Red Hat Linux OS and other open source products
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in any Red Hat product.
RSS Feeds for Red Hat security vulnerabilities
Create a CVE RSS feed including security vulnerabilities found in Red Hat products with stack.watch. Just hit watch, then grab your custom RSS feed url.
Products by Red Hat Sorted by Most Security Vulnerabilities since 2018
Red Hat Enterprise Linux Server1534 vulnerabilities
RedHat Enterprise Linux (RHEL) Server. Includes software bundeled with RHEL server.
Red Hat Enterprise Linux Workstation1504 vulnerabilities
RedHat Enterprise Linux (RHEL) Workstation. Includes software bundled with RHEL Workstation.
Red Hat Enterprise Linux Desktop1493 vulnerabilities
RedHat Enterprise Linux (RHEL) Desktop. Includes software bundled with RHEL desktop
Recent Red Hat Security Advisories
| Advisory | Title | Published |
|---|---|---|
| RHSA-2026:57483 | (RHSA-2026:57483) Important: OpenShift Container Platform 4.18.54 bug fix and security update | August 26, 2026 |
| RHSA-2026:56910 | (RHSA-2026:56910) Important: OpenShift Container Platform 4.15.68 packages and security update | August 26, 2026 |
| RHSA-2026:57401 | (RHSA-2026:57401) Important: OpenShift Container Platform 4.19.44 packages and security update | August 26, 2026 |
| RHSA-2026:57482 | (RHSA-2026:57482) Important: OpenShift Container Platform 4.18.54 packages and security update | August 26, 2026 |
| RHSA-2026:56852 | (RHSA-2026:56852) Important: OpenShift Container Platform 4.16.69 packages and security update | August 26, 2026 |
| RHSA-2026:60353 | (RHSA-2026:60353) Important: python-urwid security update | August 26, 2026 |
| RHSA-2026:60336 | (RHSA-2026:60336) Important: RHEL AI 3.3 RPM runtime CVE fix - ffmpeg | August 26, 2026 |
| RHSA-2026:60335 | (RHSA-2026:60335) Important: RHEL AI 3.5 RPM runtime CVE fix - ffmpeg | August 26, 2026 |
| RHSA-2026:60334 | (RHSA-2026:60334) Important: RHEL AI 3.4 RPM runtime CVE fix - ffmpeg | August 26, 2026 |
| RHSA-2026:60333 | (RHSA-2026:60333) Important: isns-utils security update | August 26, 2026 |
By the Year
In 2026 there have been 2953 vulnerabilities in Red Hat with an average score of 7.2 out of ten. Last year, in 2025 Red Hat had 1171 security vulnerabilities published. That is, 1782 more vulnerabilities have already been reported in 2026 as compared to last year. However, the average CVE base score of the vulnerabilities in 2026 is greater by 0.35.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 2953 | 7.20 |
| 2025 | 1171 | 6.85 |
| 2024 | 1692 | 6.82 |
| 2023 | 1206 | 6.75 |
| 2022 | 1362 | 6.96 |
| 2021 | 1123 | 6.61 |
| 2020 | 664 | 6.39 |
| 2019 | 772 | 6.98 |
| 2018 | 760 | 7.16 |
It may take a day or so for new Red Hat vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Red Hat Security Vulnerabilities
| CVE | Date | Vulnerability | Products |
|---|---|---|---|
| CVE-2026-79902 | Aug 26, 2026 |
A flaw was found in the Seattle FilmWorks plugin in GIMPA flaw was found in the Seattle FilmWorks plugin in GIMP. When processing a specially crafted SFW image file, the plugin allocates a Variable-Length Array (VLA) on the stack without integer overflow checks, causing an unbounded stack allocation. This issue leads to an application crash, resulting in a denial of service. |
Enterprise Linux (RHEL)
|
| CVE-2026-79654 | Aug 26, 2026 |
Katello CVH API Auth Bypass: Unauthorized Org AccessA flaw was found in Katello where the Content View History API does not properly enforce authorization when accessing a Content View specified by the user. An authenticated user with permission to view Content Views in one organization may be able to access the lifecycle history of a Content View belonging to another organization by supplying its identifier to the affected API endpoint. This can result in unauthorized disclosure of Content View lifecycle information, including publication and promotion events, associated users, and timestamps. |
Satellite
|
| CVE-2026-80185 | Aug 25, 2026 |
