The vulnerability CVE-2026-42010 in GnuTLS arises from improper null termination handling in RSA-PSK username matching. Specifically, servers configured with RSA-PSK authentication incorrectly match usernames containing a NUL character with truncated usernames, enabling an attacker to bypass authentication by sending a crafted username. This flaw allows unauthorized access by circumventing the authentication process. Red Hat has issued security advisories and updates for affected GnuTLS packages, including versions >=4.22.0 and <4.22.4, and for Red Hat Enterprise Linux 8 packages such as gnutls-3.6.16-8.el8_10.6. The updates fix the authentication bypass and other related security issues. The CVSS v3.1 base score is 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N), reflecting a high severity impact primarily on confidentiality.

An attacker can exploit this vulnerability to bypass authentication on servers using GnuTLS with RSA-PSK, gaining unauthorized access. The impact is high confidentiality loss with limited integrity impact and no availability impact. This can lead to unauthorized access to protected resources or services relying on GnuTLS authentication.

Red Hat has released official security updates that fix this vulnerability. Users should apply the updated GnuTLS packages provided in Red Hat advisories RHSA-2026:13274 and RHSA-2026:20611. The updates include gnutls-3.8.13-1.hum1 for Red Hat Hardened Images and gnutls-3.6.16-8.el8_10.6 for Red Hat Enterprise Linux 8. Applying these updates mitigates the authentication bypass issue. No additional mitigation steps are required beyond applying the vendor-provided patches.