Red Hat Security Advisory: Red Hat Developer Hub 1.10.5 release
Affects Red HatSource GCVE Database
Not known to be exploited.
Data as of 26 Oct 2026, 16:39 UTC
Rated by Threat Radar · CVSS not yet scored by NVD
- EPSS
- 0.5% chance of exploitation in 30 days – higher than 46% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Exploitation evidence
Disclosed: evidence found.
CVE published 8 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
- Disclosed
- The CVE record is public on cve.org. Its publication is t = 0.
- Detectable
- A public nuclei template can find exposed instances, for defenders and attackers alike.
- Weaponised
- Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
- Exploited in the wild
- CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
- Observed by OffSeq Mirage
- OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.
Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.
Description
Red Hat Developer Hub (RHDH) is Red Hat's enterprise-grade, self-managed, customizable developer portal based on Backstage.io. RHDH is supported on OpenShift and other major Kubernetes clusters (AKS, EKS, GKE). The core features of RHDH include a single pane of glass, a centralized software catalog, self-service via golden path templates, and Tech Docs. RHDH is extensible by plugins.
- CWE-524Use of Cache Containing Sensitive Information (opens in a new tab)
Base weakness
The code uses a cache that contains sensitive information, but the cache can be read by an actor outside of the intended control sphere.
Architecture and Design
Protect information stored in cache.
Architecture and Design
Do not store unnecessarily sensitive information in the cache.
Architecture and Design
Consider using encryption in the cache.
- OWASP ASVS 4.0.3
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-770Allocation of Resources Without Limits or Throttling (opens in a new tab)
Base weaknessLikelihood of exploit: HighCWE Top 25 (2025): #25
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
Requirements
Clearly specify the minimum and maximum expectations for capabilities, and dictate which behaviors are acceptable when resource allocation reaches limits.
Architecture and Design
Limit the amount of resources that are accessible to unprivileged users. Set per-user limits for resources. Allow the system administrator to define these limits. Be careful to avoid CWE-410.
Architecture and Design
Design throttling mechanisms into the system architecture. The best protection is to limit the amount of resources that an unauthorized user can cause to be expended.
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-415Double Free (opens in a new tab)
Variant weaknessLikelihood of exploit: High
The product calls free() twice on the same memory address.
Architecture and Design
Choose a language that provides automatic memory management.
Implementation
Ensure that each allocation is freed only once. After freeing a chunk, set the pointer to NULL to ensure the pointer cannot be freed again. In complicated error conditions, be sure that clean-up routines respect the state of allocation properly.
Implementation
Use a static analysis tool to find double free instances.
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-476NULL Pointer Dereference (opens in a new tab)
Base weaknessLikelihood of exploit: MediumCWE Top 25 (2025): #13OWASP Top 10 A10:2025: Mishandling of Exceptional Conditions (opens in a new tab)
The product dereferences a pointer that it expects to be valid but is NULL.
Implementation
For any pointers that could have been modified or provided from a function that can return NULL, check the pointer for NULL before use. When working with a multithreaded or otherwise asynchronous environment, ensure that proper locking APIs are used to lock before the check, and unlock when it has finished.
Requirements
Select a programming language that is not susceptible to these issues.
Implementation
Check the results of all functions that return a value and verify that the value is non-null before acting upon it.
- OWASP Cheat Sheets
- OWASP ASVS 4.0.3
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-693Protection Mechanism Failure (opens in a new tab)
Pillar weaknessOWASP Top 10 A06:2025: Insecure Design (opens in a new tab)
The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.
MITRE discourages mapping vulnerabilities to this broad entry; the root cause is usually a more specific weakness.
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-913Improper Control of Dynamically-Managed Code Resources (opens in a new tab)
Class weaknessOWASP Top 10 A01:2021: Broken Access Control (opens in a new tab)
The product does not properly restrict reading from or writing to dynamically-managed code resources such as variables, objects, classes, attributes, functions, or executable instructions or statements.
Implementation · Input Validation
For any externally-influenced input, check the input against an allowlist of acceptable values.
Implementation · Architecture and Design · Refactoring
Refactor the code so that it does not need to be dynamically managed.
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-201Insertion of Sensitive Information Into Sent Data (opens in a new tab)
Base weaknessOWASP Top 10 A01:2025: Broken Access Control (opens in a new tab)
The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.
Requirements
Specify which data in the software should be regarded as sensitive. Consider which types of users should have access to which types of data.
Implementation
Ensure that any possibly sensitive data specified in the requirements is verified with designers to ensure that it is either a calculated risk or mitigated elsewhere.