BlueZ sdp-xml.c Type Confusion in RegisterProfile() leads to Local DoSBlueZ sdp-xml.c type confusion via RegisterProfile(ServiceRecord) can crash bluetoothd (local DoS): a crafted nested ServiceRecord can corrupt the SDP XML parser stack so scalar union data is treated as a sequence pointer, allowing a local caller to crash bluetoothd. |
Enterprise Linux (RHEL)
|
| CVE-2026-80186 | Aug 25, 2026 |
BlueZ stack-based buffer overflow via crafted EIR packet (DoS/Arbitrary exec)A stack-based buffer overflow vulnerability exists in BlueZ, the Linux Bluetooth protocol stack. A remote user within Bluetooth radio range can send a specially crafted Extended Inquiry Response (EIR) packet that causes a buffer overflow when the target device performs Bluetooth discovery. This vulnerability can lead to a Denial of Service (DoS) by crashing the bluetoothd service and may allow for arbitrary code execution. |
Enterprise Linux (RHEL)
|
| CVE-2026-80101 | Aug 25, 2026 |
Heap OOB Read in GIMP file-xwd Plugin (Image Width/Bytes-Per-Line Validation)A flaw was found in the file-xwd plugin in GIMP. When processing a specially crafted XWD image file, the plugin validates the image width and bytes-per-line parameters independently rather than ensuring their combined values are consistent with the allocated buffer size. This incorrect validation leads to improper bounds checking, causing a heap out-of-bounds read. This issue can result in an application crash, leading to a denial of service, or a limited information disclosure of heap memory contents into the produced image. |
Enterprise Linux (RHEL)
|
| CVE-2026-77680 | Aug 25, 2026 |
LibSoup O(N2) Range Header CPU ExhaustionAn algorithmic complexity flaw exists in libsoup's HTTP Range header processing that persists after the CVE-2025-32907 fix. CVE-2025-32907 addressed memory amplification when a client repeated the same range many times in a single Range header. Commit 9bb92f7a corrected merge correctness in soup_message_headers_get_ranges_internal() in libsoup/soup-message-headers.c, but the coalescing loop still removes merged ranges using g_array_remove_index() for each coalesced element. Because GArray is contiguous, each mid-array removal performs an O(N) memmove. When many identical satisfiable ranges are supplied (for example bytes=0-0 repeated thousands of times), the loop performs O(N²) work coalescing them into a single range. The vulnerable path is reachable server-side from handle_partial_get() in libsoup/server/http1/soup-server-message-io-http1.c when a SoupServer handler returns HTTP 200 with a non-empty body. No authentication is required. The number of ranges is bounded only by the maximum request header size (~100 KiB), allowing roughly 25,000 ranges per request. Reporter measurements on libsoup HEAD containing the CVE-2025-32907 fix show ~90 ms single-core CPU per such request at the wire maximum, blocking the server's event loop for that duration. This is a CPU exhaustion / availability issue only. No memory corruption or information disclosure occurs. Affected: libsoup versions containing the CVE-2025-32907 fix but not merge request !550. Fixed upstream: MR !550 merged 2026-08-20, replacing per-element removal with O(N) in-place compaction and rejecting Range headers requesting more than 200 ranges. Upstream report: https://gitlab.gnome.org/GNOME/libsoup/-/issues/538 Related: CVE-2025-32907 |
Enterprise Linux (RHEL)
|
| CVE-2026-79992 | Aug 25, 2026 |
A flaw was found in Emacs TRAMPA flaw was found in Emacs TRAMP. A local attacker could exploit this vulnerability by processing maliciously crafted filenames. This occurs because TRAMP concatenates login arguments without proper sanitization, which are then passed to a local shell. Successful exploitation could lead to arbitrary code execution. |
Enterprise Linux (RHEL)
|
| CVE-2026-79717 | Aug 25, 2026 |
