Red Hat Developer Hub versions before 1.7.0 contain multiple security vulnerabilities including CVE-2025-5417 and eight others. One notable vulnerability (CVE-2025-22870) involves improper proxy host matching that allows bypassing proxy settings by manipulating IPv6 zone IDs, potentially leading to denial of service or unauthorized data access. The vulnerabilities span several CWE categories such as improper input validation (CWE-20), improper access control (CWE-266), and path traversal (CWE-22). Red Hat released RHDH 1.7.0 to address these issues, updating underlying components like Backstage to version 1.39. The advisory does not list explicit patches but indicates the new version as the fix.

The vulnerabilities can lead to improper proxy bypass, denial of service through resource exhaustion or crashes, unauthorized reading of confidential data, and potential modification or execution of unauthorized commands. The impact is rated high by Red Hat, reflecting significant risk if exploited. However, no known exploits in the wild have been reported. The issues affect the confidentiality, integrity, and availability of systems running affected versions of RHDH.

Upgrade to Red Hat Developer Hub version 1.7.0, which includes fixes for the identified vulnerabilities. No other mitigations are noted or recommended by Red Hat. Since this is a self-managed product, users must apply the update themselves. There is no indication that temporary workarounds or mitigations meet Red Hat's criteria for deployment or stability.