Red Hat Security Advisory: RHOAI 3.3.7 - Red Hat OpenShift AI
Affects Red HatSource GCVE Database
Not known to be exploited · CVSS 7.5 High →: upgrade Red Hat url to 1.25.6 or 1.24.12 soon.
Data as of 26 Oct 2026, 17:16 UTC
- EPSS
- 2.2% chance of exploitation in 30 days – higher than 83% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in 1.25.6, 1.24.12
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H- Attack Vector
- Network
- Attack Complexity
- Low
- Privileges Required
- None
- User Interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Bold values are the worst case: easiest to exploit or largest impact.
- Attack Vector: Network
- The vulnerable component is bound to the network stack and the set of possible attackers extends beyond the other options listed, up to and including the entire Internet. Such a vulnerability is often termed 'remotely exploitable' and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers).
- Attack Complexity: Low
- Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success against the vulnerable component.
- Privileges Required: None
- The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files to carry out an attack.
- User Interaction: None
- The vulnerable system can be exploited without any interaction from any user.
- Scope: Unchanged
- An exploited vulnerability can only affect resources managed by the same security authority. In this case, the vulnerable component and the impacted component are either the same, or both are managed by the same security authority.
- Confidentiality: None
- There is no loss of confidentiality within the impacted component.
- Integrity: None
- There is no loss of integrity within the impacted component.
- Availability: High
- There is total loss of availability, resulting in the attacker being able to fully deny access to resources in the impacted component; this loss is either sustained (while the attacker continues to deliver the attack) or persistent (the condition persists even after the attack has completed). Alternatively, the attacker has the ability to deny some availability, but the loss of availability presents a direct, serious consequence to the impacted component (e.g., the attacker cannot disrupt existing connections, but can prevent new connections; the attacker can repeatedly exploit a vulnerability that, in each instance of a successful attack, leaks a only small amount of memory, but after repeated exploitation causes a service to become completely unavailable).
Definitions: FIRST CVSS v3.1 specification.
Exploitation evidence
Disclosed: evidence found.
CVE published 28 Jan 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
- Disclosed
- The CVE record is public on cve.org. Its publication is t = 0.
- Detectable
- A public nuclei template can find exposed instances, for defenders and attackers alike.
- Weaponised
- Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
- Exploited in the wild
- CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
- Observed by OffSeq Mirage
- OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.
Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.
What to do
Upgrade net/url to 1.25.6 or 1.24.12.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Go standard librarynet/url | Affected
| Fixed in
|
| Go standard librarynet/url | Affected
| Fixed in
|
Gonet/urlpkg:golang/net/urlOther threats | Affected
| Fixed in– |
Gonet/urlpkg:golang/net/urlOther threats | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
Release of RHOAI 3.3.7 provides these changes:
- CWE-770Allocation of Resources Without Limits or Throttling (opens in a new tab)
Base weaknessLikelihood of exploit: HighCWE Top 25 (2025): #25
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
Requirements
Clearly specify the minimum and maximum expectations for capabilities, and dictate which behaviors are acceptable when resource allocation reaches limits.
Architecture and Design
Limit the amount of resources that are accessible to unprivileged users. Set per-user limits for resources. Allow the system administrator to define these limits. Be careful to avoid CWE-410.
Architecture and Design
Design throttling mechanisms into the system architecture. The best protection is to limit the amount of resources that an unauthorized user can cause to be expended.
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-409Improper Handling of Highly Compressed Data (Data Amplification) (opens in a new tab)
Base weakness
The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.
- OWASP Cheat Sheets
- OWASP ASVS 4.0.3
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-94Improper Control of Generation of Code ('Code Injection') (opens in a new tab)
Base weaknessLikelihood of exploit: MediumCWE Top 25 (2025): #10OWASP Top 10 A05:2025: Injection (opens in a new tab)
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Architecture and Design · Refactoring
Refactor your program so that you do not have to dynamically generate code.
Architecture and Design
Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which code can be executed by your product.
Implementation · Input Validation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-444Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') (opens in a new tab)
Base weaknessOWASP Top 10 A06:2025: Insecure Design (opens in a new tab)
The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.
Implementation
Use a web server that employs a strict HTTP parsing procedure, such as Apache.
Implementation
Use only SSL communication.
Implementation
Terminate the client session after each request.