SSRF in galaxy_ng Ansible Galaxy plugin via avatar URLA server-side request forgery (SSRF) vulnerability was found in galaxy_ng, the Ansible Galaxy server plugin for Pulp. An authenticated user with namespace management permissions can set a namespace avatar URL to an arbitrary address, including internal networks, loopback, or cloud instance metadata endpoints. A background worker fetches that URL without checking the destination, which lets the attacker probe internal services and enumerate reachable IP addresses. The HTTP client is also configured without an overall timeout, so a slow or non-responsive target can pin workers and cause a denial of service. |
Ansible Automation Platform
|
| CVE-2026-79655 | Aug 25, 2026 |
Sos Clean Path Traversal Enables Arbitrary File Creation with Root PrivilegesA flaw was found in sos clean, a utility within the sos package. This vulnerability allows a local attacker to perform arbitrary file creation or overwrite. By crafting a malicious tar archive, an attacker can exploit a path traversal issue during tar extraction, where symlink and hardlink targets are not properly validated. This enables the attacker to write files to arbitrary locations on the system with the privileges of the sos clean process, which often runs as root. |
Enterprise Linux (RHEL)
|
| CVE-2026-79652 | Aug 25, 2026 |
Keycloak JWT Bearer Grant Bypass of User ConsentA flaw was found in the JWT Bearer authorization grant implementation within the keycloak-services component of Red Hat Build of Keycloak. This component handles various OAuth2 and OpenID Connect grant types used for issuing access tokens. The issue occurs because the JWT Bearer grant fails to check if a client requires user consent before issuing a token. This allows an authenticated attacker with valid client credentials and a trusted identity provider assertion to bypass the consent requirement and obtain unauthorized access to a user account at a consent-gated client. |
Build Keycloak
Red Hat Single Sign On
|
| CVE-2026-78701 | Aug 25, 2026 |
389-ds Base SASL UNBIND DoS via Remote Authenticated StallingA flaw was found in 389-ds-base. A remote, authenticated attacker could exploit a vulnerability in the Simple Authentication and Security Layer (SASL) UNBIND process. By sending a specially crafted request, the attacker can cause a connection to stall, leading to resource exhaustion and a Denial of Service (DoS) for the server. |
Directory Server
Enterprise Linux (RHEL)
|
| CVE-2026-78322 | Aug 25, 2026 |
File-roller Stack Buffer Overflow via Malicious Archive PathA flaw was found in file-roller. When opening or extracting a malicious 7z or RAR archive containing a file entry with an excessively long path, file-roller's progress-line parsing copies the path into a fixed-size stack buffer using an unbounded string copy. This can trigger a stack buffer overflow and cause file-roller to terminate, resulting in a denial of service. To exploit this flaw, a victim must open or extract the crafted archive using file-roller. |
Enterprise Linux (RHEL)
|
| CVE-2026-17113 | Aug 24, 2026 |
CRI-O Env Variable Crash via Nil Envs Causes Go Runtime PanicA flaw was found in CRI-O's container-creation environment-variable handling (`mergeEnvs` in `server/utils.go`, consumed by `setupContainerEnvironmentAndWorkdir` in `server/container_create.go`). When a `CreateContainer` request supplies a `nil` CRI `Envs` field, CRI-O falls back to using the target OCI image's `config.Env` entries unfiltered, in contrast to the normal merge path, which validates each entry for a `key=value` form before use. An OCI image whose `config.Env` contains an entry with no `=` character (e.g. a bare `NOEQUALS` string) causes CRI-O to split that entry into a single-element slice and then index its second element, which is out of range. This triggers an unrecovered Go runtime panic in the `crio` daemon process, crashing it and terminating the container-runtime service for all workloads on the node until it is restarted. |
Openshift
|
| CVE-2026-78475 | Aug 24, 2026 |
Unbounded Stack Allocation in GIMP file-pix (ESM) PluginA flaw was found in the file-pix (ESM) plugin in GIMP. When processing a specially crafted PIX image file, the plugin allocates a Variable-Length Array (VLA) on the stack without proper bounds checking, causing an unbounded stack allocation followed by a 21-byte stack over-read. This can result in a denial of service due to stack exhaustion and a limited information disclosure of stack memory contents into an intermediate file. |
