Red Hat Linux OS and other open source products

Don't miss out!

Thousands of developers use stack.watch to stay informed.
Get an email whenever new security vulnerabilities are reported in any Red Hat product.

RSS Feeds for Red Hat security vulnerabilities

Create a CVE RSS feed including security vulnerabilities found in Red Hat products with stack.watch. Just hit watch, then grab your custom RSS feed url.

Products by Red Hat Sorted by Most Security Vulnerabilities since 2018

Red Hat Enterprise Linux (RHEL)2683 vulnerabilities

Red Hat Enterprise Linux Server1534 vulnerabilities
RedHat Enterprise Linux (RHEL) Server. Includes software bundeled with RHEL server.

Red Hat Enterprise Linux Workstation1504 vulnerabilities
RedHat Enterprise Linux (RHEL) Workstation. Includes software bundled with RHEL Workstation.

Red Hat Enterprise Linux Desktop1493 vulnerabilities
RedHat Enterprise Linux (RHEL) Desktop. Includes software bundled with RHEL desktop

Red Hat Enterprise Linux Eus1135 vulnerabilities

Red Hat Enterprise Linux Server Aus884 vulnerabilities

Red Hat Enterprise Linux Server Tus701 vulnerabilities

Red Hat Openshift605 vulnerabilities

Red Hat Rhel Eus587 vulnerabilities

Red Hat Rhel E4s490 vulnerabilities

Red Hat Rhel Tus436 vulnerabilities

Red Hat Rhel Aus427 vulnerabilities

Red Hat Enterprise Linux Server Eus414 vulnerabilities

Red Hat Satellite362 vulnerabilities

Red Hat Rhel Eus Long Life344 vulnerabilities

Red Hat Rhel Els330 vulnerabilities

Red Hat Openshift Ai325 vulnerabilities

Red Hat Jboss Enterprise Application Platform297 vulnerabilities

Red Hat Hummingbird280 vulnerabilities

Red Hat Openstack277 vulnerabilities

Red Hat Jbosseapxp236 vulnerabilities

Red Hat Openshift Container Platform230 vulnerabilities

Red Hat Build Keycloak219 vulnerabilities

Red Hat Jboss Fuse208 vulnerabilities

Red Hat Ansible Automation Platform204 vulnerabilities

Red Hat Rhivos199 vulnerabilities

Red Hat Jboss Data Grid197 vulnerabilities

Red Hat Single Sign On176 vulnerabilities

Red Hat Quay154 vulnerabilities

Red Hat Enterprise Linux Ai154 vulnerabilities

Red Hat Openshift Devspaces153 vulnerabilities

Red Hat Acm147 vulnerabilities

Red Hat Rhdh124 vulnerabilities

Red Hat Software Collections123 vulnerabilities

Red Hat Keycloak123 vulnerabilities

Red Hat Cryostat120 vulnerabilities

Red Hat Virtualization115 vulnerabilities

Red Hat Discovery114 vulnerabilities

Red Hat Enterprise Linux Ibm Z Systems108 vulnerabilities

Red Hat Ai Inference Server105 vulnerabilities

Red Hat Kafka104 vulnerabilities

Red Hat Enterprise Linux Power Little Endian103 vulnerabilities

Red Hat Jboss Enterprise Bpms Platform100 vulnerabilities

Red Hat Trusted Artifact Signer96 vulnerabilities

Red Hat Single Sign On95 vulnerabilities

Red Hat Ceph Storage94 vulnerabilities

Red Hat Multicluster Engine94 vulnerabilities

Red Hat Openshift Pipelines94 vulnerabilities

Red Hat Apache Camel Hawtio92 vulnerabilities

Red Hat Advanced Cluster Security91 vulnerabilities

Red Hat Container Native Virtualization90 vulnerabilities

Red Hat Enterprise Linux Power Little Endian Eus88 vulnerabilities

Red Hat Amq Streams84 vulnerabilities

Red Hat Service Mesh84 vulnerabilities

Red Hat Camel Spring Boot84 vulnerabilities

Red Hat Enterprise Linux Ibm Z Systems Eus82 vulnerabilities

Red Hat Logging82 vulnerabilities

Red Hat Openshift Data Foundation81 vulnerabilities

Red Hat Rhui79 vulnerabilities

Red Hat Amq Broker77 vulnerabilities

