The rhc-worker-playbook component in Red Hat Enterprise Linux 10, which executes Ansible playbooks locally, is affected by two vulnerabilities in the underlying Go language libraries. CVE-2026-32282 involves the internal/syscall/unix package's Root.Chmod function improperly following symlinks outside the intended root directory, potentially allowing unauthorized file permission changes. CVE-2026-32283 is a denial of service vulnerability in the crypto/tls package caused by processing multiple TLS 1.3 key update messages. Red Hat has issued an important security update (RHSA-2026:11863) that addresses these issues by updating the rhc-worker-playbook package. The advisory covers multiple architectures and versions of Red Hat Enterprise Linux 10 and provides instructions for applying the update.

The vulnerabilities could allow unauthorized modification of file permissions outside the intended root directory (CVE-2026-32282) and cause denial of service via TLS 1.3 key update message handling (CVE-2026-32283). These issues affect the rhc-worker-playbook component that executes Ansible playbooks locally, potentially impacting system integrity and availability. The severity is rated as important by Red Hat, indicating a high impact on affected systems if exploited.

Red Hat has released an official security update for rhc-worker-playbook in Red Hat Enterprise Linux 10 that addresses these vulnerabilities. Users should apply the updated packages as described in the Red Hat advisory RHSA-2026:11863 and the referenced article https://access.redhat.com/articles/11258. Applying this update remediates the issues. No additional mitigation steps are indicated by the vendor.