Enterprise Linux (RHEL)
|
| CVE-2026-78465 | Aug 24, 2026 |
Heap-Based Buffer Overflow in GIMP file-pcx Plugin (32bit)A flaw was found in the file-pcx plugin in GIMP, affecting 32-bit builds only. When processing a PCX image file, the plugin calculates memory allocation sizes based on the image dimensions and the number of color planes. If a crafted file sets the number of planes to 4 alongside sufficiently large dimensions, the calculation exceeds the 32-bit integer limit and overflows, resulting in an undersized heap-based buffer allocation. This integer overflow issue results in a heap-based buffer overflow when the plugin subsequently writes image data into the undersized buffer, causing memory corruption, potentially leading to arbitrary code execution or a denial of service. |
Enterprise Linux (RHEL)
|
| CVE-2026-19685 | Aug 24, 2026 |
NetworkManager Vulnerable 802-1x.ca-path CA Path Bypass (CVE-2026-19685)NetworkManager did not apply the private_user restriction to the 802-1x.ca-path and phase2-ca-path directory-valued connection properties. This incomplete fix for CVE-2025-9615 allows an unprivileged local user to point a private WPA-Enterprise (802.1X) connection profile's CA path at an attacker-controlled directory, bypassing server certificate validation and enabling credential theft via a rogue access point. |
Enterprise Linux (RHEL)
Hummingbird
Openshift
And others... |
| CVE-2026-71366 | Aug 24, 2026 |
SSRF in Red Hat AWX Notif Backends: Webhook, Mattermost, Rocket.Chat, GrafanaA server-side request forgery (SSRF) vulnerability was found in multiple AWX notification backends. The webhook, Mattermost, Rocket.Chat, and Grafana notification backends use notification template URLs as direct HTTP request targets without validating the target address against private, loopback, or reserved IP ranges. An organization notification administrator can create notification templates pointing to internal or loopback addresses, causing the AWX control node to issue HTTP requests to services that are not externally accessible. Additionally, the webhook notification backend follows HTTP redirects and resends configured Basic Authentication credentials to redirect targets regardless of host change, allowing an attacker to exfiltrate notification credentials by redirecting to an attacker-controlled host. The Grafana backend sends its API key in the Authorization header to the configured target URL. |
Ansible Automation Platform
Ansible Automation Platform Developer
Ansible Automation Platform Inside
And others... |
| CVE-2026-71364 | Aug 24, 2026 |
AWX Project Archive Path Traversal for Arbitrary File WriteA path traversal vulnerability was found in AWX's project archive extraction. The project_archive action plugin extracts zip and tar archive members by joining the project directory path with the member filename without performing path normalization, boundary validation, or rejecting directory traversal sequences. A malicious archive containing members with path traversal components can write files to arbitrary locations on the execution node's filesystem outside the intended project directory. An attacker who controls the archive content, either through a compromised upstream source, a malicious archive URL, or a man-in-the-middle attack on a plain HTTP connection, can achieve arbitrary file writes as the user performing the extraction, potentially leading to remote code execution through mechanisms such as cron files, SSH authorized keys, or playbook content injection. |
Ansible Automation Platform
Ansible Automation Platform Developer
Ansible Automation Platform Inside
And others... |
| CVE-2026-78367 | Aug 24, 2026 |
