Red Hat Linux OS and other open source products
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in any Red Hat product.
RSS Feeds for Red Hat security vulnerabilities
Create a CVE RSS feed including security vulnerabilities found in Red Hat products with stack.watch. Just hit watch, then grab your custom RSS feed url.
Products by Red Hat Sorted by Most Security Vulnerabilities since 2018
Red Hat Enterprise Linux Server1534 vulnerabilities
RedHat Enterprise Linux (RHEL) Server. Includes software bundeled with RHEL server.
Red Hat Enterprise Linux Workstation1504 vulnerabilities
RedHat Enterprise Linux (RHEL) Workstation. Includes software bundled with RHEL Workstation.
Red Hat Enterprise Linux Desktop1493 vulnerabilities
RedHat Enterprise Linux (RHEL) Desktop. Includes software bundled with RHEL desktop
Recent Red Hat Security Advisories
| Advisory | Title | Published |
|---|---|---|
| RHSA-2026:96040 | (RHSA-2026:96040) Important: Red Hat build of Keycloak 26.6.9 Security Update | November 7, 2026 |
| RHSA-2026:96039 | (RHSA-2026:96039) Important: Red Hat build of Keycloak 26.6.9 Images Security Update | November 7, 2026 |
| RHSA-2026:96038 | (RHSA-2026:96038) Important: Red Hat build of Keycloak 26.4.18 Images Security Update | November 7, 2026 |
| RHSA-2026:96037 | (RHSA-2026:96037) Important: Red Hat build of Keycloak 26.4.18 Security Update | November 7, 2026 |
| RHSA-2026:95524 | (RHSA-2026:95524) OpenShift Container Platform 4.19.55 bug fix and security update | November 7, 2026 |
| RHSA-2026:95380 | (RHSA-2026:95380) OpenShift Container Platform 4.20.46 bug fix and security update | November 7, 2026 |
| RHSA-2026:95509 | (RHSA-2026:95509) OpenShift Container Platform 4.14.78 bug fix and security update | November 6, 2026 |
| RHSA-2026:95981 | (RHSA-2026:95981) Red Hat Hardened Images RPMs bug fix and enhancement update | November 6, 2026 |
| RHSA-2026:95525 | (RHSA-2026:95525) OpenShift Container Platform 4.19.55 security and extras update | November 6, 2026 |
| RHSA-2026:95409 | (RHSA-2026:95409) OpenShift Container Platform 4.21.42 bug fix and security update | November 6, 2026 |
By the Year
In 2026 there have been 5577 vulnerabilities in Red Hat with an average score of 7.3 out of ten. Last year, in 2025 Red Hat had 1206 security vulnerabilities published. That is, 4371 more vulnerabilities have already been reported in 2026 as compared to last year. However, the average CVE base score of the vulnerabilities in 2026 is greater by 0.42.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 5577 | 7.29 |
| 2025 | 1206 | 6.88 |
| 2024 | 1705 | 6.83 |
| 2023 | 1208 | 6.74 |
| 2022 | 1362 | 6.98 |
| 2021 | 1123 | 6.54 |
| 2020 | 664 | 6.37 |
| 2019 | 772 | 6.93 |
| 2018 | 762 | 7.17 |
It may take a day or so for new Red Hat vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Red Hat Security Vulnerabilities
| CVE | Date | Vulnerability | Products |
|---|---|---|---|
| CVE-2026-120984 | Nov 07, 2026 |
Keycloak client management auth bypass enabling JS policy injectionA flaw was found in the Keycloak server's client management component. When a client is created or imported with authorization services enabled, the system fails to properly clear an internal session attribute used during the setup process. This allows an authenticated attacker with client management permissions to bypass security controls and upload a malicious JavaScript policy, which is then executed on the server when an authorization request is made. Successful exploitation could allow the attacker to run arbitrary code on the server, potentially compromising the entire system. |
Build Keycloak
Red Hat Single Sign On
|
| CVE-2026-83495 | Nov 07, 2026 |
Red Hat Trainer v2 TrainJob API SecretKeyRef Injection (RBAC Escalation)A flaw was found in the Trainer v2 TrainJob API. A user with permissions to create TrainJobs can exploit this by injecting `valueFrom.secretKeyRef` into environment variable definitions. This allows them to read and exfiltrate sensitive information (secrets) from the namespace, leading to a privilege escalation. This occurs when the TrainJob Role-Based Access Control (RBAC) is broader than the Secret read RBAC. |
Openshift Ai
|
| CVE-2026-50240 | Nov 06, 2026 |
Red Hat OpenShift PAC Privilege Escalation via Unchecked Repo CreatorA flaw was found in OpenShift Pipelines-as-Code (PAC). PAC does not verify whether the creator of a Repository custom resource has permission to create PipelineRuns. A namespace user with only Repository and Secret create/delete permissions can cause PAC to execute attacker-controlled PipelineRuns as the auto-provisioned pipeline ServiceAccount, which carries ClusterRole/edit by default. This results in namespace-scoped privilege escalation, enabling Secret read, resource creation/modification/deletion, and potential supply chain injection in CI/CD namespaces. |
