Red Hat Security Advisory: Red Hat Developer Hub 1.9.10 release
Affects Red HatSource GCVE Database
Mentioned vulnerabilities
Not known to be exploited · CVSS 8.7 High →: upgrade Red Hat vm2 to 3.11.6 soon.
Data as of 30 Oct 2026, 02:59 UTC
- Patch
- Available – fixed in 3.11.6
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N- Attack Vector
- Network
- Attack Complexity
- Low
- Attack Requirements
- None
- Privileges Required
- None
- User Interaction
- None
- Vulnerable system confidentiality
- None
- Vulnerable system integrity
- None
- Vulnerable system availability
- High
- Subsequent system confidentiality
- None
- Subsequent system integrity
- None
- Subsequent system availability
- None
Bold values are the worst case: easiest to exploit or largest impact.
- Attack Vector: Network
- The vulnerable system is bound to the network stack and the set of possible attackers extends beyond the other options listed below, up to and including the entire Internet. Such a vulnerability is often termed “remotely exploitable” and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers).
- Attack Complexity: Low
- The attacker must take no measurable action to exploit the vulnerability. The attack requires no target-specific circumvention to exploit the vulnerability. An attacker can expect repeatable success against the vulnerable system.
- Attack Requirements: None
- The successful attack does not depend on the deployment and execution conditions of the vulnerable system. The attacker can expect to be able to reach the vulnerability and execute the exploit under all or most instances of the vulnerability.
- Privileges Required: None
- The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files of the vulnerable system to carry out an attack.
- User Interaction: None
- The vulnerable system can be exploited without interaction from any human user, other than the attacker.
- Vulnerable system confidentiality: None
- There is no loss of confidentiality within the Vulnerable System.
- Vulnerable system integrity: None
- There is no loss of integrity within the Vulnerable System.
- Vulnerable system availability: High
- There is a total loss of availability, resulting in the attacker being able to fully deny access to resources in the Vulnerable System; this loss is either sustained (while the attacker continues to deliver the attack) or persistent (the condition persists even after the attack has completed). Alternatively, the attacker has the ability to deny some availability, but the loss of availability presents a direct, serious consequence to the Vulnerable System (e.g., the attacker cannot disrupt existing connections, but can prevent new connections; the attacker can repeatedly exploit a vulnerability that, in each instance of a successful attack, leaks a only small amount of memory, but after repeated exploitation causes a service to become completely unavailable).
- Subsequent system confidentiality: None
- There is no loss of confidentiality within the Subsequent System or all confidentiality impact is constrained to the Vulnerable System.
- Subsequent system integrity: None
- There is no loss of integrity within the Subsequent System or all integrity impact is constrained to the Vulnerable System.
- Subsequent system availability: None
- There is no impact to availability within the Subsequent System or all availability impact is constrained to the Vulnerable System.
Definitions: FIRST CVSS v4.0 specification.
Exploitation evidence
Disclosed: evidence found.
CVE published 17 Aug 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 29 Oct 2026.
- Disclosed
- The CVE record is public on cve.org. Its publication is t = 0.
- Detectable
- A public nuclei template can find exposed instances, for defenders and attackers alike.
- Weaponized
- A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
- Exploited in the wild
- CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
- Observed by OffSeq Mirage
- OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.
Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.
What to do
Upgrade vm2 to 3.11.6.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| patriksimekvm2 | Affected
| Fixed in
|
npmvm2pkg:npm/vm2Other threats | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
No fixes are currently available for Red Hat Developer Hub 1.9.10. Network-level protections and certificate pinning may reduce risk. Red Hat does not provide a direct fix for this version at this time.
Description
Red Hat Developer Hub (RHDH) 1.9.10 is an enterprise-grade developer portal based on Backstage.io, supporting Kubernetes clusters. The advisory mentions multiple CVEs including CVE-2026-111943, which involves a flaw in Go's crypto/x509 package that improperly validates certificates, allowing man-in-the-middle attacks via untrusted intermediate certificates. No fixes are currently available for RHDH 1.9.10. The vulnerability requires specific network positioning and attacker-controlled certificates. Red Hat rates this issue as important due to the potential compromise of secure communications.
Impact
The vulnerability allows attackers to bypass certificate validation, potentially enabling man-in-the-middle attacks that compromise the confidentiality and integrity of secure communications for Go-based clients or servers relying on standard TLS certificate verification. Exploitation requires attacker control over network traffic and certificates from distrusted intermediate authorities. This can lead to interception or alteration of confidential data during secure connections.
Summary
Red Hat Developer Hub (RHDH) 1.9.10 is a customizable developer portal supported on Kubernetes clusters. The advisory includes CVE-2026-111943, a vulnerability in Go's crypto/x509 package where certificate verification fails to block trust in intermediate certificates from compromised CAs. This flaw allows remote attackers to impersonate legitimate servers and conduct man-in-the-middle attacks by presenting certificates signed by these intermediates. Exploitation requires network positioning and attacker-generated certificates. Red Hat classifies this vulnerability as important with a CVSS score of 6.8, highlighting high confidentiality and integrity impact but no availability impact. No patches or fixes are currently provided for RHDH 1.9.10.
