Red Hat Openshift
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in Red Hat Openshift.
Recent Red Hat Openshift Security Advisories
| Advisory | Title | Published |
|---|---|---|
| RHSA-2026:77611 | (RHSA-2026:77611) Important: OpenShift Container Platform 4.16.73 packages and security update | October 15, 2026 |
| RHSA-2026:77612 | (RHSA-2026:77612) Important: OpenShift Container Platform 4.16.73 bug fix and security update | October 15, 2026 |
| RHSA-2026:77547 | (RHSA-2026:77547) Important: OpenShift Container Platform 4.17.59 packages and security update | October 15, 2026 |
| RHSA-2026:77548 | (RHSA-2026:77548) Important: OpenShift Container Platform 4.17.59 bug fix and security update | October 15, 2026 |
| RHSA-2026:83629 | (RHSA-2026:83629) Red Hat OpenShift GitOps CLI tools version 1.22.2 | October 15, 2026 |
| RHSA-2026:77320 | (RHSA-2026:77320) Important: OpenShift Container Platform 4.13.72 bug fix and security update | October 15, 2026 |
| RHSA-2026:77315 | (RHSA-2026:77315) Important: OpenShift Container Platform 4.12.100 bug fix and security update | October 15, 2026 |
| RHSA-2026:79035 | (RHSA-2026:79035) Important: OpenShift Container Platform 4.18.57 bug fix and security update | October 15, 2026 |
| RHSA-2026:77319 | (RHSA-2026:77319) Important: OpenShift Container Platform 4.13.72 packages and security update | October 15, 2026 |
| RHSA-2026:79166 | (RHSA-2026:79166) Important: OpenShift Container Platform 4.19.51 packages and security update | October 15, 2026 |
By the Year
In 2026 there have been 444 vulnerabilities in Red Hat Openshift with an average score of 7.1 out of ten. Last year, in 2025 Openshift had 99 security vulnerabilities published. That is, 345 more vulnerabilities have already been reported in 2026 as compared to last year. However, the average CVE base score of the vulnerabilities in 2026 is greater by 0.96.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 444 | 7.09 |
| 2025 | 99 | 6.13 |
| 2024 | 48 | 6.70 |
| 2023 | 7 | 6.34 |
| 2022 | 14 | 6.42 |
| 2021 | 6 | 5.90 |
| 2020 | 12 | 6.77 |
| 2019 | 6 | 6.13 |
| 2018 | 14 | 6.11 |
It may take a day or so for new Openshift vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Red Hat Openshift Security Vulnerabilities
nfs-utils rpc.statd DoS via Memory Leak
CVE-2026-89096
5.9 - Medium
- October 16, 2026
A flaw was found in nfs-utils. An unauthenticated remote attacker can trigger a Denial of Service (DoS) by sending repeated state notification requests to an exposed rpc.statd service. The service fails to properly release memory allocated during callback processing, leading to continuous memory growth. Sustained requests can exhaust system resources, eventually causing the service to degrade or crash.
Missing Release of Resource after Effective Lifetime
libtirpc Denial of Service via Unbounded PMAPPROC_DUMP Decoding
CVE-2026-85977
5.3 - Medium
- October 16, 2026
A flaw was found in libtirpc. A remote attacker can exploit this vulnerability by sending specially crafted PMAPPROC_DUMP replies to a client application that uses the pmap_getmaps() function against an attacker-controlled host. This unbounded decoding can lead to excessive memory and CPU allocation, causing the client process to experience a Denial of Service (DoS) due to resource exhaustion.
Excessive Platform Resource Consumption within a Loop
libtirpc DoS via Unbounded Memory Allocation by Oversized RPCSEC_GSS Data
CVE-2026-85231
6.5 - Medium
- October 16, 2026
A flaw was found in libtirpc. An authenticated remote attacker could exploit this vulnerability by sending oversized wrapped data requests to an RPC (Remote Procedure Call) service configured with RPCSEC_GSS (Remote Procedure Call Security-Generic Security Service) integrity or privacy. This can lead to unbounded memory allocation, resulting in a Denial of Service (DoS) by exhausting system resources and causing the service to become unstable or terminate.