Openshift Builds
Openshift Pipelines
Serverless
And others... |
| CVE-2026-123876 | Nov 06, 2026 |
Podman seccomp AF_VSOCK/NETLINK_AUDIT bypass via 64-bit int truncationA flaw was found in the default seccomp profile used by Podman via containers-common. Deny rules for AF_VSOCK and NETLINK_AUDIT compared socket arguments with unmasked 64-bit equality. Because the kernel truncates those int arguments to 32 bits, setting upper bits can bypass the deny rules. |
Enterprise Linux (RHEL)
Hummingbird
Openshift
And others... |
| CVE-2026-120749 | Nov 06, 2026 |
D-Bus Daemon DoS via Driver Broadcast Delivery FailureA flaw was found in D-Bus. With a privileged Monitoring client attached (for example dbus-monitor or busctl monitor), an unprivileged local user can cause dbus-daemon to abort if a driver-originated broadcast such as NameOwnerChanged or ActivatableServicesChanged cannot be delivered to a recipient (for example due to a deny rule or an exceeded outgoing message queue). Driver broadcasts still use serial 0; when delivery fails, composing the monitor error reply asserts reply_serial != 0 and aborts the daemon. This is an incomplete fix for CVE-2023-34969, which only assigned serials for driver messages sent to a single recipient. On the well-known system bus this is a denial of service. |
Enterprise Linux (RHEL)
Rhel Els
Hummingbird
And others... |
| CVE-2026-83494 | Nov 06, 2026 |
Kubeflow Training Operator Webhook Object Cast Bypass leading to DoSA flaw was found in the training-operator. An incorrect object casting in the PyTorchJob ValidateUpdate webhook allows users to bypass an immutability check. This vulnerability could enable users to detach a queued job from its quota management system or hijack a running job's controller ownership. The primary impact is a Denial of Service (DoS) condition. |
Openshift Ai
|
| CVE-2026-83493 | Nov 06, 2026 |
Snyk Distributed Workloads PR Target Secret Leak via pull_request_targetA flaw was found in distributed-workloads. A remote attacker could exploit a vulnerability in the pull_request_target workflow by submitting a specially crafted pull request. This workflow processes untrusted code from the pull request author while operating with the base repository's sensitive secrets, such as the SNYK_TOKEN, and its default write token. Consequently, an attacker could exfiltrate these secrets, leading to unauthorized access to the Snyk integration and potential control over the repository. |
Openshift Ai
|
| CVE-2026-9797 | Nov 06, 2026 |
Keycloak Admin Privilege Escalation via JWKS Manipulation (CVE-2026-9797)A flaw was found in Keycloak's administrative services (org.keycloak.services.resources.admin). A highly privileged attacker, authenticated with a 'manage-clients' role, could exploit this vulnerability through several methods, including manipulating client JSON Web Key Sets (JWKS), swapping client authenticator types and resetting secrets, or downloading legitimate signing keys. Successful exploitation allows the attacker to obtain a token with 'realm-admin' role assignments, leading to privilege escalation and potential unauthorized access to sensitive resources. |
Build Keycloak
|
| CVE-2026-97848 | Nov 06, 2026 |
Keycloak JSON Mapper Token Sanitization Bypass (Role Injection)A flaw was found in the token sanitization logic of Keycloak, an open source identity and access management solution. The issue occurs when a protocol mapper is configured to emit structured claims using the JSON type. The security check designed to remove unauthorized role mappings only looks for standard Java maps and fails to recognize Jackson based JSON objects. This allows an attacker to inject forged client roles into security tokens, which could lead to unauthorized access to protected resources. |
Build Keycloak
Red Hat Single Sign On
|
| CVE-2026-97367 | Nov 06, 2026 |
Keycloak Account REST API Session Hijack via Token ManipulationA flaw was found in the Keycloak Account REST API where it incorrectly handles session identification. A malicious client owner can manipulate their own security tokens to point to a different user's active session. This allows the attacker to access and modify the victim's account information, potentially leading to a full account takeover by changing the recovery email and resetting the password. |
Build Keycloak
Red Hat Single Sign On
|
| CVE-2026-96547 | Nov 06, 2026 |
Keycloak DCR Claim Name Restriction Bypass (Privilege Escalation)A flaw was found in the Dynamic Client Registration component of Keycloak, an open-source identity and access management solution. The issue occurs because the system does not properly restrict which claim names can be used when setting up new clients. An attacker with valid registration credentials could create a client that incorrectly maps standard user profile information to sensitive security roles, potentially allowing them to gain unauthorized privileges on external applications that trust Keycloak tokens. |