- CWE-770Allocation of Resources Without Limits or Throttling (opens in a new tab)
Base weaknessLikelihood of exploit: HighCWE Top 25 (2025): #25
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
Requirements
Clearly specify the minimum and maximum expectations for capabilities, and dictate which behaviors are acceptable when resource allocation reaches limits.
Architecture and Design
Limit the amount of resources that are accessible to unprivileged users. Set per-user limits for resources. Allow the system administrator to define these limits. Be careful to avoid CWE-410.
Architecture and Design
Design throttling mechanisms into the system architecture. The best protection is to limit the amount of resources that an unauthorized user can cause to be expended.
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-693Protection Mechanism Failure (opens in a new tab)
Pillar weaknessOWASP Top 10 A06:2025: Insecure Design (opens in a new tab)
The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.
MITRE discourages mapping vulnerabilities to this broad entry; the root cause is usually a more specific weakness.
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-913Improper Control of Dynamically-Managed Code Resources (opens in a new tab)
Class weaknessOWASP Top 10 A01:2021: Broken Access Control (opens in a new tab)
The product does not properly restrict reading from or writing to dynamically-managed code resources such as variables, objects, classes, attributes, functions, or executable instructions or statements.
Implementation · Input Validation
For any externally-influenced input, check the input against an allowlist of acceptable values.
Implementation · Architecture and Design · Refactoring
Refactor the code so that it does not need to be dynamically managed.
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-125Out-of-bounds Read (opens in a new tab)
Base weaknessCWE Top 25 (2025): #8
The product reads data past the end, or before the beginning, of the intended buffer.
Implementation · Input Validation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
Architecture and Design · Language Selection
Use a language that provides appropriate memory abstractions.
- OWASP Cheat Sheets
- Attack patterns
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-94Improper Control of Generation of Code (Code Injection) (opens in a new tab)
Base weaknessLikelihood of exploit: MediumCWE Top 25 (2025): #10OWASP Top 10 A05:2025: Injection (opens in a new tab)
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Architecture and Design · Refactoring
Refactor your program so that you do not have to dynamically generate code.
Architecture and Design
Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which code can be executed by your product.
Implementation · Input Validation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-114Process Control (opens in a new tab)
Class weaknessOWASP Top 10 A05:2025: Injection (opens in a new tab)
Executing commands or loading libraries from an untrusted source or in an untrusted environment can cause an application to execute malicious commands (and payloads) on behalf of an attacker.
MITRE discourages mapping vulnerabilities to this broad entry; the root cause is usually a more specific weakness.
Architecture and Design · Libraries or Frameworks
Libraries that are loaded should be well understood and come from a trusted source. The application can execute code contained in the native libraries, which often contain calls that are susceptible to other security problems, such as buffer overflows or command injection.
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-668Exposure of Resource to Wrong Sphere (opens in a new tab)
Class weaknessOWASP Top 10 A01:2025: Broken Access Control (opens in a new tab)
The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
MITRE discourages mapping vulnerabilities to this broad entry; the root cause is usually a more specific weakness.
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-732Incorrect Permission Assignment for Critical Resource (opens in a new tab)
Class weaknessLikelihood of exploit: HighOWASP Top 10 A01:2025: Broken Access Control (opens in a new tab)
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
Implementation
When using a critical resource such as a configuration file, check to see if the resource has insecure permissions (such as being modifiable by any regular user), and generate an error or even exit the software if there is a possibility that the resource could have been modified by an unauthorized party.
Architecture and Design
Divide the software into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully defining distinct user groups, privileges, and/or roles. Map these against data, functionality, and the related resources. Then set the permissions accordingly.
Architecture and Design · Operation · Sandbox or Jail
Run the code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which files can be accessed in a particular directory or which commands can be executed by the software.
- OWASP Cheat Sheets
- Attack patterns
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-1100Insufficient Isolation of System-Dependent Functions (opens in a new tab)
Base weakness
The product or code does not isolate system-dependent functionality into separate standalone modules.
- CWE-200Exposure of Sensitive Information to an Unauthorized Actor (opens in a new tab)
Class weaknessLikelihood of exploit: HighCWE Top 25 (2025): #20OWASP Top 10 A01:2025: Broken Access Control (opens in a new tab)
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
MITRE discourages mapping vulnerabilities to this broad entry; the root cause is usually a more specific weakness.
Architecture and Design · Separation of Privilege
Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-453Insecure Default Variable Initialization (opens in a new tab)
Variant weakness
The product, by default, initializes an internal variable with an insecure or less secure value than is possible.
System Configuration
Disable or change default settings when they can be used to abuse the system. Since those default settings are shipped with the product they are likely to be known by a potential attacker who is familiar with the product. For instance, default credentials should be changed or the associated accounts should be disabled.
