The advisory covers security fixes for the trivy RPMs in Red Hat Hardened Images, including CVE-2026-46680, which is a containerd vulnerability. The flaw allows containers with a malformed numeric User directive to bypass Kubernetes runAsNonRoot restrictions, potentially running as root (UID 0). Red Hat products do not use containerd as a runtime but as a build-time dependency, and the vulnerable code path is not exercised, so the vulnerability is not exploitable in these products. The advisory recommends enforcing a numeric runAsUser in Kubernetes Pod securityContext and restricting image push access. The update includes trivy version 0.72.0-0.1.hum1 for aarch64 and x86_64 architectures. No direct patch status is explicitly stated, but updated RPMs are provided.

If exploited, the vulnerability could allow privilege escalation by bypassing Kubernetes runAsNonRoot restrictions, causing containers to run as root unexpectedly. However, in Red Hat products, the vulnerable code path is not exercised, so the risk of exploitation is minimal in these environments. The impact is high if the vulnerability were exploitable, but Red Hat's use context mitigates this risk.

Red Hat advises enforcing a specific numeric runAsUser in the Kubernetes Pod securityContext to override the User directive in container images, preventing bypass. Additionally, restrict access to push container images to trusted users and validate image provenance before deployment. Updated trivy RPMs are available and should be applied. Since the vulnerable code path is not exercised in Red Hat products, the risk is mitigated but these steps further reduce exposure.