Build Keycloak
Red Hat Single Sign On
|
| CVE-2026-96460 | Nov 06, 2026 |
Keycloak Token Exchange V2 Unlimited Lifetime VulnerabilityA flaw was found in the token exchange mechanism of Keycloak. When using Standard Token Exchange V2, the system issues new tokens with a fresh lifetime based on the requester clients configuration instead of limiting it to the original tokens expiration. This issue allows an authenticated requester to indefinitely extend access for service accounts by repeatedly exchanging tokens, even if the original client has been disabled by an administrator. |
Build Keycloak
Red Hat Single Sign On
|
| CVE-2026-92856 | Nov 06, 2026 |
Keycloak SAML brokering ProxyRestriction bypass (CVE-2026-92856)A flaw was found in the SAML brokering component of Keycloak, an identity and access management solution. The issue occurs when Keycloak acts as an intermediary between an upstream identity provider and downstream services. Keycloak fails to respect specific security instructions called ProxyRestrictions in the login messages it receives. This allows a user to log into downstream services even when the original identity provider explicitly forbade further sharing of the login session. As a result, users can bypass security boundaries intended to limit where their identity can be used. |
Build Keycloak
Red Hat Single Sign On
|
| CVE-2026-19688 | Nov 06, 2026 |
Keycloak Admin API Token Audience Validation Bypass (CVE-2026-19688)A flaw was found in the Admin REST API of Keycloak, an identity and access management solution. The Admin API fails to verify the intended audience of bearer tokens during authentication. This issue allows an attacker who operates a client within a realm to capture an administrator's access token and reuse it to perform unauthorized administrative actions, potentially leading to full realm compromise. |
Build Keycloak
Red Hat Single Sign On
|
| CVE-2026-96447 | Nov 06, 2026 |
Keycloak TokenManager Stateless Token Validation BypassA flaw was found in the TokenManager component of Keycloak, an open-source identity and access management solution. The issue occurs during the validation of stateless access tokens when the original user ID no longer exists. Keycloak incorrectly falls back to using the username to identify the user without verifying if the identity matches the original token subject. This could allow an attacker with an old token to gain access to a newly created service account if it shares the same client ID as a previously deleted one. |
Build Keycloak
Red Hat Single Sign On
|
| CVE-2026-109081 | Nov 06, 2026 |
Keycloak DCR endpoint auth bypass leads to role injection DoSA flaw was found in Keycloak. The Dynamic Client Registration (DCR) endpoint does not properly validate authorization when processing the deprecated defaultRoles field. An authenticated attacker with client creation privileges or an Initial Access Token (IAT) can inject excessive roles into the realm's default roles configuration. This causes clients across the realm to generate bloated access tokens, resulting in performance and memory degradation that can lead to a Denial of Service (DoS). |
Build Keycloak
Red Hat Single Sign On
|
| CVE-2026-107124 | Nov 06, 2026 |
Keycloak OIDC Logout Session Fixation via Unvalidated Token HintA flaw was found in the OIDC logout endpoint of the keycloak-services component, which handles user session termination in Red Hat Build of Keycloak. The issue occurs because the system sets a session cookie based on an unvalidated token hint before completing security checks. An attacker can use this flaw to fix a session ID in a victim's browser, allowing them to hijack the victim's subsequent login and gain full control over their account. |
Build Keycloak
Red Hat Single Sign On
|
| CVE-2026-121837 | Nov 06, 2026 |
Quarkus REST Data Panache @SecureField Filtering BypassA flaw was found in the REST Data Panache component of Quarkus. When a security constraint is applied to an entity property using the @SecureField annotation on its getter method rather than the field itself, the generated REST resource fails to enforce this constraint for filtering and sorting operations. This allows an authenticated user to infer sensitive data values by observing which records match specific filter criteria or how they are ordered, even though the values are omitted from the final response. |
Exploit Intelligence
Quarkus
|
| CVE-2026-123037 | Nov 06, 2026 |