Allocation of Resources Without Limits or Throttling
Local DoS via fsidd assertion failure in nfs-utils
CVE-2026-89098
5.5 - Medium
- October 16, 2026
A flaw was found in nfs-utils. The fsidd daemon improperly handles input received over its local domain socket by relying on program assertions to verify command arguments. A local user can exploit this vulnerability by sending a malformed request lacking the required arguments to trigger an assertion failure. This causes the daemon to crash, resulting in a Denial of Service (DoS) for filesystem identifier lookup services until restarted.
assertion failure
Ansible Operator Plugins: Jinja2 Template Injection Enables ClusterWide PrivEsc
CVE-2026-92982
8.5 - High
- October 15, 2026
A flaw was found in Ansible Operator Plugins. A low-privileged Kubernetes user can exploit a Jinja2 template injection vulnerability by crafting malicious custom resource (CR) specification values. These values are processed by Ansible without proper sanitization, allowing embedded Jinja2 expressions to be executed within the operator pod. This can lead to arbitrary code execution and privilege escalation, granting the attacker control over the operator's service account with cluster-wide permissions.
1336
DPDK vhost-crypto Integer Overflow, Host Buffer Overrun
CVE-2026-86849
6.5 - Medium
- October 14, 2026
A flaw was found in DPDK lib/vhost vhost-crypto. Integer overflow in chain length checks, and missing length checks on the RSA path, can overflow a host buffer in the vhost-crypto backend.
Memory Corruption
DPDK nfp vDPA Driver Buffer Overflow via Excess Virtqueues
CVE-2026-86856
6.5 - Medium
- October 14, 2026
A flaw was found in the DPDK nfp vDPA driver. Stack and heap buffers sized for a single queue pair can be overflowed when more virtqueues are configured, leading to a host crash or memory corruption.
Memory Corruption
DPDK vhost-crypto Uninitialized Next Pointer Crash in Write-Back Chain
CVE-2026-86847
6.5 - Medium
- October 14, 2026
A flaw was found in DPDK lib/vhost vhost-crypto. Write-back chain cleanup can follow an uninitialized next pointer when mapping a guest descriptor fails, causing the host vhost-crypto process to hang or crash.
Access of Uninitialized Pointer
DPDK vhost-crypto OOB Write via Unchecked Avail-Ring Index
CVE-2026-86846
6.5 - Medium
- October 14, 2026
A flaw was found in DPDK lib/vhost vhost-crypto. A guest can supply an avail-ring descriptor index that is used without bounds checking, causing an out-of-bounds write in the host vhost-crypto backend.
Memory Corruption
DPDK vhost-crypto Use-after-Free via stale session pointer
CVE-2026-86845
6.5 - Medium
- October 14, 2026
A flaw was found in DPDK lib/vhost vhost-crypto. Session cleanup can leave a stale cached session pointer, and the data path does not check the session type before attaching it, leading to use-after-free or type confusion in the host vhost-crypto backend.
Dangling pointer
DPDK lib/vhost RX Descriptor Underflow Causes VDS in OVSDPDK
CVE-2026-86566
6.5 - Medium
- October 14, 2026
A flaw was found in DPDK lib/vhost. A guest with runt RX descriptors can underflow the copy length in vhost enqueue, causing a denial of service in a shared vhost backend such as OVS-DPDK.
Integer underflow
DPDK lib/vhost vhost-crypto Indirect-Descriptor OOB via double-fetch
CVE-2026-86848
8.8 - High
- October 14, 2026
A flaw was found in DPDK lib/vhost vhost-crypto. The indirect-descriptor snapshot double-fetches a guest descriptor next index, allowing a malicious guest to cause an out-of-bounds access in the host backend.
