The rhc-worker-playbook component in Red Hat Enterprise Linux 10, which executes Ansible playbooks on the local host, is affected by two security vulnerabilities. CVE-2026-32282 involves golang's internal syscall/unix package where the Root.Chmod function can improperly follow symbolic links outside the root directory, potentially leading to unauthorized file permission changes. CVE-2026-32283 is a denial of service vulnerability in golang's crypto/tls package caused by processing multiple TLS 1.3 key update messages. Red Hat has issued an Important security advisory (RHSA-2026:11863) providing updated packages to remediate these issues. The advisory covers multiple architectures and extended support versions of Red Hat Enterprise Linux 10. The vendor advisory does not provide CVSS scores but rates the impact as Important.

The vulnerabilities could allow unauthorized modification of file permissions outside the intended root directory due to symlink following (CVE-2026-32282) and cause denial of service conditions via TLS 1.3 key update message handling (CVE-2026-32283). These issues affect the rhc-worker-playbook component that executes Ansible playbooks locally, potentially impacting system stability and security. The advisory rates the impact as Important, indicating a significant security concern but does not specify exploitation in the wild.

Red Hat has released updated rhc-worker-playbook packages for Red Hat Enterprise Linux 10 and its extended support versions that address these vulnerabilities. Users should apply the security update as described in the Red Hat advisory RHSA-2026:11863 and the referenced article https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the official update.