Red Hat Ansible Portal77 vulnerabilities

Red Hat Openshift Lightspeed75 vulnerabilities

Red Hat Serverless75 vulnerabilities

Red Hat Ansible Automation Platform Developer72 vulnerabilities

Red Hat Http Server72 vulnerabilities

Red Hat Enterprise Linux Scientific Computing71 vulnerabilities

Red Hat Migration Toolkit Applications70 vulnerabilities

Red Hat Ansible Tower69 vulnerabilities

Red Hat Openshift Gitops68 vulnerabilities

Red Hat Ansible Automation Platform Inside63 vulnerabilities

Red Hat Quarkus63 vulnerabilities

Red Hat 3scale Amp62 vulnerabilities

Red Hat Enterprise Linux Server Power Little Endian Update Services Sap Solutions61 vulnerabilities

Red Hat Apache Camel Spring Boot58 vulnerabilities

Red Hat Podman Desktop58 vulnerabilities

Red Hat Apicurio Registry56 vulnerabilities

Red Hat Libvirt55 vulnerabilities

Red Hat Rhmt55 vulnerabilities

Red Hat Service Registry54 vulnerabilities

Red Hat Camel Quarkus54 vulnerabilities

Red Hat Multicluster Globalhub54 vulnerabilities

Red Hat Satellite Capsule53 vulnerabilities

Red Hat Virtualization Host53 vulnerabilities

Red Hat Openshift Distributed Tracing52 vulnerabilities

Red Hat Network Observ Optr51 vulnerabilities

Red Hat Directory Server47 vulnerabilities

Red Hat Enterprise Linux Power Big Endian45 vulnerabilities

Red Hat Jboss Core Services45 vulnerabilities

Red Hat Insights Proxy44 vulnerabilities

Red Hat Enterprise Linux Server Update Services Sap Solutions43 vulnerabilities

Red Hat Enterprise Linux For Real Time43 vulnerabilities

Red Hat Ansible42 vulnerabilities

Red Hat Enterprise Linux For Arm 6442 vulnerabilities

Red Hat Confidential Compute Attestation42 vulnerabilities

Red Hat Enterprise Linux Aus41 vulnerabilities

Recent Red Hat Security Advisories

Advisory	Title	Published
RHSA-2026:54553	(RHSA-2026:54553) Important: OpenShift Container Platform 4.19.43 bug fix and security update	August 19, 2026
RHSA-2026:54544	(RHSA-2026:54544) Important: OpenShift Container Platform 4.18.53 bug fix and security update	August 19, 2026
RHSA-2026:54883	(RHSA-2026:54883) Important: Red Hat build of MicroShift 4.19.43 security update	August 19, 2026
RHSA-2026:56869	(RHSA-2026:56869) Important: Red Hat JBoss Core Services Apache HTTP Server 2.4.62 SP5 security update	August 19, 2026
RHSA-2026:56971	(RHSA-2026:56971) Important: perl-Date-Manip security update	August 19, 2026
RHSA-2026:56970	(RHSA-2026:56970) Important: perl-Date-Manip security update	August 19, 2026
RHSA-2026:56966	(RHSA-2026:56966) Moderate: gstreamer1-plugins-good security update	August 19, 2026
RHSA-2026:56965	(RHSA-2026:56965) Moderate: libcupsfilters security update	August 19, 2026
RHSA-2026:56963	(RHSA-2026:56963) Important: gegl04 security update	August 19, 2026
RHSA-2026:56959	(RHSA-2026:56959) Important: osbuild-composer security update	August 19, 2026

By the Year

In 2026 there have been 2814 vulnerabilities in Red Hat with an average score of 7.2 out of ten. Last year, in 2025 Red Hat had 1171 security vulnerabilities published. That is, 1643 more vulnerabilities have already been reported in 2026 as compared to last year. However, the average CVE base score of the vulnerabilities in 2026 is greater by 0.32.

Year	Vulnerabilities	Average Score
2026	2814	7.17
2025	1171	6.85
2024	1691	6.82
2023	1206	6.74
2022	1362	6.96
2021	1123	6.61
2020	664	6.39
2019	772	6.98
2018	760	7.16

It may take a day or so for new Red Hat vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.