System Configuration
Setup default error messages so that unexpected errors do not disclose sensitive information.
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-787Out-of-bounds Write (opens in a new tab)
Base weaknessLikelihood of exploit: HighCWE Top 25 (2025): #5
The product writes data past the end, or before the beginning, of the intended buffer.
Requirements · Language Selection
Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
Architecture and Design · Libraries or Frameworks
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
Operation · Build and Compilation · Environment Hardening
Use automatic buffer overflow detection mechanisms that are offered by certain compilers or compiler extensions. Examples include: the Microsoft Visual Studio /GS flag, Fedora/Red Hat FORTIFY_SOURCE GCC flag, StackGuard, and ProPolice, which provide various mechanisms including canary-based detection and range/index…
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-835Loop with Unreachable Exit Condition ('Infinite Loop') (opens in a new tab)
Base weakness
The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
- CWE-839Numeric Range Comparison Without Minimum Check (opens in a new tab)
Base weakness
The product checks a value to ensure that it is less than or equal to a maximum, but it does not also verify that the value is greater than or equal to the minimum.
Implementation · Enforcement by Conversion
If the number to be used is always expected to be positive, change the variable type from signed to unsigned or size_t.
Implementation · Input Validation
If the number to be used could have a negative value based on the specification (thus requiring a signed value), but the number should only be positive to preserve code correctness, then include a check to ensure that the value is positive.
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-1333Inefficient Regular Expression Complexity (opens in a new tab)
Base weaknessLikelihood of exploit: High
The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.
Architecture and Design
Use regular expressions that do not support backtracking, e.g. by removing nested quantifiers.
System Configuration
Set backtracking limits in the configuration of the regular expression implementation, such as PHP's pcre.backtrack_limit. Also consider limits on execution time for the process.
Implementation
Do not use regular expressions with untrusted input. If regular expressions must be used, avoid using backtracking in the expression.
- OWASP Cheat Sheets
- OWASP ASVS 4.0.3
- Attack patterns
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-140Improper Neutralization of Delimiters (opens in a new tab)
Base weakness
The product does not neutralize or incorrectly neutralizes delimiters.
Implementation · Input Validation
Developers should anticipate that delimiters will be injected/removed/manipulated in the input vectors of their product. Use an appropriate combination of denylists and allowlists to ensure only valid, expected and appropriate input is processed by the system.
Implementation · Input Validation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
Implementation · Output Encoding
While it is risky to use dynamically-generated query strings, code, or commands that mix control and data together, sometimes it may be unavoidable. Properly quote arguments and escape any special characters within those arguments.
- OWASP Cheat Sheets
- OWASP ASVS 4.0.3
- Attack patterns
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-444Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') (opens in a new tab)
Base weaknessOWASP Top 10 A06:2025: Insecure Design (opens in a new tab)
The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.
Implementation
Use a web server that employs a strict HTTP parsing procedure, such as Apache.
Implementation
Use only SSL communication.
Implementation
Terminate the client session after each request.
- OWASP Cheat Sheets
- OWASP ASVS 4.0.3
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-918Server-Side Request Forgery (SSRF) (opens in a new tab)
Base weaknessCWE Top 25 (2025): #22OWASP Top 10 A01:2025: Broken Access Control (opens in a new tab)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
- OWASP Cheat Sheets
- OWASP ASVS 4.0.3
- Attack patterns
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-76Improper Neutralization of Equivalent Special Elements (opens in a new tab)
Base weaknessLikelihood of exploit: HighOWASP Top 10 A05:2025: Injection (opens in a new tab)
The product correctly neutralizes certain special elements, but it improperly neutralizes equivalent special elements.
Requirements
Programming languages and supporting technologies might be chosen which are not subject to these issues.
Implementation
Utilize an appropriate mix of allowlist and denylist parsing to filter equivalent special element syntax from all input.
- OWASP Cheat Sheets
- OWASP ASVS 4.0.3
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-772Missing Release of Resource after Effective Lifetime (opens in a new tab)
Base weaknessLikelihood of exploit: High
The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.
Requirements · Language Selection
Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
Implementation
It is good practice to be responsible for freeing all resources you allocate and to be consistent with how and where you free resources in a function. If you allocate resources that you intend to free upon completion of the function, you must be sure to free the resources at all exit points for that function including…
Operation · Architecture and Design · Resource Limitation
Use resource-limiting settings provided by the operating system or environment. For example, when managing system resources in POSIX, setrlimit() can be used to set limits for certain types of resources, and getrlimit() can determine how many resources are available.
