CVE-2026-42010 is an authentication bypass vulnerability in the gnutls library on Red Hat Enterprise Linux 10. The flaw arises from improper null termination handling in RSA-PSK username processing, where usernames containing a NUL character are incorrectly matched to truncated usernames. This allows a remote attacker to send a specially crafted username to bypass authentication controls. The vulnerability is tracked under CWE-626 (Null Pointer Dereference) and CWE-170 (Improper Null Termination). The CVSS v3.1 base score is 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact. Red Hat has issued security advisories and updates for gnutls packages addressing this and related vulnerabilities, but the provided data does not confirm a specific patch for Red Hat Enterprise Linux 10.

Successful exploitation allows remote attackers to bypass authentication mechanisms on servers configured with RSA-PSK in gnutls, potentially granting unauthorized access. The confidentiality impact is high, as attackers may gain access to protected resources. Integrity impact is low, and availability is not affected. There are no known exploits in the wild as of the data provided.

Red Hat has released security advisories and updates for gnutls packages addressing this vulnerability, particularly for Red Hat Enterprise Linux 8. Users should apply the latest available updates from Red Hat for their respective systems. For Red Hat Enterprise Linux 10, patch status is not explicitly confirmed in the provided data; therefore, users should monitor the Red Hat advisory page (https://access.redhat.com/security/cve/CVE-2026-42010) for official patch releases and remediation instructions. Until patches are applied, consider restricting or monitoring use of RSA-PSK authentication where feasible.