- OWASP Cheat Sheets
- OWASP ASVS 4.0.3
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-248Uncaught Exception (opens in a new tab)
Base weaknessOWASP Top 10 A10:2025: Mishandling of Exceptional Conditions (opens in a new tab)
An exception is thrown from a function, but it is not caught.
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (opens in a new tab)
Base weaknessLikelihood of exploit: HighCWE Top 25 (2025): #6OWASP Top 10 A01:2025: Broken Access Control (opens in a new tab)
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Implementation · Input Validation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
Architecture and Design
For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks…
Implementation · Input Validation
Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174).
- OWASP Cheat Sheets
- OWASP ASVS 4.0.3
- Attack patterns
- Path Traversal (opens in a new tab)
- Using Slashes and URL Encoding Combined to Bypass Validation Logic (opens in a new tab)
- Manipulating Web Input to File System Calls (opens in a new tab)
- Using Escaped Slashes in Alternate Encoding (opens in a new tab)
- Using Slashes in Alternate Encoding (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-940Improper Verification of Source of a Communication Channel (opens in a new tab)
Base weaknessOWASP Top 10 A07:2025: Authentication Failures (opens in a new tab)
The product establishes a communication channel to handle an incoming request that has been initiated by an actor, but it does not properly verify that the request is coming from the expected origin.
Architecture and Design
Use a mechanism that can validate the identity of the source, such as a certificate, and validate the integrity of data to ensure that it cannot be modified in transit using an Adversary-in-the-Middle (AITM) attack.
- OWASP Cheat Sheets
- OWASP ASVS 4.0.3
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-295Improper Certificate Validation (opens in a new tab)
Base weaknessOWASP Top 10 A07:2025: Authentication Failures (opens in a new tab)
The product does not validate, or incorrectly validates, a certificate.
Architecture and Design · Implementation
Certificates should be carefully managed and checked to assure that data are encrypted with the intended owner's public key.
Implementation
If certificate pinning is being used, ensure that all relevant properties of the certificate are fully validated before the certificate is pinned, including the hostname.
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-125Out-of-bounds Read (opens in a new tab)
Base weaknessCWE Top 25 (2025): #8
The product reads data past the end, or before the beginning, of the intended buffer.
Implementation · Input Validation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
Architecture and Design · Language Selection
Use a language that provides appropriate memory abstractions.
- OWASP Cheat Sheets
- Attack patterns
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-191Integer Underflow (Wrap or Wraparound) (opens in a new tab)
Base weakness
The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.
- CWE-1333Inefficient Regular Expression Complexity (opens in a new tab)
Base weaknessLikelihood of exploit: High
The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.
Architecture and Design
Use regular expressions that do not support backtracking, e.g. by removing nested quantifiers.
System Configuration
Set backtracking limits in the configuration of the regular expression implementation, such as PHP's pcre.backtrack_limit. Also consider limits on execution time for the process.
Implementation
Do not use regular expressions with untrusted input. If regular expressions must be used, avoid using backtracking in the expression.
- OWASP Cheat Sheets
- OWASP ASVS 4.0.3
- Attack patterns
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-918Server-Side Request Forgery (SSRF) (opens in a new tab)
Base weaknessCWE Top 25 (2025): #22OWASP Top 10 A01:2025: Broken Access Control (opens in a new tab)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
- OWASP Cheat Sheets
- OWASP ASVS 4.0.3
- Attack patterns
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-807Reliance on Untrusted Inputs in a Security Decision (opens in a new tab)
Base weaknessLikelihood of exploit: HighOWASP Top 10 A06:2025: Insecure Design (opens in a new tab)
The product uses a protection mechanism that relies on the existence or values of an input, but the input can be modified by an untrusted actor in a way that bypasses the protection mechanism.
Architecture and Design · Attack Surface Reduction
Store state information and sensitive data on the server side only.
Architecture and Design · Libraries or Frameworks
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
Architecture and Design
For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks…
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-346Origin Validation Error (opens in a new tab)
Class weaknessOWASP Top 10 A07:2025: Authentication Failures (opens in a new tab)
The product does not properly verify that the source of data or communication is valid.
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-267Privilege Defined With Unsafe Actions (opens in a new tab)
Base weakness
A particular privilege, role, capability, or right can be used to perform unsafe actions that were not intended, even when it is assigned to the correct entity.
Architecture and Design · Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
Architecture and Design · Operation · Environment Hardening
Run your code using the lowest privileges that are required to accomplish the necessary tasks. If possible, create isolated accounts with limited privileges that are only used for a single task. That way, a successful attack will not immediately give the attacker access to the rest of the software or its environment.