Ansiblecore User Module Symlink PrivEsc via SSH Key GenerationA flaw was found in the ansible-core user module. When generate_ssh_key is enabled, User.ssh_key_gen() guards the key files against symlinks but checks the ~/.ssh directory only with os.path.exists(). An unprivileged user on a managed node who replaces their ~/.ssh with a symlink to an existing root-writable directory causes the privileged module to write the generated key pair through the symlink and then chown both files to that user. Because such files can be dropped into directories processed by schedulers (e.g. /etc/cron.daily) or dynamic MOTD (/etc/update-motd.d), the user can escalate to root on the managed node. This is an incomplete fix of CVE-2024-9902. |
Ansible Automation Platform
Ansible Core
Ansible Portal
And others... |
| CVE-2026-112902 | Nov 05, 2026 |
Pillow 12.3.0 TIFF encoder libtiff tag mismatch leads to OOB readPillow is a Python imaging library. In versions through 12.3.0, the libtiff TIFF encoder can pass arguments to TIFFSetField() that do not match libtiffs definition of the corresponding tag. When an application saves attacker-controlled image metadata through this encoder, crafted tag values can cause invalid memory reads, copying process memory into the encoded output or crashing the process. Applications that return the encoded output to an attacker can disclose that memory. The issue is reachable when re-saving compressed TIFF images and through certain conversions that preserve EXIF metadata into compressed TIFF output. This vulnerability is fixed in version 13.0.0. |
|
| CVE-2026-97847 | Nov 05, 2026 |
Keycloak Protocol Mapper Identity Resolution Bug (CVE-2026-97847)A flaw was found in the protocol mapper and identity resolution components of Keycloak. The issue occurs when a client manager uses hardcoded-claim mappers to override identity claims in sessionless service-account tokens. Because these tokens lack a session ID, Keycloak may incorrectly resolve the token bearer as a different, highly privileged user based on the manipulated claims. This can allow an attacker with limited client management permissions to impersonate a realm administrator and gain full control over the realm. |
Build Keycloak
Red Hat Single Sign On
|
| CVE-2026-97175 | Nov 05, 2026 |
Keycloak idp-auto-link Authenticator Account Takeover via Unverified EmailA flaw was found in the idp-auto-link authenticator of the keycloak-services component, which handles user identity federation. The issue occurs when Keycloak automatically links an incoming identity from an external provider to an existing local account based on an email address without verifying if the provider has validated that email. This can allow an attacker to take over a victim's account by using a matching unverified email address at a brokered provider. |
Build Keycloak
Red Hat Single Sign On
|
| CVE-2026-97174 | Nov 05, 2026 |
Keycloak CIBA sub parameter injection leads to token substitutionA flaw was found in the Client-Initiated Backchannel Authentication (CIBA) implementation of Keycloak. The CIBA endpoint fails to properly validate the sub parameter, allowing it to be stored as an additional request parameter. During the token issuance process, this injected value overwrites the legitimate subject identifier. This allows an attacker to authenticate as themselves but receive security tokens belonging to a different victim user, leading to unauthorized account access. |
Build Keycloak
Red Hat Single Sign On
|
| CVE-2026-96453 | Nov 05, 2026 |
Keycloak kcadm CLI Truststore Hostname Validation BypassA flaw was found in the Keycloak Admin CLI kcadm tool, which is used by administrators to manage Keycloak servers from the command line. When a custom truststore is provided to verify the server identity, the tool incorrectly accepts any self-signed certificate as long as the hostname matches. This allows a network attacker to impersonate the Keycloak server, steal administrative credentials, and perform unauthorized management actions. |
Amq Broker
Build Keycloak
Jboss Fuse
And others... |
| CVE-2026-93998 | Nov 05, 2026 |
Keycloak SAML Adapter Issuer Mismatch (CVE-2026-93998)A flaw was found in the SAML adapter component of Keycloak, which is used to secure applications with SAML-based authentication. The adapter fails to verify that the issuer of a signed SAML assertion matches the expected identity provider configured for the application. If multiple identity providers share the same trusted signing key, an attacker who controls one of those providers can create a validly signed assertion to log into the application as any user, potentially gaining full administrative control. |
Amq Broker
Build Keycloak
Jboss Fuse
And others... |
| CVE-2026-92857 | Nov 05, 2026 |