Recent Red Hat Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2026-18874	Aug 19, 2026	A flaw was found in volsync-addon-controller A flaw was found in volsync-addon-controller. This vulnerability allows an attacker to inject malicious YAML (Yet Another Markup Language) code into the OpenShift Lifecycle Manager (OLM) Subscription resource. This is due to improper escaping of annotation values when they are rendered into YAML. Successful exploitation could lead to unauthorized modification or control over OLM Subscription configurations, potentially impacting software management within the cluster. This issue primarily affects systems where the 'volsync-addon-deploy-type: olm' annotation is explicitly enabled.	Acm
CVE-2026-66794	Aug 19, 2026	A flaw was found in the `cluster-proxy-addon` component of Multicluster Engine for Kubernetes A flaw was found in the `cluster-proxy-addon` component of Multicluster Engine for Kubernetes. This vulnerability allows an unauthenticated attacker, who can access the user-facing route, to bypass authentication and authorization checks. By manipulating URL path segments, the attacker can proxy requests to arbitrary services across any managed cluster. This enables unauthorized access to internal services that would otherwise be protected, potentially leading to information disclosure or further compromise of the cluster environment.	Multicluster Engine
CVE-2026-71470	Aug 19, 2026	Privilege Escalation via Unvalidated Env Setup in Red Hat Search Operator A flaw was found in the search-v2-operator. This vulnerability allows a privileged user, specifically a Custom Resource (CR) editor, to manipulate Search CR fields such as imageOverride, arguments, and environment variables without proper validation. By exploiting this, an attacker can mount arbitrary secrets into a search container's environment or replace the container image with an attacker-controlled one. This leads to privilege escalation and can result in a full cluster compromise due to the ServiceAccount's extensive impersonation permissions.	Acm
CVE-2026-43961	Aug 19, 2026	Vim netrw Arbitrary Vimscript via Quote Breakout in Mark/Unmark A flaw was found in Vim's netrw plugin. A crafted filename containing quote characters and expression fragments can break out of the quoted context during mark/unmark operations, allowing arbitrary Vimscript execution. This can be leveraged to run shell commands with the privileges of the user running Vim.	Enterprise Linux (RHEL) Openshift
CVE-2026-76235	Aug 19, 2026	Cockpit-ws Memory Leak Allows Remote DoS via Unauth Request A memory leak flaw was found in cockpit-ws. The login page handler leaks a heap allocation on every unauthenticated request that carries a CockpitLang cookie, allowing a remote unauthenticated attacker to exhaust memory on the host and cause a denial of service.	Enterprise Linux (RHEL) Openshift Devspaces
CVE-2026-76166	Aug 19, 2026	mod_cluster AdvertiseListener NullPointerException via UDP Multicast A flaw was found in mod_cluster's AdvertiseListenerImpl (org.jboss.modcluster core module). A single crafted UDP multicast datagram with a valid HTTP status line and a "Server:" header but without the "Date:", "Digest:", and "Sequence:" headers triggers a NullPointerException in verifyDigest() that is not caught by the worker thread's exception handler. This causes the advertise listener thread to terminate permanently. The failure is silent (isListening() continues to return true) and persists until the node is restarted. The crash occurs before the AdvertiseSecurityKey comparison, so deployments with a configured security key are still affected.	Jboss Enterprise Application Platform Jbosseapxp Jboss Enterprise Web Server And others...
CVE-2026-75900	Aug 19, 2026	swtpm OOB read in SWTPM_NVRAM_CheckHeader: heap overread & log leak An out-of-bounds read vulnerability was found in swtpm's SWTPM_NVRAM_CheckHeader() function. The entry guard checks the buffer length against sizeof(bh), where bh is a pointer, instead of sizeof(*bh), the actual struct size. This allows an undersized buffer to pass validation, causing a 2-byte heap overread on 64-bit systems (6 bytes on 32-bit) when accessing the totlen field. This may cause daemon termination on some platforms and leaks heap data to the log.	Enterprise Linux (RHEL)
CVE-2026-15571	Aug 18, 2026	A flaw was found in the legacy client-initiated account-linking endpoint of Keycloak A flaw was found in the legacy client-initiated account-linking endpoint of Keycloak, a widely used open-source identity and access management solution. The mechanism used to protect the account-linking process from unauthorized requests relies on a hash that can be predicted by a malicious OIDC client. By tricking a user into authenticating, an attacker-controlled client can forge a valid linking URL to connect the victim's account to an attacker's external identity. This results in a full account takeover, allowing the attacker to log in as the victim.	Build Keycloak Jboss Data Grid Jbosseapxp And others...