TOCTTOU
DPDK lib/vhost UAF via IOTLB miss leading to use-after-unmap
CVE-2026-86567
8.8 - High
- October 14, 2026
A flaw was found in DPDK lib/vhost. The VDUSE handler fails to invalidate vring pointers when the IOTLB is invalidated, leading to use-after-unmap.
Dangling pointer
DPDK lib/vhost OOB write via virtqueue size desync
CVE-2026-86565
8.2 - High
- October 14, 2026
A flaw was found in DPDK lib/vhost. A guest can desynchronize virtqueue size from inflight descriptor table size, causing an out-of-bounds write in the host vhost process.
Memory Corruption
DPDK vhost double-offset bug causes memory access error
CVE-2026-86563
7.8 - High
- October 14, 2026
A flaw was found in DPDK lib/vhost. A double-offset bug in vhost log mapping calculation can lead to incorrect memory access.
Incorrect Calculation of Buffer Size
DPDK VHOST TOCTOU Double-Fetch Heap Overflow Vulnerability
CVE-2026-86562
7.8 - High
- October 14, 2026
A flaw was found in DPDK lib/vhost. A TOCTOU double-fetch of control-queue descriptors allows a heap buffer overflow with attacker-controlled content in the VDUSE control-queue handler.
Race Condition
DPDK vhost mmap size validation flaw leads to host crash
CVE-2026-86561
6.5 - Medium
- October 14, 2026
A flaw was found in DPDK lib/vhost. Memory size is not adequately validated before mmap during vhost memory-region setup, which can lead to a host crash or memory corruption.
Allocation of Resources Without Limits or Throttling
DPDK vhost OOB heap copy via indirect descriptor table
CVE-2026-93683
6.4 - Medium
- October 14, 2026
A flaw was found in the DPDK vhost library. When handling a virtio indirect descriptor table, the host reads the table length more than once from guest memory and can allocate a host copy before validating that length. A guest that changes the length between those reads, or that supplies an out-of-range next index on a small host copy in the vDPA relay path, can cause the host vhost process to walk past the validated mapping or heap copy. That can crash or disrupt the vhost process. Out-of-bounds bytes are consumed as descriptor fields for GPA translation and are not returned to the guest as payload. This is a residual issue in the non-contiguous indirect descriptor copy path introduced as part of the CVE-2018-1059 fix.
TOCTTOU
OpenShift Console SSRF via Helm Chart URL (CVE-2026-75888)
CVE-2026-75888
7.7 - High
- October 12, 2026
A flaw was found in the OpenShift console. An authenticated console user can exploit a Server-Side Request Forgery (SSRF) vulnerability by providing a specially crafted Helm chart URL without proper validation. This allows the user to make the console pod fetch arbitrary URLs, potentially leading to the disclosure of sensitive information through error messages or enabling blind port scanning within the cluster.
SSRF
Ansible Core Tarball Path Traversal via Symlink Chain Exploit
CVE-2026-89091
8.8 - High
- October 08, 2026
A flaw was found in ansible-core. When installing a collection with `ansible-galaxy collection install`, the archive extractor validates member paths using lexical path normalisation (os.path.abspath) instead of resolving symbolic links (os.path.realpath), and it performs no containment check on symlink-typed directory members before creating them. A crafted collection tarball can chain symlink directory entries so that a subsequent file member is written outside the intended destination directory. This allows an attacker who can get a victim to install a malicious collection to overwrite arbitrary files with the privileges of the user running ansible-galaxy, leading to code execution on the control node. This is a bypass of the fix for CVE-2020-10691.