rpmbuild Macro Injection via Tar Member NameA vulnerability was found in RPM's rpmbuild tarball processing. When processing a crafted source archive, the getTarSpec() function in tools/rpmbuild.cc passes an attacker-controlled tar archive member name to rpmExpand() as part of a %{basename:...} macro expression. A specially crafted .spec member name can therefore inject RPM macros, including Lua expressions, resulting in arbitrary code execution with the privileges of the user running rpmbuild. This can be exploited when a victim or automated build system processes an attacker-controlled source tarball using rpmbuild tarball mode (such as -ts, -ta, or -tb). |
Enterprise Linux (RHEL)
Hummingbird
Openshift
And others... |
| CVE-2026-78376 | Aug 24, 2026 |
WebKitGTK UAF via improper memory handling in WebKitGTKA flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory handling and result in memory corruption. |
Enterprise Linux (RHEL)
|
| CVE-2026-78323 | Aug 24, 2026 |
Trust Anchor Validation Flaw in JSS JSSTrustManagerA flaw was found in JSS (Java Security Services). The JSSTrustManager class does not verify NSS trust flags when validating CA certificates, allowing certificates present in the NSS database without TRUSTED_CA flags to be accepted as trust anchors for TLS connections. In non-default configurations where certificate revocation checking is disabled, this could allow a man-in-the-middle attacker to forge certificates accepted by PKI client connections. |
Certificate System
Enterprise Linux (RHEL)
|
| CVE-2026-74581 | Aug 21, 2026 |
Linux Kernel: Stale IPv6 Route Leak Due to fib6 Rule SuppressionIn the Linux kernel, the following vulnerability has been resolved: net: ipv6: clear suppressed fib6 rule result fib6_rule_suppress() drops a suppressed route with ip6_rt_put_flags(), but leaves res->rt6 pointing at the released rt6_info. If no later rule supplies a replacement, fib6_rule_lookup() still sees res.rt6 and returns that stale dst to its caller. A suppressing rule can therefore leak a released route back to rt6_lookup(), and the next put hits rcuref_put_slowpath() from dst_release(). Clear res->rt6 when suppressing the route so suppressed lookups fall through to the null dst instead of reusing the released one. |
|
| CVE-2026-73267 | Aug 21, 2026 |
MCE clusterclaims-controller DoS via unauthorized ManagedCluster deletionA flaw was found in the clusterclaims-controller component of multicluster engine (MCE). A tenant with standard permissions to create and delete ClusterClaim resources can exploit this by manipulating the `spec.namespace` field. This allows the tenant to specify and delete any ManagedCluster, including the hub's local-cluster or other tenants' clusters, due to a missing ownership check. This vulnerability can lead to a denial of service by enabling unauthorized deletion of ManagedClusters. |
Multicluster Engine
|
| CVE-2026-73137 | Aug 20, 2026 |
RHACM multicloud-operators-subscription: privilege escalation allows exfilA flaw was found in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management (RHACM). A tenant with HelmRelease create permissions can exploit this vulnerability by manipulating the `secretRef.Namespace` field. This allows the `GetSecret()` function in the HelmRelease controller to fetch sensitive credentials from any namespace, which are then sent to an attacker-controlled Helm repository. This can lead to the exfiltration of credentials from arbitrary namespace Secrets, resulting in information disclosure. |
Acm
|
| CVE-2026-67567 | Aug 20, 2026 |
Arbitrary k8s resource deployment via HelmRelease multicloud-operator-subscriptionA flaw was found in the multicloud-operators-subscription component. This vulnerability allows a tenant, who has the ability to create HelmRelease custom resources (CRs), to bypass existing security controls. The system's HelmRelease controller processes Helm chart templates using its own elevated ServiceAccount privileges without proper validation. This enables the tenant to deploy arbitrary resources across the entire cluster, leading to a significant security compromise. |
Acm
|
| CVE-2026-66788 | Aug 20, 2026 |