CVE-2026-66780	Aug 18, 2026	A flaw was found in the submariner-operator component A flaw was found in the submariner-operator component. The `submariner-k8s-broker-cluster` Role, which is assigned to joined clusters, possesses excessive permissions. This allows a compromised cluster to alter network configurations, specifically by overwriting other clusters' endpoint information. Consequently, an attacker can redirect inter-cluster tunnel traffic, enabling a Man-in-the-Middle (MITM) attack across the entire cluster mesh.	Acm
CVE-2026-66783	Aug 18, 2026	Red Hat ACMM Submariner-Operator Escalation via Unvalidated Image Path A flaw was found in the `submariner-operator` component of Red Hat Advanced Cluster Management for Kubernetes. This vulnerability allows a cluster administrator, or any user with permissions to modify the Submariner Custom Resource (CR), to specify an unvalidated image path. This lack of validation enables an attacker to execute arbitrary code with elevated privileges across the entire cluster, including control-plane nodes, by deploying a malicious image.	Acm
CVE-2026-66782	Aug 18, 2026	Submariner Operator: Broker SA Token Exposure Grants Full Mesh Control A flaw was found in the Submariner operator. This vulnerability allows for the exposure of a long-lived broker service account (SA) bearer token within the Submariner Custom Resource (CR) specification. An attacker with access to the cluster's etcd database or through `kubectl get` commands could obtain this token. The possession of this token grants full control over the mesh network, enabling unauthorized management of network resources such as endpoints and secrets.	Acm
CVE-2026-66781	Aug 18, 2026	Submariner Operator Exposes Unencrypted IPsec PSK A flaw was found in the Submariner operator. The Submariner Custom Resource (CR), used for configuring network connectivity, stores the IPsec pre-shared key (PSK) in an unencrypted format. This key, which is critical for securing communication between Kubernetes clusters, can be accessed by unauthorized parties. Such access enables an attacker to passively decrypt network traffic flowing between any two clusters in the mesh, resulting in sensitive information disclosure.	Acm
CVE-2026-18963	Aug 18, 2026	Unauthenticated Reset Credentials in KeycloakServices (Red Hat Build) A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials.	Build Keycloak Jbosseapxp Red Hat Single Sign On And others...
CVE-2026-75924	Aug 18, 2026	A flaw was found in managed-serviceaccount A flaw was found in managed-serviceaccount. A compromised addon-manager pod, due to its ClusterRole granting excessive permissions, can read any secret across all namespaces. Additionally, it can approve arbitrary Certificate Signing Requests (CSRs), which could lead to information disclosure and privilege escalation within the cluster.	Acm Multicluster Engine
CVE-2026-71365	Aug 18, 2026	A server-side request forgery (SSRF) vulnerability was found in AWX's webhook status callback mechanism A server-side request forgery (SSRF) vulnerability was found in AWX's webhook status callback mechanism. When processing GitHub pull request webhooks, AWX extracts the status callback URL (pull_request.statuses_url) from the incoming webhook payload without validating the target host against the expected Git provider. This URL is persisted in job extra variables and later used to send authenticated status updates. A user with admin role on a webhook-enabled job template can read the template's webhook signing key, forge a signed GitHub webhook payload with an arbitrary statuses_url, and cause AWX to POST status updates to an attacker-controlled or internal URL. The status update request includes the configured Git Personal Access Token (PAT) in the Authorization header, resulting in credential leakage to the attacker-specified endpoint.	Ansible Automation Platform
CVE-2026-12564	Aug 18, 2026	A flaw was found in the AAP Controller's HashiCorp Vault credential plugin A flaw was found in the AAP Controller's HashiCorp Vault credential plugin. The kubernetes_auth() function in awx_plugins/credentials/hashivault.py reads the controller pod's Kubernetes service account token and sends it to an attacker-controlled URL when a HashiCorp Vault Secret Lookup credential with kubernetes_role authentication is tested. An authenticated attacker with credential-creation privileges can exfiltrate the service account token, gaining Kubernetes API access to the control plane namespaces with full pod CRUD and secret read permissions, including database credentials and the Django SECRET_KEY.	Ansible Automation Platform
