automatically generate REST endpoints for data entities. A flaw was found where certain endpoints do not properly check the sort parameter provided by users. This could allow an attacker to learn information they should not have access to or slow down the system by forcing the database to perform complex tasks, potentially causing a denial of service. |
Exploit Intelligence
Quarkus
|
| CVE-2026-52903 | Oct 12, 2026 |
Deserialization RCE via YAML.safe_load override in ManageIQA deserialization of untrusted data vulnerability was found in ManageIQ. The YamlLoadAliases module overrides YAML.safe_load to silently fall back to YAML.unsafe_load in production when a Psych::DisallowedClass error occurs. An authenticated attacker with dialog import access can exploit this to achieve remote code execution by uploading a crafted YAML payload that triggers the fallback and deserializes arbitrary Ruby objects. Red Hat CloudForms, which was based on ManageIQ, has reached End of Life and is no longer supported. No errata or patches will be issued. This CVE is being assigned for the benefit of the ManageIQ community and downstream consumers. |
|
| CVE-2026-94447 | Oct 08, 2026 |
Go cmd/go Checksum Bypass (Go <1.26.9, 1.27.0-1.27.2)Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/toolchain go.sum entry and operates a malicious GOMODPROXY the user chooses to use can bypass the intended checksum. We now ensure that golang.org/toolchain always goes to the network for the canonical checksum. |
|
| CVE-2026-94444 | Oct 08, 2026 |
Go cmd/go Module Injection via bogus golang.org/fips140 (<=1.27.1)Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/fips140 and operates a malicious GOMODPROXY the user chooses to connect to can serve an arbitrary module in its place. We now unpack the trusted ziphash for the bundled golang.org/fips140 module and construct its entry in the GOMODCACHE such that it can be verified by the toolchain. |
|
| CVE-2026-89091 | Oct 08, 2026 |
Ansible Core Tarball Path Traversal via Symlink Chain ExploitA flaw was found in ansible-core. When installing a collection with `ansible-galaxy collection install`, the archive extractor validates member paths using lexical path normalisation (os.path.abspath) instead of resolving symbolic links (os.path.realpath), and it performs no containment check on symlink-typed directory members before creating them. A crafted collection tarball can chain symlink directory entries so that a subsequent file member is written outside the intended destination directory. This allows an attacker who can get a victim to install a malicious collection to overwrite arbitrary files with the privileges of the user running ansible-galaxy, leading to code execution on the control node. This is a bypass of the fix for CVE-2020-10691. |
Migration Toolkit Applications
Migration Toolkit Virtualization
Service Mesh
And others... |
| CVE-2026-93017 | Oct 08, 2026 |
OpenShift Insights Operator: Misconfigured ClusterRole Grants All SecretsThe `insights-operator-gather` ClusterRole grants the operator's service account read access to secrets in the core API group with no namespace or resourceNames restriction therefore, access to every secret in every namespace in the cluster. Ref: https://github.com/openshift/insights-operator/blob/8f15e3157ff09f54ab22801f5b21da35a195cc6d/manifests/03-clusterrole.yaml#L368-L373 ``` - apiGroups: - "" resources: - secrets verbs: - get - list ``` By spawning a pod with the gather service account mounted, an attacker will be able to access any secret in any namespace. ``` spec: serviceAccountName:"gather" ``` |
Openshift
|
| CVE-2026-56851 | Oct 07, 2026 |
Nickname Profile Out-of-Bounds Panic in GoThe Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer. |
|
| CVE-2026-77214 | Oct 07, 2026 |
Heap Buffer Over-Read in libexpat XML_ParseBuffer (CVE-2026-77214)libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c. XML_ParseBuffer advances the parse buffer end with parser->m_bufferEnd += len using a caller-supplied length that is not validated against the allocated buffer size, so repeated XML_ParseBuffer calls move m_bufferEnd past the end of the heap allocation and subsequent parsing reads out of bounds. Reaching this path requires a parse buffer to already be present; otherwise XML_ParseBuffer returns XML_ERROR_NO_BUFFER. A buffer is present after a prior call to XML_GetBuffer, either directly (the common case) or indirectly through a prior XML_Parse call that allocates the buffer internally. The over-read discloses adjacent heap memory to the calling application, recovering heap pointers, libc function pointers, and code pointers sufficient to defeat ASLR and build further exploitation primitives. |