Lighthouse Namespace Injection for Unauthorized EndpointSlice/ServiceImportA flaw was found in Lighthouse. A remote attacker, by compromising a spoke cluster, can exploit a vulnerability where the destination namespace for resource injection is derived from an attacker-controlled label or annotation on the broker object. This allows the attacker to inject unauthorized EndpointSlices and ServiceImports into any namespace on peer clusters, including critical system namespaces like kube-system and openshift-*. This could lead to privilege escalation or other forms of system compromise within the cluster. |
Acm
|
| CVE-2026-66787 | Aug 20, 2026 |
RedHat AMK Lighthouse IP validation flaw enabling MITMA flaw was found in the lighthouse component of Red Hat Advanced Cluster Management for Kubernetes. This vulnerability stems from insufficient validation of advertised IP addresses within EndpointSlice objects. A compromised spoke cluster can exploit this by creating EndpointSlices with attacker-controlled IP addresses, causing other clusters' lighthouse DNS to redirect legitimate service traffic to malicious endpoints. This enables a remote attacker to conduct transparent Man-in-the-Middle (MITM) attacks on cross-cluster service communications, potentially leading to unauthorized information disclosure and data manipulation. |
Acm
|
| CVE-2026-66785 | Aug 20, 2026 |
Red Hat Submariner Unauthorized Network Traffic Redirection VulnerabilityA flaw was found in Submariner. This vulnerability allows a malicious cluster (spoke) to redirect network traffic from other connected clusters (peer clusters) by publishing a specially crafted network endpoint. The system fails to properly validate the network subnets provided by the malicious cluster, enabling it to declare arbitrary network ranges. Consequently, all network traffic intended for these arbitrary ranges from peer clusters will be rerouted through the attacker's tunnel, potentially leading to unauthorized information disclosure or network disruption. |
Acm
|
| CVE-2026-18299 | Aug 20, 2026 |
GStreamer rtpsbcdepay UAF RCE VulnerabilityGStreamer rtpsbcdepay Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the processing of RTP payload elements. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29787. |
|
| CVE-2026-18298 | Aug 20, 2026 |
GStreamer png Plugin Heap Overflow RCEGStreamer PNG File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PNG files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29581. |
|
| CVE-2026-18297 | Aug 20, 2026 |
GStreamer OGG Stack Buffer Overflow RCEGStreamer OGG File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of OGG files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29584. |
|
| CVE-2026-18296 | Aug 20, 2026 |
GStreamer MRF Heap Overflow RCE via File ParsingGStreamer MRF File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of MRF files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29608. |
|
| CVE-2026-18295 | Aug 20, 2026 |
GStreamer MRF OOB Write RCE VulnerabilityGStreamer MRF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of MRF files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29510. |
|
| CVE-2026-77176 | Aug 20, 2026 |
Kata Containers: Host Operator Elevates Priv via CreateContainer Mount ValidationA flaw was found in Kata Containers. In configurations utilizing genpolicy for Confidential Containers guest protection, a malicious host operator can exploit insufficient validation of CreateContainer mount and storage rules. This allows them to mount arbitrary container-rootfs paths over sensitive host locations or provision arbitrary content, potentially exposing confidential information or enabling the acceptance of attacker-controlled input. |
Openshift
|
| CVE-2026-19611 | Aug 20, 2026 |
WildFly Elytron Unicode Normalization Weakens Password HashingA flaw was found in WildFly Elytron. Password hashing and verification normalize input with Unicode NFKC, which can collapse fullwidth characters to ASCII equivalents. A remote attacker can more easily guess affected passwords by using an ASCII-only dictionary against accounts whose passwords were intended to include those non-ASCII characters, leading to unauthorized access. |
Camel Quarkus
Debezium
Build Keycloak
And others... |