CVE-2026-75485	Aug 18, 2026	A flaw was found in the must-gather component of Red Hat Advanced Cluster Management for Kubernetes A flaw was found in the must-gather component of Red Hat Advanced Cluster Management for Kubernetes. The cluster Proxy object is dumped in raw form, bypassing the oc inspect redaction that would normally sanitize sensitive fields. This exposes proxy basic-auth credentials in the must-gather archive, potentially disclosing sensitive authentication information to anyone with access to the archive.	Acm
CVE-2026-73834	Aug 18, 2026	A flaw was found in the must-gather component of Red Hat Advanced Cluster Management for Kubernetes A flaw was found in the must-gather component of Red Hat Advanced Cluster Management for Kubernetes. Certain ACM wrapper Custom Resources that embed Secret data are collected without redaction. When an administrator runs must-gather, credentials and tokens are captured in cleartext in the resulting archive, potentially exposing sensitive information to anyone with access to the archive.	Acm
CVE-2026-66793	Aug 18, 2026	A flaw was found in the governance-policy-addon-controller component of Red Hat Advanced Cluster Management for Kubernetes A flaw was found in the governance-policy-addon-controller component of Red Hat Advanced Cluster Management for Kubernetes. A user with permissions to annotate the namespaced ManagedClusterAddOn resource can override the governance-policy container image. This allows an attacker to run a controlled image with cluster-admin privileges on the managed cluster, leading to arbitrary code execution and privilege escalation.	Acm
CVE-2026-75032	Aug 18, 2026	BlueZ AVRCP Packet Length Validation Bypass -> DoS A flaw was found in BlueZ. Insufficient validation of packet length fields in GetFolderItems responses within the Audio/Video Remote Control Profile (AVRCP) implementation allows a malicious Bluetooth device within range to cause an out-of-bounds memory read. This vulnerability, affecting the parse_media_element() and parse_media_folder() functions, can lead to a crash of the bluetoothd daemon, resulting in a Denial of Service (DoS). It could also potentially expose sensitive heap memory contents. Exploitation requires user interaction to pair with the malicious device.	Enterprise Linux (RHEL)
CVE-2026-19608	Aug 18, 2026	Keycloak Group Policy Eval Bug: Group Name Ambiguity Allows Unauthorized Access A flaw was found in the group policy provider of Keycloak authorization services, which is used to manage fine-grained access control to resources. The issue occurs when the system evaluates group-based policies using tokens that only contain group names rather than full paths. If two groups in different parts of the organization share the same name, a user in the unauthorized group can be mistaken for a member of the authorized group. This can allow a user to gain unauthorized access to protected resources they should not be able to reach.	Build Keycloak Red Hat Single Sign On
CVE-2026-66795	Aug 17, 2026	Privilege Escalation in Red Hat managedcluster-import-controller via Improper CSR Validation A flaw was found in the managedcluster-import-controller. The Certificate Signing Request (CSR) auto-approval logic improperly validates incoming CSRs, specifically by not inspecting the signer name or decoding the PEM-encoded x509 CSR. This vulnerability allows a privileged service account on a spoke cluster to submit a malicious CSR. Successful exploitation can lead to privilege escalation, enabling the attacker to obtain administrative credentials on the hub cluster.	Multicluster Engine
CVE-2026-71472	Aug 17, 2026	acm-search-v2-rhel9 RHEL9 RCE via WORK_MEM injection A flaw was found in acm-search-v2-rhel9. This vulnerability allows an authenticated attacker, such as a hub administrator or a Search Custom Resource (CR) editor, to inject malicious shell commands or SQL statements. This occurs because the WORK_MEM string provided in the Search CR is not properly validated before being used in a bash script and an SQL query. Successful exploitation could lead to arbitrary code execution within the privileged postgres pod, potentially compromising the system.	Acm
CVE-2026-70495	Aug 17, 2026	CVE-2026-70495: Overly Broad Permissions in Red Hat Search V2 Operator ServiceAccount A flaw was found in search-v2-operator. This component's `search-serviceaccount` has overly broad permissions, allowing it to impersonate users and groups across the entire cluster. If an attacker gains access to any of the pods running under this service account, they could exploit this to achieve `system:masters` access, granting them full control over the cluster.	Acm