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-706Use of Incorrectly-Resolved Name or Reference (opens in a new tab)
Class weaknessOWASP Top 10 A01:2021: Broken Access Control (opens in a new tab)
The product uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere.
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-248Uncaught Exception (opens in a new tab)
Base weaknessOWASP Top 10 A10:2025: Mishandling of Exceptional Conditions (opens in a new tab)
An exception is thrown from a function, but it is not caught.
Requirements
The choice between a language which has named or unnamed exceptions needs to be done. While unnamed exceptions exacerbate the chance of not properly dealing with an exception, named exceptions suffer from the up call version of the weak base class problem.
Requirements
A language can be used which requires, at compile time, to catch all serious exceptions. However, one must make sure to use the most current version of the API as new exceptions could be added.
Implementation
Catch all relevant exceptions. This is the recommended solution. Ensure that all exceptions are handled in such a way that you can be sure of the state of your system at any given moment.
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-269Improper Privilege Management (opens in a new tab)
Class weaknessLikelihood of exploit: MediumOWASP Top 10 A06:2025: Insecure Design (opens in a new tab)
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
MITRE discourages mapping vulnerabilities to this broad entry; the root cause is usually a more specific weakness.
Architecture and Design · Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
Architecture and Design · Separation of Privilege
Follow the principle of least privilege when assigning access rights to entities in a software system.
Architecture and Design · Separation of Privilege
Consider following the principle of separation of privilege. Require multiple conditions to be met before permitting access to a system resource.
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-1220Insufficient Granularity of Access Control (opens in a new tab)
Base weakness
The product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a system from untrusted agents. However, implemented access controls lack the required granularity
Architecture and Design · Implementation · Testing
Access-control-policy protections must be reviewed for design inconsistency and common weaknesses.; Access-control-policy definition and programming flow must be tested in pre-silicon, post-silicon testing.
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-358Improperly Implemented Security Check for Standard (opens in a new tab)
Base weakness
The product does not implement or incorrectly implements one or more security-relevant checks as specified by the design of a standardized algorithm, protocol, or technique.
- CWE-653Improper Isolation or Compartmentalization (opens in a new tab)
Class weaknessOWASP Top 10 A06:2025: Insecure Design (opens in a new tab)
The product does not properly compartmentalize or isolate functionality, processes, or resources that require different privilege levels, rights, or permissions.
Architecture and Design
Break up privileges between different modules, objects, or entities. Minimize the interfaces between modules and require strong access control between them.
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-184Incomplete List of Disallowed Inputs (opens in a new tab)
Base weaknessOWASP Top 10 A03:2021: Injection (opens in a new tab)
The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete.
Implementation · Input Validation
Do not rely exclusively on detecting disallowed inputs. There are too many variants to encode a character, especially when different environments are used, so there is a high likelihood of missing some variants. Only use detection of disallowed inputs as a mechanism for detecting suspicious activity.
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-295Improper Certificate Validation (opens in a new tab)
Base weaknessOWASP Top 10 A07:2025: Authentication Failures (opens in a new tab)
The product does not validate, or incorrectly validates, a certificate.
Architecture and Design · Implementation
Certificates should be carefully managed and checked to assure that data are encrypted with the intended owner's public key.
Implementation
If certificate pinning is being used, ensure that all relevant properties of the certificate are fully validated before the certificate is pinned, including the hostname.
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- GCVE source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory ID
- RHSA-2026:91651
- Vendor Severity
- critical
- CVE Count
- 32
- Additional Cves
- CVE-2026-47686, CVE-2026-47698, CVE-2026-84445, CVE-2026-92934, CVE-2026-92935, CVE-2026-92937, CVE-2026-92938, CVE-2026-92939, CVE-2026-92940, CVE-2026-92941, CVE-2026-92942, CVE-2026-92944, CVE-2026-92946, CVE-2026-92947, CVE-2026-92948, CVE-2026-92950, CVE-2026-92951, CVE-2026-92953, CVE-2026-92954, CVE-2026-92955, CVE-2026-92956, CVE-2026-92957, CVE-2026-92958, CVE-2026-92959, CVE-2026-92960, CVE-2026-92961, CVE-2026-93603, CVE-2026-93604, CVE-2026-93605, CVE-2026-93606, CVE-2026-111943
References
- access.redhat.com/errata/RHSA-2026:91651 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-111943 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-47683 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-47686 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-47698 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-84445 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-92934 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-92935 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-92937 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-92938 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-92939 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-92940 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-92941 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-92942 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-92944 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-92946 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-92947 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-92948 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-92950 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-92951 (opens in a new tab)
Community reviews
Related threats
- Red Hat Security Advisory: Release of components for Service Telemetry Framework 1.5.7HighVulnerability
- Red Hat Security Advisory: ignition security updateHighVulnerability
- Red Hat Security Advisory: ignition security updateHighVulnerability
- Red Hat Security Advisory: Red Hat build of MicroShift 4.20.44 security updateHighVulnerability
- Red Hat Security Advisory: Red Hat Service Interconnect 2.2.4 Release (rpms)HighVulnerability