| CVE-2026-73199 | Aug 20, 2026 |
Null Pointer Deref in FreeIPA ipa-enrollment SLAPI (DoS)A flaw was found in the `ipa-enrollment` SLAPI plugin. A remote authenticated client can exploit a null pointer dereference vulnerability by sending a malformed Lightweight Directory Access Protocol (LDAP) extended operation. By omitting the request value for the `JOIN_OID` in the `ipa-enrollment` extended operation, an attacker can trigger a server crash, potentially causing a denial of service. |
Enterprise Linux (RHEL)
|
| CVE-2026-11861 | Aug 20, 2026 |
Privilege Escalation: PAC Omission in FreeIPA AD TrustA flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services, including the portal, SMB server, and LDAP directory. This is possible by impersonating a client name in the Ticket Granting Service (TGS) due to FreeIPA services not verifying Privilege Attribute Certificate (PAC) certificates. This vulnerability could allow an authenticated Active Directory user to escalate their privileges within the FreeIPA domain. |
Enterprise Linux (RHEL)
|
| CVE-2026-73198 | Aug 20, 2026 |
FreeIPA Memory Exhaustion DoS via Large /ipa/i18n_messages RequestA flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit a vulnerability in the `/ipa/i18n_messages` endpoint by sending an arbitrarily large request body. This can cause the service to consume excessive memory, leading to memory exhaustion, degraded responsiveness, and a denial of service (DoS) condition. |
Enterprise Linux (RHEL)
|
| CVE-2026-13097 | Aug 20, 2026 |
FreeIPA Kerberos Principal Uniqueness Flaw Priv EscalationA privilege escalation flaw was found in FreeIPA. The uniqueness constraint enforced on Kerberos principal name attributes in the 389-ds directory server does not properly account for equivalent representations of the same principal name, allowing a user with sufficient LDAP write privileges to create a service principal that impersonates an existing privileged one. This can lead to unauthorized acquisition of Kerberos service tickets for sensitive services, potentially resulting in full domain compromise. |
Enterprise Linux (RHEL)
|
| CVE-2026-73196 | Aug 20, 2026 |
FreeIPA CPU DoS via Oversized OTP KeyA flaw was found in FreeIPA. A low-privilege authenticated user can exploit this vulnerability by submitting an oversized One-Time Password (OTP) key value. This oversized key is then decoded and re-encoded without proper size limits, consuming excessive CPU and memory resources. This can lead to a denial of service, degrading the availability of the IPA service. |
Enterprise Linux (RHEL)
|
| CVE-2026-73197 | Aug 20, 2026 |
FreeIPA DoS via Oversized POST: /ipa/migration/migration.pyA flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit this vulnerability by sending oversized form POST requests to the `/ipa/migration/migration.py` endpoint. This can force the migration handler to read attacker-controlled request bodies fully into memory, leading to increased memory usage, slower request handling, and potential service disruption or denial of service. |
Enterprise Linux (RHEL)
|
| CVE-2026-18917 | Aug 20, 2026 |
libvirt NodeGetFreePages Int Overflow (Privilege Escalation)A flaw was found in libvirt. An unprivileged local user could exploit an integer overflow vulnerability in the NodeGetFreePages RPC handler. This flaw allows crafted values to bypass a size check, leading to an undersized memory buffer. Subsequently, real NUMA node data can overwrite this buffer. This heap buffer overflow can corrupt the root libvirt daemon's memory, potentially leading to a denial of service or local privilege escalation. |
Enterprise Linux (RHEL)
Enterprise Linux Nvidia
|
| CVE-2026-77014 | Aug 20, 2026 |
libsoup HTTP Range Header Partial Content Bug (CVE-2026-77014)A flaw was found in libsoup's SoupServer HTTP Range header processing. The sort_ranges() comparator in soup-message-headers.c truncates a 64-bit subtraction result to 32-bit int, flipping the sign for range offsets differing by more than INT_MAX. This causes silent omission of requested byte ranges from HTTP 206 Partial Content responses on resources larger than approximately 2 GB. |