CVE-2026-66792	Aug 17, 2026	Red Hat Multi-Cloud Operators Subscription PrivEsc via Crafted Annotations A flaw was found in the multicloud-operators-subscription component. This vulnerability allows a user on a managed cluster to escalate their privileges by creating a Subscription with specific, crafted annotations. Successful exploitation grants the attacker the ability to deploy resources into any namespace with the elevated permissions of the controller's Service Account, potentially leading to unauthorized access and control over cluster resources.	Multicluster Globalhub Acm Openshift And others...
CVE-2026-15218	Aug 17, 2026	Risky OpenShift AI ServiceAccounts Grant Cluster-Admin Privileges A flaw was found in the maas-api and maas-controller ServiceAccounts within Red Hat OpenShift AI. These ServiceAccounts are granted cluster-wide permissions that exceed their operational requirements. An attacker who compromises the identity of these ServiceAccounts, either through a remote code execution vulnerability or by creating a malicious pod in the same namespace, could exploit these excessive permissions. This could lead to full cluster administrator privileges through the creation of new ClusterRoleBindings or the disclosure of sensitive information by accessing all secrets across the cluster.	Openshift Ai
CVE-2026-74247	Aug 14, 2026	Red Hat Quay SSRF via Build API (FEATURE_BUILD_SUPPORT) A flaw was found in Red Hat Quay. A user with FEATURE_BUILD_SUPPORT enabled and repository write access can exploit a Server-Side Request Forgery (SSRF) vulnerability within the build API. This allows the user to provide a malicious URL, causing the Quay builder to make requests to internal network addresses. Such an action could lead to the disclosure of sensitive internal information.	Openshift Update Service Quay
CVE-2026-74245	Aug 14, 2026	Red Hat Quay: Unauth File ID Hijack Logs Info Disclosure A flaw was found in Red Hat Quay's exported logs feature. An unauthenticated attacker with a valid file ID could download exported action logs without proper authorization. While file IDs are complex, they can be intercepted from plaintext email or webhook callbacks. This vulnerability leads to information disclosure, potentially exposing sensitive data such as usernames, email addresses, IP addresses, and action-specific metadata.	Openshift Update Service Quay
CVE-2026-74243	Aug 14, 2026	Red Hat Quay: Unauth flood & path traversal on Clair via SECURITY_SCANNER_V4_PSK A flaw was found in Red Hat Quay. When the SECURITY_SCANNER_V4_PSK (pre-shared key) is not set, a remote unauthenticated attacker can send POST requests to the security scanner notification endpoint. This allows the attacker to flood the notification queue and inject path traversal characters into Clair API URL paths. The primary consequence is worker resource exhaustion and blind path manipulation on the configured Clair host, potentially leading to a denial of service.	Openshift Update Service Quay
CVE-2026-74244	Aug 14, 2026	Unauth Webhook Forgery in Red Hat Quay Stripe Handler (CVE-2026-74244) A flaw was found in Red Hat Quay's Stripe billing webhook handler. This vulnerability allows an unauthenticated attacker to forge billing events by sending crafted JSON requests to the `/webhooks/stripe` endpoint without validating the Stripe-Signature header. Successful exploitation can lead to the unauthorized resetting of a namespace's build quota to its maximum and trigger unsolicited billing emails to namespace administrators.	Openshift Update Service Quay
CVE-2026-74242	Aug 14, 2026	Quay: UUID-based Notification Config Disclosure (CVE-2026-74242) A flaw was found in Red Hat Quay. An administrator of any repository, by knowing or guessing a target notification's Universally Unique Identifier (UUID), can read the notification configuration, including sensitive details like webhook URLs, Slack tokens, and email addresses. This vulnerability also allows them to trigger test notifications for another repository. This could lead to unauthorized information disclosure and potential misuse of notification services.	Openshift Update Service Quay
CVE-2026-74241	Aug 14, 2026	LDAP Filter Injection in Red Hat Quay Auth A flaw was found in Red Hat Quay's external Lightweight Directory Access Protocol (LDAP) authentication handling. When an LDAP referral is returned during authentication, the system does not properly escape the username input. This allows an attacker to inject LDAP filter metacharacters, enabling user-existence oracle attacks at the referral Directory Name (DN). This could also potentially influence which DN is used for password binding in multi-domain Active Directory environments.	Openshift Update Service Quay
CVE-2026-74240	Aug 14, 2026	Red Hat Quay JWT Audit/Claim Bypass via SSO A flaw was found in Red Hat Quay's JWT (JSON Web Token) validation for federated robot accounts and single sign-on (SSO) authentication. Multiple issues related to audience verification and the enforcement of `azp` and `sub` claims were identified. These flaws could allow an attacker with a validly-signed token from the same identity provider to bypass configured security restrictions. This bypass could lead to unauthorized access by circumventing intended audience, subject, or authorized-client limitations.	Openshift Update Service Quay