insecure temporary file
OpenShift Insights Operator: Misconfigured ClusterRole Grants All Secrets
CVE-2026-93017
7.7 - High
- October 08, 2026
The `insights-operator-gather` ClusterRole grants the operator's service account read access to secrets in the core API group with no namespace or resourceNames restriction therefore, access to every secret in every namespace in the cluster. Ref: https://github.com/openshift/insights-operator/blob/8f15e3157ff09f54ab22801f5b21da35a195cc6d/manifests/03-clusterrole.yaml#L368-L373 ``` - apiGroups: - "" resources: - secrets verbs: - get - list ``` By spawning a pod with the gather service account mounted, an attacker will be able to access any secret in any namespace. ``` spec: serviceAccountName:"gather" ```
Improper Privilege Management
Red Hat sssd-kcm Local DoS via Large Request Header
CVE-2026-80048
5.5 - Medium
- October 06, 2026
A flaw was found in `sssd-kcm`. A local user or process able to connect to the `sssd-kcm` UNIX socket can exploit this vulnerability. By sending a large request length header and then stalling the connection, an attacker can cause the system to preallocate significant memory. This leads to memory exhaustion within the `sssd-kcm` responder, resulting in a Denial of Service (DoS) for affected deployments.
Allocation of Resources Without Limits or Throttling
CRI-O bind_mount_prefix Symlink Spoof leads to Host Path Escalation
CVE-2026-76061
5.5 - Medium
- October 06, 2026
A flaw was found in CRI-O's `bind_mount_prefix` handling. When configured with a non-empty `bind_mount_prefix`, a malicious container or local attacker could use a Container Runtime Interface (CRI) hostPath containing an intermediate absolute symlink. This could cause the bind mount source to resolve outside the intended prefixed root, potentially leading to unauthorized access to files or privilege escalation on the host system.
insecure temporary file
SSSD Local DoS via Responder Service File Descriptor Exhaustion
CVE-2026-88252
4.7 - Medium
- October 06, 2026
A flaw was found in sssd. A local user can cause a Denial of Service (DoS) by exhausting the responder service's available file descriptors (system handles used for open connections). By opening and maintaining many concurrent connections to a responder socket while continuing to queue new connection attempts, an attacker can trigger an unthrottled retry loop. This condition leads to high CPU utilization and stalls the service, preventing legitimate identity and authentication requests from being processed.
Infinite Loop
SSSD LDAP Expired-Password Bypass via Early Rule Termination
CVE-2026-92821
6.8 - Medium
- October 06, 2026
A flaw was found in SSSD. When configured to evaluate password expiration warnings before restrictive access rules in LDAP (Lightweight Directory Access Protocol) environments, an expired-password warning terminates rule evaluation early and treats the access request as successful. A remote authenticated user with an expired password using an alternative authentication method, such as SSH public key authentication, can exploit this flaw to bypass access control restrictions and gain unauthorized access to protected systems.
Return of Wrong Status Code
RCE: oc-mirror Local Cache Registry Exposes All Interfaces
CVE-2026-96577
7.1 - High
- October 01, 2026
A flaw was found in oc-mirror. During mirroring operations, the embedded local cache registry binds to all network interfaces without authentication or encryption instead of restricting access to the local system. An unauthenticated attacker on an adjacent network can connect to the exposed service to push tampered container images, delete cached images, or access mirrored content.
Missing Authentication for Critical Function
Red Hat oauth-proxy Open Redirect via rd Parameter
CVE-2026-83589
6.1 - Medium
- October 01, 2026
A flaw was found in oauth-proxy. The application fails to properly validate the destination redirect parameter (`rd`) during post-login redirection. A remote attacker can exploit this vulnerability by enticing a user to follow a specially crafted link, resulting in the user being redirected to an arbitrary external website after authenticating. This open redirect can be leveraged to conduct phishing attacks or credential theft.
Open Redirect
CRI-O Container Runtime Sandbox Persistence Exploit Enables Host Escape
CVE-2026-62146
7.8 - High
- September 30, 2026
A trust-boundary flaw in CRI-O's sandbox state persistence allows attacker-influenced pod metadata to overwrite CRI-O's own reserved sandbox bookkeeping; once reloaded as trusted after a restart, a later container recreate in that sandbox can expose a host-side runtime-management resource inside the container, enabling container escape.
