GHSA-m3r7-xjq8-gc4r
A flaw was found in gnutls. Servers configured with RSA-PSK (Rivest–Shamir–Adleman – Pre-Shared Key) wrongfully matched usernames containing a NUL character with truncated usernames. A remote attacker could exploit this by sending a specially crafted username, leading to an authentication bypass. This vulnerability allows an attacker to gain unauthorized access by circumventing the authentication process.
AI Analysis
Technical Summary
This advisory addresses a security vulnerability identified as CVE-2026-42010 in the gnutls component used by Red Hat OpenShift Container Platform 4.22. The vulnerability allows authentication bypass via a NUL character in the username. Red Hat has released OpenShift Container Platform 4.22.4 containing updated container images that fix this issue. The advisory covers multiple architectures including x86_64, s390x, ppc64le, and aarch64, and applies to OpenShift Container Platform 4.22 on RHEL 8 and RHEL 9. Users should upgrade their clusters using the OpenShift CLI or web console following Red Hat's documented procedures.
Potential Impact
The vulnerability allows an attacker to bypass authentication mechanisms by exploiting a NUL character in the username within the gnutls library. This could potentially allow unauthorized access to the OpenShift Container Platform environment. The issue is rated as having an important security impact by Red Hat, indicating a high severity level. No known exploits in the wild have been reported at this time.
Mitigation Recommendations
Red Hat has released OpenShift Container Platform 4.22.4 with updated container images that fix this vulnerability. Users of OpenShift Container Platform 4.22 are strongly advised to upgrade to this version as soon as it is available in their release channel. Upgrades can be performed using the OpenShift CLI (oc) or the web console. Detailed upgrade instructions are provided in Red Hat's official documentation. Since this is an official fix, applying the update fully mitigates the vulnerability.
GHSA-m3r7-xjq8-gc4r
Description
A flaw was found in gnutls. Servers configured with RSA-PSK (Rivest–Shamir–Adleman – Pre-Shared Key) wrongfully matched usernames containing a NUL character with truncated usernames. A remote attacker could exploit this by sending a specially crafted username, leading to an authentication bypass. This vulnerability allows an attacker to gain unauthorized access by circumventing the authentication process.
CVSS v3.1
Score 7.1high
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This advisory addresses a security vulnerability identified as CVE-2026-42010 in the gnutls component used by Red Hat OpenShift Container Platform 4.22. The vulnerability allows authentication bypass via a NUL character in the username. Red Hat has released OpenShift Container Platform 4.22.4 containing updated container images that fix this issue. The advisory covers multiple architectures including x86_64, s390x, ppc64le, and aarch64, and applies to OpenShift Container Platform 4.22 on RHEL 8 and RHEL 9. Users should upgrade their clusters using the OpenShift CLI or web console following Red Hat's documented procedures.
Potential Impact
The vulnerability allows an attacker to bypass authentication mechanisms by exploiting a NUL character in the username within the gnutls library. This could potentially allow unauthorized access to the OpenShift Container Platform environment. The issue is rated as having an important security impact by Red Hat, indicating a high severity level. No known exploits in the wild have been reported at this time.
Mitigation Recommendations
Red Hat has released OpenShift Container Platform 4.22.4 with updated container images that fix this vulnerability. Users of OpenShift Container Platform 4.22 are strongly advised to upgrade to this version as soon as it is available in their release channel. Upgrades can be performed using the OpenShift CLI (oc) or the web console. Detailed upgrade instructions are provided in Red Hat's official documentation. Since this is an official fix, applying the update fully mitigates the vulnerability.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:34790
- Cve Count
- 1
- Additional Cves
- []
- Cvss Version
- null
Threat ID: 6a4cf0f7c9d9e3dbe31d3447
Added to database: 07/07/2026, 12:28:39 UTC
Last enriched: 07/07/2026, 12:29:53 UTC
Last updated: 07/09/2026, 00:04:50 UTC
Views: 23
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.