CVE-2026-13002	Aug 14, 2026	dnsmasq dnssec.c infinite loop DoS (CVE-2026-13002) A flow has been identified into dnssec.c library, causing an infinite loop to dnsmasq service. An attacker who controls any DNSSEC-signed zone can hang the dnsmasq process with a single crafted response, killing all DNS resolution for its clients.	Enterprise Linux (RHEL) Openshift
CVE-2026-19879	Aug 14, 2026	Encoding Truncation in Undertow Response Header Writes A flaw was found in Undertow, an HTTP server, within its HTTP response header writing path. The `writeString()` method performs a silent narrowing cast from 16-bit Unicode characters to 8-bit bytes when writing HTTP response header values. A remote attacker can exploit this by supplying specific Unicode characters in user-controlled input that an application places into response headers. This can lead to the truncation of these characters into ASCII control characters or special symbols, potentially resulting in limited integrity impact or information disclosure if the application does not properly sanitize user input.	Camel Spring Boot Enterprise Linux (RHEL) Jboss Enterprise Application Platform And others...
CVE-2026-58224	Aug 14, 2026	Samba CTDB Protocol Packet Bounds Checking Flaw (CVE-2026-58224) A flaw was found in Samba's CTDB, the clustered database service used by Samba. Insufficient integrity validation of received CTDB protocol packets allows malformed packets containing invalid field lengths, improperly terminated strings, or inconsistent packet sizes to be processed without adequate bounds checking. A remote attacker with access to the CTDB private network may trigger a denial of service through process crashes or excessive memory consumption and, in limited cases, disclose adjacent memory contents.	Enterprise Linux (RHEL) Openshift
CVE-2026-19617	Aug 14, 2026	Libdm Recursion DoS via LVM Metadata (CVE-2026-19617) A flaw was found in libdm. A local attacker could craft a malicious Logical Volume Manager (LVM) metadata configuration with deeply nested structures. This could lead to uncontrolled recursion in the libdm configuration file parser, exhausting the stack and causing any LVM command reading the metadata to crash. This vulnerability results in a Denial of Service (DoS) for affected systems.	Enterprise Linux (RHEL) Hummingbird Openshift And others...
CVE-2026-56860	Aug 13, 2026	Go net/url quadratic path resolution DoS before 1.27.0-rc.3 Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking for '..' segments, eliminating the quadratic time complexity and significantly reducing memory allocations.
CVE-2026-56853	Aug 13, 2026	Go net/http Unencrypted HTTP/2 Preface Read Skips ReadHeaderTimeout (<1.25.13, 1.26.0<1.26.6, 1.27.0 When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this.
CVE-2026-56858	Aug 13, 2026	html/template XSS via unescaped '/' (<=1.25.12, <=1.26.5, <=1.27.0-rc.2) Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS.
CVE-2026-56859	Aug 13, 2026	Go encoding/xml <1.25.13 DecodeElement stack exhaustion Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion.
CVE-2026-56862	Aug 13, 2026	TLS KeyUpdate DoS in Go crypto/tls before 1.27.0-rc.3 Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely.
CVE-2026-33818	Aug 13, 2026	Go encoding/asn1 Recursion Cap 1.25.12 to Prevent Stack Exhaustion Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.
CVE-2026-19730	Aug 13, 2026	Podman 5.8.x Quadlet Replace Truncation Flaw Security Data Leakage The 'podman quadlet install --replace' command opens the existing destination file with O_CREATE\|O_WRONLY but omits O_TRUNC. When the initial reflink copy attempt fails (common on non-reflink-capable filesystems including many RHEL default XFS configurations), the fallback in ReflinkOrCopy uses io.Copy which performs a non-truncating write. If the original Quadlet is larger than the new Quadlet, the file is not truncated and content from the original is preserved. The command completes with no warning. There is no risk of information leakage as the user already had access to the Quadlet in order to replace it, and in most cases, this would only lead to invalid Quadlet files. However, security-related options from the end of the old Quadlet could be included in the new Quadlet, and if the truncation resulted in a valid Quadlet file, this could result in undesirable behavior. For example, running podman quadlet install --replace to remove a single line from the end of a Quadlet - including security-sensitive content, like AddCapability - will fail, and the option will continue to be used. Further, with Volume Quadlets, this can include additional mounts which can cause content to be unintentionally exposed into containers. If, later, the image is updated then compromised content might be leaked to an attacker. The vulnerable code paths are in pkg/domain/infra/abi/quadlet.go (lines 338-360, O_CREATE\|O_WRONLY without O_TRUNC) and vendor/go.podman.io/storage/pkg/fileutils/reflink_linux.go (lines 12-19, non-truncating io.Copy fallback).	Ansible Automation Platform Enterprise Linux (RHEL) Hummingbird And others...