Trust Boundary Violation
Red Hat kube-compare Container Ref Path RCE on Operator Workstation
CVE-2026-87114
7.1 - High
- September 28, 2026
A flaw was found in kube-compare. When processing a 'container://' reference path, the tool incorrectly executes an untrusted container image's entrypoint instead of merely extracting data from a stopped container. This allows a remote attacker to achieve arbitrary code execution on the operator's workstation. If the Docker daemon requires elevated privileges, the untrusted code may execute with root-mediated daemon privileges, posing a significant security risk.
Inclusion of Functionality from Untrusted Control Sphere
Use-after-Free in QEMU 9pfs Enables VM Escape
CVE-2026-93834
8.8 - High
- September 25, 2026
A use-after-free vulnerability was found in QEMU's 9pfs subsystem. A race condition between the main thread and a worker thread when processing concurrent Tlcreate and Twalk requests allows a malicious guest user to craft a fid path containing stale heap data, bypassing directory traversal restrictions and escaping the shared directory boundary. This can lead to arbitrary host file read/write and code execution (VM escape) as the QEMU process user.
Dangling pointer
OpenShift Console Path Traversal via lng/ns on /locales/resource.json
CVE-2026-75887
7.5 - High
- September 23, 2026
A flaw was found in the OpenShift console. An unauthenticated attacker can exploit a path traversal vulnerability by manipulating the `lng` and `ns` query parameters in the `/locales/resource.json` endpoint. This allows the attacker to read sensitive `*.json` files from the pod filesystem, including plugin manifests and configuration files. Furthermore, this flaw can enable path traversal against registered dynamic-plugin backends.
Directory traversal
OpenShift Console CatalogdHandler Auth Bypass & Cookie Forwarding
CVE-2026-75886
7.2 - High
- September 23, 2026
A flaw was found in openshift/console. An unauthenticated remote attacker can exploit a misconfiguration in the CatalogdHandler, which lacks proper authentication, and the forwarding of the `openshift-session-token` cookie. This allows the attacker to send requests to the in-cluster catalogd service, leading to the disclosure of the internal operator-catalog index and providing a relay into the openshift-catalogd namespace.
Confused Deputy
SSSD LDAP ppolicy failopen: Deleted user retains access
CVE-2026-90462
5.4 - Medium
- September 22, 2026
A flaw was found in SSSD. When configured with the LDAP access provider and `ldap_access_order` including `ppolicy` or `lockout`, a fail-open condition in the LDAP ppolicy access check can occur if a user lookup returns zero results. This can incorrectly return success and cache an allow decision, permitting continued authorization for a deleted or deprovisioned user. A remote attacker with prior valid account context could exploit this to maintain access to information and potentially make limited modifications to resources that should no longer be available.
Improper Handling of Insufficient Permissions or Privileges
rpcbind DoS via unbounded memory growth
CVE-2026-94640
7.5 - High
- September 22, 2026
A flaw was found in rpcbind. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service (DoS) by sending a large number of unique requests. The rpcbind service records previously unseen RPC (Remote Procedure Call) statistics in unbounded in-memory lists, leading to persistent memory growth and increased CPU usage. This can degrade or exhaust service availability.
Resource Exhaustion
Integer Overflow in libstdc++ New Operator Causing Memory Corruption
CVE-2026-95619
7.7 - High
- September 22, 2026
A flaw was found in libstdc++. An integer overflow can occur when processing large inputs to the aligned operator new in the C++ library. This vulnerability could lead to an undersized memory allocation, potentially causing memory corruption or application instability.