|
| CVE-2026-80048 | Oct 06, 2026 |
Red Hat sssd-kcm Local DoS via Large Request HeaderA flaw was found in `sssd-kcm`. A local user or process able to connect to the `sssd-kcm` UNIX socket can exploit this vulnerability. By sending a large request length header and then stalling the connection, an attacker can cause the system to preallocate significant memory. This leads to memory exhaustion within the `sssd-kcm` responder, resulting in a Denial of Service (DoS) for affected deployments. |
Enterprise Linux (RHEL)
Openshift
|
| CVE-2026-76061 | Oct 06, 2026 |
CRI-O bind_mount_prefix Symlink Spoof leads to Host Path EscalationA flaw was found in CRI-O's `bind_mount_prefix` handling. When configured with a non-empty `bind_mount_prefix`, a malicious container or local attacker could use a Container Runtime Interface (CRI) hostPath containing an intermediate absolute symlink. This could cause the bind mount source to resolve outside the intended prefixed root, potentially leading to unauthorized access to files or privilege escalation on the host system. |
Openshift
|
| CVE-2026-83550 | Oct 06, 2026 |
Go Postgres-Exporter: pprof debug endpoints exposed, info disclosure & DoSA flaw was found in postgres-exporter. Due to the blank import of `net/http/pprof`, debug endpoints are exposed on the unauthenticated metrics listener. A remote attacker within the cluster network can access these endpoints. This allows for information disclosure, potentially revealing process arguments, full goroutine stacks, and sensitive data like database connection strings or passwords from heap dumps. Additionally, repeated CPU profiling through these endpoints can lead to a denial of service. |
Multicluster Globalhub
|
| CVE-2026-88252 | Oct 06, 2026 |
SSSD Local DoS via Responder Service File Descriptor ExhaustionA flaw was found in sssd. A local user can cause a Denial of Service (DoS) by exhausting the responder service's available file descriptors (system handles used for open connections). By opening and maintaining many concurrent connections to a responder socket while continuing to queue new connection attempts, an attacker can trigger an unthrottled retry loop. This condition leads to high CPU utilization and stalls the service, preventing legitimate identity and authentication requests from being processed. |
Enterprise Linux (RHEL)
Openshift
|
| CVE-2026-92821 | Oct 06, 2026 |
SSSD LDAP Expired-Password Bypass via Early Rule TerminationA flaw was found in SSSD. When configured to evaluate password expiration warnings before restrictive access rules in LDAP (Lightweight Directory Access Protocol) environments, an expired-password warning terminates rule evaluation early and treats the access request as successful. A remote authenticated user with an expired password using an alternative authentication method, such as SSH public key authentication, can exploit this flaw to bypass access control restrictions and gain unauthorized access to protected systems. |
Enterprise Linux (RHEL)
Openshift
|
| CVE-2026-71297 | Oct 05, 2026 |
Red Hat Maestro gRPC Broker Auth Bypass via Client CertA flaw was found in the maestro gRPC broker. This vulnerability allows a remote attacker, with a valid client certificate, to bypass authentication. This bypass enables the attacker to subscribe to other consumers' event streams, leading to unauthorized information disclosure, or to publish forged agent status, which can compromise data integrity. |
Multicluster Engine
|
| CVE-2026-71299 | Oct 05, 2026 |
Maestro REST API Auth Bypass: UnAuth Writes PossibleA flaw was found in Maestro. Its REST API write endpoints were registered without proper authentication middleware. This allows a remote attacker to perform unauthorized write operations, such as creating, modifying, or deleting consumers and resource bundles. This could lead to data integrity issues or a denial of service (DoS). |
Multicluster Engine
|
| CVE-2026-71298 | Oct 05, 2026 |
Unauthenticated SQLi in RedHat Maestro REST orderBy for Data ExfiltrationA flaw was found in maestro. A remote attacker could exploit a SQL injection vulnerability in the `orderBy` query parameter of its REST API list endpoints. This flaw, which does not require authentication, allows for read-only blind extraction of data from the database. |
Multicluster Engine
|