Keycloak DCR Validation Bypass Allows Token ForgeryKeycloak provides a Dynamic Client Registration feature that allows users with specific tokens to register their own applications. A flaw in how Keycloak validates these registration requests allows an attacker to create a malicious application that forges identity information. By mapping their own user profile details to protected fields like the user ID (sub) or intended audience (aud), an attacker can generate signed security tokens that make them appear to be a different user. This could allow an attacker to impersonate other users or gain unauthorized access to services that rely on these tokens for identity verification. |
Build Keycloak
Red Hat Single Sign On
|
| CVE-2026-92855 | Nov 05, 2026 |
Keycloak SAML broker holder-of-key assertion replay flawA flaw was found in the SAML identity broker component of Keycloak, which is used to delegate authentication to external identity providers. The issue occurs because the broker fails to verify that a user actually possesses the private key associated with a holder-of-key assertion. An attacker who intercepts a victim signed assertion can replay it to gain unauthorized access and impersonate the victim without needing their private key. |
Build Keycloak
Red Hat Single Sign On
|
| CVE-2026-82965 | Nov 05, 2026 |
Keycloak SAML XML DoS via Unbounded Artifact/ECP RequestsA flaw was found in the SAML implementation of Keycloak, an open-source identity and access management solution. The SAML Artifact Resolution and ECP SOAP endpoints do not properly limit the size or complexity of incoming XML requests. An unauthenticated remote attacker can exploit this by sending specially crafted, large XML messages that cause the server to consume excessive memory. This leads to the application running out of memory and crashing, resulting in a denial of service for all users. |
Build Keycloak
Red Hat Single Sign On
|
| CVE-2026-111253 | Nov 05, 2026 |
CVE-2026-111253: DNF5 Daemon D-Bus Session HijackA flaw was found in dnf5daemon-server. Session methods on dynamically exported D-Bus session objects do not verify that the caller is the unique sender that created the session. A local attacker can modify another user's live package-management session and replace its resolved transaction plan. If the legitimate session party later authorizes execution, the root daemon may apply the attacker-chosen package operations. |
Hummingbird
|
| CVE-2026-123151 | Nov 05, 2026 |
GDB Remote Debug Target Stack Buffer Overflow (CVE-2026-123151)A flaw was found in the GNU debugger (GDB). When GDB connects to a remote debug target, a malicious target can cause GDB to overflow a buffer on the stack while parsing the target's replies. This can crash GDB or potentially allow the target to execute arbitrary code in the GDB client process with the privileges of the user running GDB. |
Enterprise Linux (RHEL)
Rhel Els
Hummingbird
And others... |
| CVE-2026-121997 | Nov 05, 2026 |
Heap Buffer Overflow in gdbserver QTDPsrc packet leads to RCEA heap buffer overflow in gdbserver's QTDPsrc packet handler allows an unauthenticated remote attacker to achieve native code execution in the gdbserver process. The vulnerability results from a mismatch between a packet's declared source length and the actual data length, causing hex2bin to write beyond the allocated heap buffer. |
Enterprise Linux (RHEL)
Rhel Els
Hummingbird
And others... |
| CVE-2026-121996 | Nov 05, 2026 |
gdbserver agent-expression parser length validation OOB read/DoSA length validation flaw in gdbserver's agent-expression parser allows an unauthenticated remote attacker to read uninitialized heap memory from the gdbserver process and cause a denial of service. Disclosed heap content includes addresses suitable for defeating ASLR in further exploitation. |
Enterprise Linux (RHEL)
Rhel Els
Hummingbird
And others... |
| CVE-2026-121995 | Nov 05, 2026 |
GDB client tracepoint upload stack buffer overflow (CVE-2026-121995)A stack buffer overflow in the GDB client's tracepoint upload handler allows an attacker-controlled debug stub to corrupt stack memory automatically during connection setup. The overflow results from GDB reading beyond the current reply boundary into a stale prior reply in the shared packet buffer. |
Enterprise Linux (RHEL)
Rhel Els
Hummingbird
And others... |
| CVE-2026-121994 | Nov 05, 2026 |
GDB remote protocol stack buffer overflow (CVE-2026-121994)A stack buffer overflow in the GDB client's remote protocol handler allows an attacker-controlled debug target to execute arbitrary code in the GDB process. The vulnerability exists in fetch_register_using_p, which decodes a stub's register reply into an alloca-sized buffer without bounding writes by the register width. |
Enterprise Linux (RHEL)
Rhel Els
Hummingbird
And others... |
