Openshift container platform: Improper Null Termination in Red Hat Red Hat Enterprise Linux 10 (CVE-2026-42010)
A flaw was found in gnutls. Servers configured with RSA-PSK (Rivest–Shamir–Adleman – Pre-Shared Key) wrongfully matched usernames containing a NUL character with truncated usernames. A remote attacker could exploit this by sending a specially crafted username, leading to an authentication bypass. This vulnerability allows an attacker to gain unauthorized access by circumventing the authentication process.
AI Analysis
Technical Summary
The security advisory for Red Hat OpenShift Container Platform 4.22.4 addresses an authentication bypass vulnerability (CVE-2026-42010) in the gnutls library. The issue involves improper handling of a NUL character in the username, which can be exploited to bypass authentication. Red Hat has released updated container images and RPM packages to remediate this vulnerability. The advisory recommends all OpenShift Container Platform 4.22 users upgrade to the fixed version 4.22.4. The update is rated as having an Important security impact by Red Hat Product Security. No CVSS score is provided in the advisory. The fix is available through official release channels and can be applied using standard OpenShift upgrade procedures.
Potential Impact
This vulnerability allows an attacker to bypass authentication controls in the gnutls library used by OpenShift Container Platform, potentially enabling unauthorized access. The impact is rated as Important by Red Hat, indicating a significant security risk if left unpatched. There are no known exploits in the wild at the time of the advisory.
Mitigation Recommendations
A fix is available in Red Hat OpenShift Container Platform version 4.22.4. Users should upgrade to this version using the OpenShift CLI (oc) or web console as soon as the update is available in their release channel. Detailed upgrade instructions are provided by Red Hat in their official documentation. No additional mitigation steps are indicated beyond applying the update.
Openshift container platform: Improper Null Termination in Red Hat Red Hat Enterprise Linux 10 (CVE-2026-42010)
Description
A flaw was found in gnutls. Servers configured with RSA-PSK (Rivest–Shamir–Adleman – Pre-Shared Key) wrongfully matched usernames containing a NUL character with truncated usernames. A remote attacker could exploit this by sending a specially crafted username, leading to an authentication bypass. This vulnerability allows an attacker to gain unauthorized access by circumventing the authentication process.
CVSS v3.1
Score 7.1high
Affected software
pkg:rpm/redhat/openshift-container-platformRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The security advisory for Red Hat OpenShift Container Platform 4.22.4 addresses an authentication bypass vulnerability (CVE-2026-42010) in the gnutls library. The issue involves improper handling of a NUL character in the username, which can be exploited to bypass authentication. Red Hat has released updated container images and RPM packages to remediate this vulnerability. The advisory recommends all OpenShift Container Platform 4.22 users upgrade to the fixed version 4.22.4. The update is rated as having an Important security impact by Red Hat Product Security. No CVSS score is provided in the advisory. The fix is available through official release channels and can be applied using standard OpenShift upgrade procedures.
Potential Impact
This vulnerability allows an attacker to bypass authentication controls in the gnutls library used by OpenShift Container Platform, potentially enabling unauthorized access. The impact is rated as Important by Red Hat, indicating a significant security risk if left unpatched. There are no known exploits in the wild at the time of the advisory.
Mitigation Recommendations
A fix is available in Red Hat OpenShift Container Platform version 4.22.4. Users should upgrade to this version using the OpenShift CLI (oc) or web console as soon as the update is available in their release channel. Detailed upgrade instructions are provided by Red Hat in their official documentation. No additional mitigation steps are indicated beyond applying the update.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:34790
- Cve Count
- 1
- Additional Cves
- []
- Cvss Version
- null
Threat ID: 6a55ffc368715ace432fccde
Added to database: 07/14/2026, 09:22:11 UTC
Last enriched: 07/14/2026, 10:03:11 UTC
Last updated: 07/31/2026, 19:22:58 UTC
Views: 97
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.