Integer Overflow or Wraparound
Heap Overflow in libslirp DHCPv6/TFTP Builders Arbitrary Code Exec
CVE-2026-95508
7.4 - High
- September 22, 2026
A heap-based buffer overflow was found in the DHCPv6 and TFTP response builders of libslirp. When the host is configured with a small interface MTU, a guest-supplied DHCPv6 CLIENTID option or TFTP blksize option can overflow the reply buffer with attacker-controlled content and length, resulting in denial of service and potentially arbitrary code execution in the host process. The default interface MTU is not affected.
Memory Corruption
OpenShift oc-mirror PGP Signature Bypass via Intercepted Signature Endpoint
CVE-2026-75939
7.4 - High
- September 21, 2026
A flaw was found in openshift/oc-mirror. The tool incorrectly verifies PGP (Pretty Good Privacy) release image signatures by checking for signature errors before the entire signed body is processed, leading to a bypass of the signature verification. A remote attacker, by intercepting or manipulating network traffic to the signature endpoint, could exploit this to craft a PGP message with a valid Red Hat release key ID but a forged signature. This enables the `oc-mirror` tool to accept and mirror a malicious release payload into a disconnected registry, potentially compromising the integrity of software deployments.
Improper Verification of Cryptographic Signature
CRI-O Privilege Escalation via Malicious Checkpoint Restore (before 1.34)
CVE-2026-92574
8.8 - High
- September 21, 2026
A vulnerability in CRI-O checkpoint restore allows a user who can create a pod from a malicious checkpointed container to bypass the destination Kubernetes security context. The restored process may retain credentials, Linux capabilities, no_new_privs, and seccomp state from the checkpoint instead of enforcing the destination configuration. This can allow execution with elevated privileges across the container security boundary. Affected upstream supported versions are CRI-O 1.34 and later. Downstream Red Hat products are affected from OCP 4.17 onward. Fixes have been applied to supported branches but are not yet released. Exploitation requires permission to create a pod from a malicious checkpoint image and checkpoint restore functionality to be available.
Execution with Unnecessary Privileges
CRIO chkrestore metadata flaw enabling host FS ops
CVE-2026-15801
8 - High
- September 21, 2026
A vulnerability was found in CRI-O related to the container checkpoint and restore feature. When CRI-O is configured to restore containers from checkpoint archives, insufficient validation of restore metadata may allow a user with sufficient privileges to perform unintended operations on the host filesystem. Successful exploitation requires that container checkpoint and restore functionality is enabled, which is not the default configuration. An attacker must also be able to trigger restoration of a container from untrusted checkpoint content.
Directory traversal
OpenShift Console Unauth devfile API SSRF/DoS
CVE-2026-75885
9.3 - Critical
- September 18, 2026
A flaw was found in the OpenShift console. Unauthenticated access to the `/api/devfile/` and `/api/devfile/samples/` endpoints allows a remote attacker to send crafted devfile payloads. This can lead to Server-Side Request Forgery (SSRF), where the console pod makes requests to internal services and reflects partial responses to the attacker. Additionally, by sending repeated large requests without a specified content length, an attacker can cause unbounded memory growth, leading to a Denial of Service (DoS).
SSRF
Privilege Escalation via VAPIC Alias Overflow in QEMU
CVE-2026-81627
8.2 - High
- September 18, 2026
A flaw was found in QEMU. The VAPIC setup hypercall in hw/i386/vapic.c does not validate that the writable RAM alias remains within the option ROM window. A privileged guest user on a Q35/KVM machine can position this alias over locked SMRAM, bypassing chipset D_LCK protection and injecting code into System Management Mode memory.
Memory Corruption
libxml2 NULL Pointer Deref in XML Catalog Parsing (DoS)
CVE-2026-76781
5.5 - Medium
- September 17, 2026
A flaw was found in libxml2. A local user or an attacker providing a specially crafted XML catalog can trigger a NULL pointer dereference during XML catalog parsing. This occurs when a `nextCatalog` element lacks its mandatory `catalog` attribute, leading to the application crashing and causing a Denial of Service (DoS).