Enterprise Linux (RHEL)
Openshift
|
| CVE-2026-19582 | Aug 20, 2026 |
Binutils <2.46.1: PE File Stack Bof Arbitrary Code ExecIn binutils 2.46.1 and prior versions, a victim who opens a crafted PE file using binutils could execute arbitrary code unknowningly via a stack buffer overflow out of bounds write. |
Rhmt
Enterprise Linux (RHEL)
Hummingbird
And others... |
| CVE-2026-76827 | Aug 19, 2026 |
Auth Cluster Index Tampering via Delta-Sync in Search-IndexerA flaw was found in search-indexer. This vulnerability allows a registered and authenticated managed cluster to tamper with or delete another cluster's indexed search data. This is possible because the delta-sync write paths in search-indexer do not properly restrict UPDATE/DELETE operations to data owned by the calling cluster. An attacker could exploit this by crafting specific user identifiers (UIDs) with a different cluster's prefix. |
Acm
|
| CVE-2026-76139 | Aug 19, 2026 |
Unverified Remote Script in RH acm-operator-bundle Grants Build AccessA flaw was found in acm-operator-bundle. The build process for this component downloads and runs a script from a remote source without verifying its authenticity or integrity. This script gains access to sensitive credentials, such as GitHub access tokens and registry passwords, used in the build environment. A remote attacker could exploit this vulnerability to inject malicious code, leading to unauthorized access to build resources and potential compromise of the resulting operator bundle. |
Acm
|
| CVE-2026-75569 | Aug 19, 2026 |
mce-operator-bundle Build Process Code Injection via Unverified Remote ScriptsA flaw was found in mce-operator-bundle. The build process fetches and executes scripts from a remote repository without performing integrity checks, such as commit pinning or signature verification. This allows a malicious actor with write access to the remote repository to inject and execute arbitrary code during the build. The consequence is a compromised build process, potentially leading to the distribution of malicious software. |
Multicluster Engine
|
| CVE-2026-70496 | Aug 19, 2026 |
Privilege Escalation via overpriv ClusterRole in search-v2-operator (Red Hat)A flaw was found in search-v2-operator. The operator's ClusterRole has permissions equivalent to a cluster administrator, allowing it to impersonate other entities, write Role-Based Access Control (RBAC) configurations, approve Certificate Signing Requests (CSRs), and manage ManifestWork. This grants excessive privileges beyond what is necessary for the operator's intended function, potentially leading to privilege escalation within the cluster. |
Acm
|
| CVE-2026-18874 | Aug 19, 2026 |
RedHat volsync-addon-controller: YAML Injection via OLM Subscription AnnotationA flaw was found in volsync-addon-controller. This vulnerability allows an attacker to inject malicious YAML (Yet Another Markup Language) code into the OpenShift Lifecycle Manager (OLM) Subscription resource. This is due to improper escaping of annotation values when they are rendered into YAML. Successful exploitation could lead to unauthorized modification or control over OLM Subscription configurations, potentially impacting software management within the cluster. This issue primarily affects systems where the 'volsync-addon-deploy-type: olm' annotation is explicitly enabled. |
Acm
|
| CVE-2026-66794 | Aug 19, 2026 |
Red Hat Multicluster Engine cluster-proxy-addon/CVE-2026-66794: Auth BypassA flaw was found in the `cluster-proxy-addon` component of Multicluster Engine for Kubernetes. This vulnerability allows an unauthenticated attacker, who can access the user-facing route, to bypass authentication and authorization checks. By manipulating URL path segments, the attacker can proxy requests to arbitrary services across any managed cluster. This enables unauthorized access to internal services that would otherwise be protected, potentially leading to information disclosure or further compromise of the cluster environment. |
Multicluster Engine
|