- Attack patterns
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-248Uncaught Exception (opens in a new tab)
Base weaknessOWASP Top 10 A10:2025: Mishandling of Exceptional Conditions (opens in a new tab)
An exception is thrown from a function, but it is not caught.
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-1285Improper Validation of Specified Index, Position, or Offset in Input (opens in a new tab)
Base weakness
The product receives input that is expected to specify an index, position, or offset into an indexable resource such as a buffer or file, but it does not validate or incorrectly validates that the specified index/position/offset has the required properties.
Implementation · Input Validation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-1287Improper Validation of Specified Type of Input (opens in a new tab)
Base weakness
The product receives input that is expected to be of a certain type, but it does not validate or incorrectly validates that the input is actually of the expected type.
Implementation · Input Validation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-1289Improper Validation of Unsafe Equivalence in Input (opens in a new tab)
Base weakness
The product receives an input value that is used as a resource identifier or other type of reference, but it does not validate or incorrectly validates that the input is equivalent to a potentially-unsafe value.
Implementation · Input Validation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-125Name not in the CWE catalogue (opens in a new tab)
- CWE-295Name not in the CWE catalogue (opens in a new tab)
- CWE-459Name not in the CWE catalogue (opens in a new tab)
- CWE-915Name not in the CWE catalogue (opens in a new tab)
- CWE-94Name not in the CWE catalogue (opens in a new tab)
- CWE-114Name not in the CWE catalogue (opens in a new tab)
- CWE-668Name not in the CWE catalogue (opens in a new tab)
- CWE-732Name not in the CWE catalogue (opens in a new tab)
- CWE-1100Name not in the CWE catalogue (opens in a new tab)
- CWE-200Name not in the CWE catalogue (opens in a new tab)
- CWE-453Name not in the CWE catalogue (opens in a new tab)
- CWE-706Name not in the CWE catalogue (opens in a new tab)
- CWE-269Name not in the CWE catalogue (opens in a new tab)
- CWE-1220Name not in the CWE catalogue (opens in a new tab)
- CWE-358Name not in the CWE catalogue (opens in a new tab)
- CWE-653Name not in the CWE catalogue (opens in a new tab)
- CWE-184Name not in the CWE catalogue (opens in a new tab)
- GCVE source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory ID
- RHSA-2026:79088
- Vendor Severity
- critical
- CVE Count
- 56
- Additional Cves
- CVE-2026-14456, CVE-2026-18798, CVE-2026-19534, CVE-2026-47683, CVE-2026-47686, CVE-2026-47698, CVE-2026-55553, CVE-2026-63072, CVE-2026-63076, CVE-2026-67213, CVE-2026-67214, CVE-2026-67422, CVE-2026-75899, CVE-2026-75931, CVE-2026-75975, CVE-2026-76172, CVE-2026-77037, CVE-2026-77078, CVE-2026-82333, CVE-2026-82417, CVE-2026-84292, CVE-2026-84375, CVE-2026-84394, CVE-2026-84445, CVE-2026-84961, CVE-2026-87776, CVE-2026-88932, CVE-2026-89011, CVE-2026-92934, CVE-2026-92935, CVE-2026-92937, CVE-2026-92938, CVE-2026-92939, CVE-2026-92940, CVE-2026-92941, CVE-2026-92942, CVE-2026-92944, CVE-2026-92946, CVE-2026-92947, CVE-2026-92948, CVE-2026-92950, CVE-2026-92951, CVE-2026-92953, CVE-2026-92954, CVE-2026-92955, CVE-2026-92956, CVE-2026-92957, CVE-2026-92958, CVE-2026-92959, CVE-2026-92960, CVE-2026-92961, CVE-2026-93603, CVE-2026-93604, CVE-2026-93605, CVE-2026-93606
References
- access.redhat.com/errata/RHSA-2026:79088 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-13697 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-14456 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-18798 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-19534 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-47683 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-47686 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-47698 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-55553 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-63072 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-63076 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-67213 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-67214 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-67422 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-75899 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-75931 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-75975 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-76172 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-77037 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-77078 (opens in a new tab)
Community reviews
Related threats
- Red Hat Security Advisory: RHOAI 2.25.12 - Red Hat OpenShift AICriticalVulnerability
- Red Hat Security Advisory: RHOAI 3.5.2 - Red Hat OpenShift AICriticalVulnerability
- Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Container Release UpdateCriticalVulnerability
- Red Hat Security Advisory: cert-manager Operator for Red Hat OpenShift 1.18.2HighVulnerability
- Red Hat Security Advisory: cert-manager Operator for Red Hat OpenShift 1.18.2HighVulnerability