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (opens in a new tab)
Base weaknessLikelihood of exploit: HighCWE Top 25 (2025): #1OWASP Top 10 A05:2025: Injection (opens in a new tab)
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Architecture and Design · Libraries or Frameworks
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
Implementation · Architecture and Design
Understand the context in which your data will be used and the encoding that will be expected. This is especially important when transmitting data between different components, or when generating outputs that can contain multiple encodings at the same time, such as web pages or multi-part mail messages.
Architecture and Design · Implementation · Attack Surface Reduction
Understand all the potential areas where untrusted inputs can enter your software: parameters or arguments, cookies, anything read from the network, environment variables, reverse DNS lookups, query results, request headers, URL components, e-mail, files, filenames, databases, and any external systems that provide…
- OWASP Cheat Sheets
- OWASP ASVS 4.0.3
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-501Trust Boundary Violation (opens in a new tab)
Base weaknessOWASP Top 10 A06:2025: Insecure Design (opens in a new tab)
The product mixes trusted and untrusted data in the same data structure or structured message.
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-829Inclusion of Functionality from Untrusted Control Sphere (opens in a new tab)
Base weaknessOWASP Top 10 A08:2025: Software or Data Integrity Failures (opens in a new tab)
The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.
Architecture and Design · Libraries or Frameworks
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
Architecture and Design · Enforcement by Conversion
When the set of acceptable objects, such as filenames or URLs, is limited or known, create a mapping from a set of fixed input values (such as numeric IDs) to the actual filenames or URLs, and reject all other inputs.
Architecture and Design
For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks…
- OWASP Cheat Sheets
- OWASP ASVS 4.0.3
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-59Improper Link Resolution Before File Access ('Link Following') (opens in a new tab)
Base weaknessLikelihood of exploit: MediumOWASP Top 10 A01:2025: Broken Access Control (opens in a new tab)
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
Architecture and Design · Separation of Privilege
Follow the principle of least privilege when assigning access rights to entities in a software system.
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-1285Improper Validation of Specified Index, Position, or Offset in Input (opens in a new tab)
Base weakness
The product receives input that is expected to specify an index, position, or offset into an indexable resource such as a buffer or file, but it does not validate or incorrectly validates that the specified index/position/offset has the required properties.
Implementation · Input Validation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-347Name not in the CWE catalogue (opens in a new tab)
- CWE-551Name not in the CWE catalogue (opens in a new tab)
- CWE-306Name not in the CWE catalogue (opens in a new tab)
- CWE-1341Name not in the CWE catalogue (opens in a new tab)
- CWE-606Name not in the CWE catalogue (opens in a new tab)
- CWE-787Name not in the CWE catalogue (opens in a new tab)
- CWE-915Name not in the CWE catalogue (opens in a new tab)
- CWE-131Name not in the CWE catalogue (opens in a new tab)
- CWE-502Name not in the CWE catalogue (opens in a new tab)
- CWE-88Name not in the CWE catalogue (opens in a new tab)
- CWE-1289Name not in the CWE catalogue (opens in a new tab)
- CWE-281Name not in the CWE catalogue (opens in a new tab)
- CWE-1284Name not in the CWE catalogue (opens in a new tab)
- CWE-772Name not in the CWE catalogue (opens in a new tab)
- CWE-476Name not in the CWE catalogue (opens in a new tab)
- CWE-625Name not in the CWE catalogue (opens in a new tab)
- CWE-863Name not in the CWE catalogue (opens in a new tab)
- CWE-425Name not in the CWE catalogue (opens in a new tab)
- CWE-201Name not in the CWE catalogue (opens in a new tab)
- CWE-824Name not in the CWE catalogue (opens in a new tab)
- CWE-303Name not in the CWE catalogue (opens in a new tab)
- CWE-1050Name not in the CWE catalogue (opens in a new tab)
- CWE-190Name not in the CWE catalogue (opens in a new tab)