| CVE-2026-114232 | Nov 05, 2026 |
CVE-2026-114232: Keycloak UMA Policy ResourceType Validation BypassA flaw was found in the UserManagedPermissionService of the Keycloak authorization server. The UMA Protection API, which manages user permissions, fails to validate the resourceType field when a user creates a new policy. This allows an attacker to create a policy that applies to resources owned by other users, potentially leading to unauthorized access or modification of sensitive data across the entire realm. |
Build Keycloak
Red Hat Single Sign On
|
| CVE-2026-112208 | Nov 05, 2026 |
Keycloak Org Identity Login Flow Stale Flag Auth Bypass (CVE-2026-112208)A flaw was found in the Organization identity-first login flow of the Keycloak authentication server. Keycloak is an open-source identity and access management solution used to secure modern applications and services. The issue occurs when an attacker who belongs to multiple organizations initiates a login and then switches to a registration or password reset path. During this process, a flag indicating a successful login is not properly cleared when the user is removed from the session. An attacker can then provide a victim's username, and the system incorrectly treats the stale flag as proof of the victim's identity. This allows the attacker to bypass authentication and gain full access to the victim's account and connected applications. |
Build Keycloak
Red Hat Single Sign On
|
| CVE-2026-110932 | Nov 05, 2026 |
Keycloak Theme Endpoint Disk Exhaustion (DoS)A flaw was found in the theme resource endpoint of Keycloak, an open-source identity and access management solution. The issue occurs because the server fails to validate theme names before using them as keys for an on-disk gzip cache. An unauthenticated attacker can exploit this by sending many requests with unique, fabricated theme names, leading to persistent disk space exhaustion that survives server restarts and causes service disruptions. |
Build Keycloak
Red Hat Single Sign On
|
| CVE-2026-110931 | Nov 05, 2026 |
Keycloak SAML 1.1 Assertion Parser Infinite Loop DoS (CVE2026110931)A flaw was found in the SAML 1.1 assertion parser of Keycloak, a tool used for identity and access management. The issue occurs when the parser handles a specific element called AuthorityBinding within an authentication statement. Due to an incomplete fix for a previous vulnerability, the parser can enter an infinite loop that consumes all available memory, causing the entire Keycloak service to crash and become unavailable to users. |
Build Keycloak
Red Hat Single Sign On
|
| CVE-2026-107602 | Nov 05, 2026 |
Keycloak SAML 1.1 XML Parsing Infinite Loop DoSA flaw was found in the SAML 1.1 XML parsing logic of Keycloak, an open-source identity and access management solution. The issue occurs when the parser encounters unexpected elements within a security token's key information section, causing the processing thread to enter an infinite loop. An unauthenticated remote attacker could exploit this by sending specially crafted requests, leading to 100% CPU usage and a total denial of service that requires a server restart to resolve. |
Build Keycloak
Red Hat Single Sign On
|
| CVE-2026-107123 | Nov 05, 2026 |
Keycloak SAML XML DoS (CPU) via oversized dateTime/durationA flaw was found in the SAML XML processing component of Keycloak, an open-source identity and access management solution. The issue occurs when the server parses XML documents containing excessively long dateTime or duration values. Because these strings are not properly validated before processing, the XML parser consumes excessive CPU time. An unauthenticated remote attacker can exploit this by sending specially crafted SAML requests to the server, leading to high CPU utilization and a denial of service for all users. |
Build Keycloak
Red Hat Single Sign On
|
| CVE-2026-103112 | Nov 05, 2026 |
Keycloak keycloak-services Auth Session Race ConditionA flaw was found in the authentication session handling of the keycloak-services component in Keycloak. The issue occurs because the system fails to verify if an authenticator is valid for the current authentication flow when switching between the standard authentication path and the reset credentials path. An authenticated attacker can exploit this by triggering a race condition during the credential reset process to associate their successful authentication state with another user's session. This can result in the attacker gaining full access to the victim's account and changing their password. |
Build Keycloak
Red Hat Single Sign On
|
| CVE-2026-117691 | Nov 05, 2026 |
