CVE-2026-13676 is a security vulnerability in the fast-uri library where improper Unicode hostname canonicalization allows bypassing of security policies that rely on URL parsing, such as denylists and redirect validations. This occurs because fast-uri fails to correctly convert Internationalized Domain Name (IDN) hostnames, leading to discrepancies between fast-uri and other URL parsers. Applications using fast-uri for enforcing host-based policies may be circumvented, allowing remote attackers to access unauthorized resources or perform malicious redirects. Red Hat OpenShift Container Platform versions prior to fixed releases are affected. Red Hat has released updated container images and packages to address this issue and recommends upgrading to these fixed versions. The vulnerability is rated with a CVSS base score of 7.5 (high) by Red Hat, with no known active exploitation reported.

The vulnerability allows remote attackers to bypass host-based security controls such as denylists and redirect validations by exploiting inconsistent Unicode hostname parsing in fast-uri. This can lead to unauthorized resource access or malicious redirects, impacting the integrity of affected systems. There is no reported impact on confidentiality or availability. No known exploits are currently active in the wild.

A patch is available for this vulnerability. Red Hat advises users of affected OpenShift Container Platform versions to upgrade to the updated packages and container images provided in the advisory. No effective mitigations meeting Red Hat's criteria are currently available other than applying the official fix. Users should follow Red Hat's upgrade instructions to fully apply the errata update and ensure their clusters are protected.