This advisory concerns two security vulnerabilities (CVE-2025-60542 and CVE-2025-66031) affecting Red Hat Developer Hub, an extensible developer portal based on Backstage.io. The vulnerabilities relate to CWE-89 (SQL Injection) and CWE-674 (Improper Control of a Resource Through its Lifetime), which could allow attackers to manipulate database queries or improperly manage resources. The advisory announces the release of RHDH 1.8.1 but does not explicitly state that this release contains fixes for these vulnerabilities. No CVSS score is provided, and no known exploits have been reported. The product is self-managed and deployed on Kubernetes clusters, not a cloud service. The vendor advisory lacks detailed patch or mitigation information.

The vulnerabilities are rated as high severity and involve critical weaknesses such as SQL Injection and resource lifetime control issues, which could potentially lead to unauthorized data access or resource misuse. However, no known exploits are currently reported in the wild. The lack of explicit patch information means affected systems may remain vulnerable until a confirmed fix is available.

Patch status is not yet confirmed — check the Red Hat advisory (RHSA-2025:22861) and official Red Hat security updates for current remediation guidance. Since no fixes are explicitly mentioned in the advisory, users should monitor Red Hat's security channels for updates. Until a fix is confirmed, consider limiting exposure of the Red Hat Developer Hub deployment and applying any recommended configuration hardening from Red Hat documentation relevant to RHDH and Kubernetes environments.