Keycloak SAML HTTP-Redirect Binding Percent-Encode Parameter BypassA flaw was found in the SAML HTTP-Redirect binding implementation of Keycloak. The issue occurs because the server processes percent-encoded parameter names (like %53AMLResponse) while the signature verification logic only checks literal parameter names. An attacker can use this discrepancy to provide a crafted, unsigned SAML message that the server processes instead of a legitimately signed one, leading to full account takeover of federated users. |
Build Keycloak
Red Hat Single Sign On
|
| CVE-2026-107912 | Nov 05, 2026 |
Quarkus vertx-http Auth Bypass via Miscombined Management PathA flaw was found in the management interface of the Quarkus framework, specifically within the quarkus-vertx-http component. The issue occurs when the framework incorrectly combines the management root path with specific permission rules, leading to a situation where security policies are applied to the wrong internal paths. As a result, an attacker can bypass intended authorization checks and gain unauthorized access to sensitive management endpoints. |
Exploit Intelligence
Serverless
Camel Quarkus
And others... |
| CVE-2026-123036 | Nov 05, 2026 |
ansible-core <2.19 no_log true info leak via exception fieldA flaw was found in ansible-core. When a task marked `no_log: true` fails, the task result is censored before being emitted, but the `exception` field is retained because it is present in the PRESERVE allow-list in lib/ansible/_internal/_task.py, and the default stdout callback prints it through CallbackBase._handle_exception. As a result, sensitive values the operator explicitly asked to hide can be disclosed: module argument-validation errors echo the argument value, templating errors print an Origin source snippet (the failing line plus the two preceding lines of the variables file, exposing neighbouring secrets from an -e @secrets.yml file), and fail/assert messages are printed in full. Secret material supplied as extra variables or variables files can therefore leak to terminal output, CI logs, and the stdout logs of any automation wrapping ansible-playbook, even though every task touching the secrets is marked no_log: true. This is a regression introduced with the ansible-core 2.19 data-tagging/templating rework; the behaviour does not occur on 2.16, where the error text is correctly censored. |
Ansible Core
|
| CVE-2026-118628 | Nov 03, 2026 |
MLflow 3.8.0 SSRF in get-artifacts Exposes Sensitive DataMLflow get-artifacts Server-Side Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of MLflow. Authentication is not required to exploit this vulnerability. The specific flaw exists within the get-artifacts function. The issue results from the lack of proper validation of a URI prior to accessing resources. An attacker can leverage this vulnerability to disclose information in the context of the server. Was ZDI-CAN-28192. |
|
| CVE-2026-118627 | Nov 03, 2026 |
MLflow SHAP load_explainer deserialization RCE before 3.11.2.dev0MLflow SHAP load_explainer Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MLflow. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the loading of SHAP explainer models. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-30301. |
|
| CVE-2026-118623 | Nov 03, 2026 |
MLflow 3.10.1 Pickle Deserialization RCE via Untrusted DataMLflow PickleEvaluationArtifact Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MLflow. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of pickle files. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29513. |
|
| CVE-2026-121520 | Nov 03, 2026 |
BuildKit: Xattr Abuse Prior to v0.34.1In BuildKit versions prior to v0.34.1, a malicious client with access to the BuildKit control APIs can submit a build request that sets an extended attribute on a file outside the BuildKit state directory. Extended attributes in the trusted. or security. namespaces may also be set, potentially giving a program on the host elevated privileges. This issue affects build services that accept build requests from untrusted users. The issue is fixed in v0.34.1. |
|
| CVE-2026-121522 | Nov 03, 2026 |
BuildKit Daemon Crash in v0.26.0v0.34.1 (Fixed v0.34.2)In BuildKit versions v0.26.0 through v0.34.1, a specific build definition that resolves metadata for the same Git source reference twice can cause the BuildKit daemon to panic and crash, interrupting builds handled by that daemon. The issue is fixed in v0.34.2. |
|
| CVE-2026-121621 | Nov 03, 2026 |
Cmd Injection in Argo CD Image Updater via Proxy URLA command injection vulnerability was found in Argo CD Image Updater, where a proxy URL configured on an SSH Git repository is passed unsanitized into a shell-interpreted SSH command. An attacker able to set a malicious proxy value can inject shell metacharacters to execute arbitrary commands and access credentials in the context of the Image Updater process. |
Openshift Gitops
|