The rhc-worker-playbook component in Red Hat Enterprise Linux 10 has two security vulnerabilities fixed in this update. CVE-2026-32282 is a flaw in the Go language's internal syscall/unix package where the Root.Chmod function can follow symbolic links outside the root directory, potentially leading to unauthorized file permission changes. CVE-2026-32283 is a denial of service vulnerability in Go's crypto/tls package caused by processing multiple TLS 1.3 key update messages, which can disrupt TLS connections. The advisory provides updated rhc-worker-playbook packages for multiple architectures and Red Hat Enterprise Linux variants. The vendor rates the security impact as Important and recommends applying the update. No CVSS scores are provided in the advisory.

Successful exploitation of CVE-2026-32282 could allow an attacker to manipulate file permissions outside the intended root directory via symlink traversal during chmod operations, potentially leading to unauthorized file modifications. CVE-2026-32283 could allow an attacker to cause a denial of service by sending multiple TLS 1.3 key update messages, disrupting secure communications. These vulnerabilities affect the rhc-worker-playbook component that executes Ansible playbooks locally, which may impact system integrity and availability. No known exploits are reported in the wild.

Red Hat has released updated rhc-worker-playbook packages addressing these vulnerabilities. Users should apply the security update as described in Red Hat advisory RHSA-2026:11863 and the referenced article https://access.redhat.com/articles/11258. Applying the official update is the recommended remediation. No additional mitigation steps are specified by the vendor. Patch status is confirmed by the vendor advisory.