- CWE-776Name not in the CWE catalogue (opens in a new tab)
- CWE-843Name not in the CWE catalogue (opens in a new tab)
- CWE-41Name not in the CWE catalogue (opens in a new tab)
- CWE-835Name not in the CWE catalogue (opens in a new tab)
- CWE-908Name not in the CWE catalogue (opens in a new tab)
- CWE-214Name not in the CWE catalogue (opens in a new tab)
- CWE-78Name not in the CWE catalogue (opens in a new tab)
- CWE-454Name not in the CWE catalogue (opens in a new tab)
- CWE-1389Name not in the CWE catalogue (opens in a new tab)
- CWE-911Name not in the CWE catalogue (opens in a new tab)
- CWE-414Name not in the CWE catalogue (opens in a new tab)
- GCVE source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory ID
- RHSA-2026:73987
- Vendor Severity
- critical
- CVE Count
- 125
- Additional Cves
- CVE-2025-66471, CVE-2025-71408, CVE-2026-1525, CVE-2026-1526, CVE-2026-1528, CVE-2026-2229, CVE-2026-5422, CVE-2026-6321, CVE-2026-6734, CVE-2026-9697, CVE-2026-11816, CVE-2026-11822, CVE-2026-11824, CVE-2026-12151, CVE-2026-13149, CVE-2026-15154, CVE-2026-15378, CVE-2026-16221, CVE-2026-16745, CVE-2026-18951, CVE-2026-23490, CVE-2026-25681, CVE-2026-27136, CVE-2026-27489, CVE-2026-27893, CVE-2026-28356, CVE-2026-28500, CVE-2026-28684, CVE-2026-31230, CVE-2026-31958, CVE-2026-32274, CVE-2026-32286, CVE-2026-32597, CVE-2026-33186, CVE-2026-33231, CVE-2026-33245, CVE-2026-33811, CVE-2026-33814, CVE-2026-33815, CVE-2026-33816, CVE-2026-34445, CVE-2026-34986, CVE-2026-34993, CVE-2026-35397, CVE-2026-35536, CVE-2026-39821, CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, CVE-2026-39831, CVE-2026-39832, CVE-2026-39835, CVE-2026-40110, CVE-2026-41242, CVE-2026-42215, CVE-2026-42294, CVE-2026-42296, CVE-2026-42297, CVE-2026-42338, CVE-2026-42502, CVE-2026-42508, CVE-2026-44240, CVE-2026-44431, CVE-2026-44432, CVE-2026-44727, CVE-2026-44843, CVE-2026-45736, CVE-2026-46595, CVE-2026-48526, CVE-2026-48586, CVE-2026-48710, CVE-2026-48746, CVE-2026-48779, CVE-2026-49855, CVE-2026-53550, CVE-2026-54058, CVE-2026-54283, CVE-2026-55969, CVE-2026-56853, CVE-2026-56858, CVE-2026-56859, CVE-2026-56860, CVE-2026-56862, CVE-2026-59197, CVE-2026-59199, CVE-2026-59200, CVE-2026-59204, CVE-2026-59205, CVE-2026-59869, CVE-2026-59873, CVE-2026-59874, CVE-2026-59884, CVE-2026-59885, CVE-2026-59886, CVE-2026-62384, CVE-2026-63310, CVE-2026-64834, CVE-2026-64835, CVE-2026-66036, CVE-2026-66037, CVE-2026-66038, CVE-2026-66040, CVE-2026-67322, CVE-2026-67323, CVE-2026-67325, CVE-2026-68770, CVE-2026-69152, CVE-2026-69192, CVE-2026-69243, CVE-2026-69244, CVE-2026-71281, CVE-2026-73089, CVE-2026-73415, CVE-2026-73417, CVE-2026-73627, CVE-2026-78682, CVE-2026-79674, CVE-2026-79675, CVE-2026-80205, CVE-2026-81722, CVE-2026-81724, CVE-2026-81727, CVE-2026-84375, CVE-2026-84445
References
- access.redhat.com/errata/RHSA-2026:73987 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2025-61726 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2025-66471 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2025-71408 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-11816 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-11822 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-11824 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-12151 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-13149 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-15154 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-1525 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-1526 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-1528 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-15378 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-16221 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-16745 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-18951 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-2229 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-23490 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-25681 (opens in a new tab)
Community reviews
Related threats
- Red Hat Security Advisory: cert-manager Operator for Red Hat OpenShift 1.18.2HighVulnerability
- Red Hat Security Advisory: cert-manager Operator for Red Hat OpenShift 1.18.2HighVulnerability
- Red Hat Security Advisory: cert-manager Operator for Red Hat OpenShift 1.18.2HighVulnerability
- Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Container Release UpdateCriticalVulnerability
- Red Hat Security Advisory: Red Hat OpenShift API for Data ProtectionHighVulnerability