Skip to main content
CVE-2026-1965VulnerabilityPublished Updated

Red Hat Security Advisory: Red Hat AI Base Images 3.0.9 (Spyre)

Affects Red HatSource GCVE Database

0
Compare

Mentioned vulnerabilities

Not known to be exploited · fixed in Red Hat package updates : patch Red Hat soon.

Data as of 13 Nov 2026, 14:46 UTC

Severity
High

Rated by Threat Radar · CVSS not yet scored by NVD

Patch
Available – fixed in 8.21.0

Exploitation evidence

  1. Disclosed: evidence found.

    CVE published 11 Nov 2026

  2. Detectable: no evidence on record.

    No public nuclei template indexed

  3. Weaponized: no evidence on record.

    No public exploit code indexed in Metasploit or Exploit-DB

  4. Exploited in the wild: no evidence on record.

    Not in CISA KEV and no source reports exploitation

  5. Observed by OffSeq Mirage: no evidence on record.

    No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 13 Nov 2026.

What to do

AI-suggested

Red Hat has not provided an official fix for this vulnerability in the AI Base Images 3.0.9 (Spyre) as of the advisory date. The recommended mitigation is to avoid reusing libcurl easy handles across different HTTP origins when using Digest authentication. Applications should create fresh libcurl handles for each origin or explicitly clear authentication-related state before reusing handles. Upgrading libcurl to version 8.21.0 or later, where the flaw is fixed, is advised when possible.

Description

CVE-2026-11856 is a moderate-severity vulnerability in libcurl used in Red Hat AI Base Images 3.0.9 (Spyre). It occurs when libcurl reuses the same connection handle for HTTP Digest authentication transfers to different origins, potentially sending authentication headers intended for one origin to another. This can lead to unintended information disclosure of authenticated state data. The flaw affects libcurl versions from 7.10.6 up to 8.20.0 and is fixed in 8.21.0. Mitigation involves correct usage of libcurl handles by creating fresh handles for different origins or explicitly clearing authentication state before reuse.

References

Community reviews

Loading reviews…