CVE-2026-73266	Aug 13, 2026	Auth Tenant Label Mod in MCE ClusterClaims-Controller A flaw was found in the clusterclaims-controller component of Multicluster Engine (MCE). An authenticated tenant can exploit this vulnerability by manipulating ClusterClaim labels. This allows the tenant to force a cluster to join a ManagedClusterSet belonging to another tenant. Such unauthorized access could enable the injection of policies and workloads into other tenants' clusters.	Multicluster Engine
CVE-2026-48702	Aug 13, 2026	Rekor 0.31.5.1 Unbounded Decompression via apk.go Rekor is a software supply chain transparency log. Starting in version 0.3.0 and prior to version 1.5.2, the `Package.Unmarshal()` function in `pkg/types/alpine/apk.go` decompresses the signature and control gzip members of an APK file into in-memory buffers without bounding the total decompressed size. The existing `max_apk_metadata_size` check (default 1MB) is only applied to individual tar entry header sizes after decompression completes, so it does not prevent a decompression bomb from consuming unbounded heap memory. An attacker can craft a gzip stream that compresses at a ~1000:1 ratio (e.g., 2MB compressed zeros 2GB decompressed). When submitted as spec.package.content in an Alpine `ProposedEntry`, the server decompresses the full payload into memory during request processing, triggering a fatal Go runtime out-of-memory error or OS OOM-kill that cannot be caught by the server's recover() middleware. This is reachable via two unauthenticated endpoints, `POST /api/v1/log/entries (createLogEntry)` and `POST /api/v1/log/entries/retrieve (searchLogQuery)`. Both invoke `V001Entry.Canonicalize()` `fetchExternalEntities()` `apk.Unmarshal(packageData)`, which performs the unbounded decompression. Version 1.5.2 patches the issue. There is no effective workaround. Setting `max_request_body_size` reduces but does not eliminate exposure due to the ~1000:1 compression ratio (a 1MB body limit still allows ~1GB heap allocation). Setting `max_apk_metadata_size` has no effect on this vulnerability since the check is applied after decompression.
CVE-2026-49478	Aug 13, 2026	Fulcio <=1.8.5: SSRF via cross-host redirects + K8s SA token leakage Fulcio is a certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity. Versions through 1.8.5 improperly follow cross-host redirects and attach Kubernetes ServiceAccount tokens during OIDC discovery, allowing a malicious or compromised issuer to perform blind SSRF, substitute and cache malicious JWKS keys, or disclose ServiceAccount tokens to external hosts. Version 1.8.6 blocks cross-host redirects, restricts token injection, and restricts local token loading. No known workarounds are available.
CVE-2026-73584	Aug 13, 2026	A flaw was found in sblim-sfcb A flaw was found in sblim-sfcb. A local, low-privileged attacker can exploit a race condition during privileged instance migration by manipulating a temporary file in the `/tmp` directory. By repeatedly recreating a symbolic link, the attacker can redirect privileged output to an arbitrary file. This can lead to privileged file corruption or a denial of service (DoS) on the system.	Enterprise Linux (RHEL)
CVE-2026-73583	Aug 13, 2026	A flaw was found in sblim-sfcb A flaw was found in sblim-sfcb. A local attacker with access to the system can exploit an unsafe deserialization vulnerability in the provider-manager's inter-process communication (IPC) message parsing. By sending a specially crafted message, the attacker can cause out-of-bounds memory access, leading to the termination of the provider-manager process and a denial of service. This could also potentially result in limited unintended information disclosure.	Enterprise Linux (RHEL)
CVE-2026-73585	Aug 13, 2026	A flaw was found in sblim-cmpi-base A flaw was found in sblim-cmpi-base. Insecure temporary file creation in the provider registration scripts allows a local unprivileged user to perform a symlink attack. By creating a symlink in a world-writable directory, an attacker can redirect privileged writes to an arbitrary file during script execution in a privileged context. This can lead to the overwrite of root-owned files, potentially disrupting system services or operation. Exploitation is conditional on the script running with elevated privileges and may be mitigated by sticky-directory symlink protections.	Enterprise Linux (RHEL)