NULL Pointer Dereference
Redis Community Cluster Bus OOB Read via Unchecked Null-Termination
CVE-2026-92925
7.1 - High
- September 17, 2026
A flaw was found in Redis community. The cluster bus packet parser, responsible for handling PING, PONG, and MEET packets, fails to properly validate string-carrying extensions for null-termination. This oversight allows a remote attacker to craft a malicious packet, leading to an out-of-bounds read when the packet's payload is processed. Successful exploitation of this vulnerability could result in the disclosure of sensitive information or a remote denial of service (DoS).
Out-of-bounds Read
sequoia-openpgp Key Flag Flaw Allows Subkey Bypass & Signature Forgery
CVE-2026-42784
7.4 - High
- September 16, 2026
A flaw was found in sequoia-openpgp. The library incorrectly infers key flags for older certificates when a key flags subpacket is missing, leading to a discrepancy in how key capabilities are viewed. This key flag confusion allows an attacker to bypass the back-signature check. Consequently, an attacker can illegitimately bind an arbitrary subkey to their own certificate and forge signatures, completely compromising cryptographic integrity.
Improper Verification of Cryptographic Signature
Podman tar load RCE: crafted archive writes files with user privileges
CVE-2025-11395
5.5 - Medium
- September 15, 2026
A flaw was found in Podman. If an attacker can pass a crafted tar archive to the `podman load` command, they can create files on the host machine with the privileges of the user running Podman.
Insecure Inherited Permissions
containers/storage: Arbitrary File Overwrite via Malicious Whiteout Header
CVE-2026-79699
4.4 - Medium
- September 15, 2026
A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout header (e.g. victim/.wh.) can cause the extraction destination directory to be replaced with an arbitrary file when processed by storage/pkg/archive.UnpackLayer, ApplyLayer, or ApplyUncompressedLayer.
insecure temporary file
Buildah Copier Go Package Symlink Extraction Escape (CVE-2026-79705)
CVE-2026-79705
4.5 - Medium
- September 15, 2026
A flaw was found in the buildah/copier Go package. When used outside of Buildah by a non-root caller, a crafted tar archive containing malicious symlinks can escape the target extraction directory and create files outside the intended destination. Buildah itself uses chroot hardening and is not affected.
Directory traversal
SSSD NSS Responder DoS via Zero-Length Body (CVE-2026-90996)
CVE-2026-90996
4 - Medium
- September 14, 2026
A flaw was found in sssd. A local unprivileged user could send a specially crafted request with a zero-length body to the Network Security Services (NSS) responder. This could lead to a denial-of-service condition, causing the NSS responder to become unstable or terminate. This vulnerability affects the availability of the system responder.
Integer underflow
SSSD PAM Responder NULL Deref DoS via Omitted Service Item
CVE-2026-90995
5.5 - Medium
- September 14, 2026
A flaw was found in SSSD (System Security Services Daemon). A local attacker with privileges to connect to the PAM (Pluggable Authentication Modules) responder socket can send a specially crafted protocol request. If the `pam_app_services` configuration is enabled and the service item is omitted from the request, a NULL pointer dereference can occur. This vulnerability leads to a denial of service, causing the PAM responder to crash and disrupt authentication services.
NULL Pointer Dereference
Local DoS via Empty PAM Request in sssd v1 Parser
CVE-2026-90994
4 - Medium
- September 14, 2026
A flaw was found in sssd, specifically within the PAM (Pluggable Authentication Modules) responder's protocol v1 parser, pam_parse_in_data(). A local client with access to the PAM responder's UNIX socket can exploit this by negotiating protocol v1 and sending an empty or truncated PAM request body. This can trigger an out-of-bounds read, potentially causing the PAM responder to terminate or restart, leading to a local denial of service.
Out-of-bounds Read
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Red Hat Openshift or by Red Hat? Click the Watch button to subscribe.
