A critical vulnerability (CVE-2026-18963) affects the Red Hat build of Keycloak 26.4.15, allowing unauthenticated attackers to bypass the reset-credentials flow and take over user accounts. This impacts both standalone installations and deployments on OpenShift Container Platform. Red Hat has released updated packages and container images to address this issue. Users are advised to back up their installations before applying the update.
Multiple critical vulnerabilities were found in Red Hat build of Keycloak 26.6.6 images used in OpenShift Container Platform. These include privilege escalation via a TOCTOU vulnerability, unauthenticated account takeover, leakage of rotated client secrets, predictable account-linking hashes enabling account takeover, and unauthorized disclosure of hidden group metadata. Red Hat has released updated container images to address these issues for on-premise and private cloud deployments.
Red Hat Advanced Cluster Management for Kubernetes provides the
capabilities to address common challenges that administrators and site
reliability engineers face as they work across a range of public and
private cloud environments. Clusters and applications are all visible and
managed from a single console—with security policy built in.
This advisory contains the container images for Red Hat Advanced Cluster
Management for Kubernetes, which add new features and enhancements, bug
fixes, and updated container images. See the following
Release Notes documentation, which will be updated shortly for this
release, for additional details about this release:
https://docs.redhat.com/en/documentation/red_hat_advanced_cluster_management_for_kubernetes/2.14/html-single/release_notes/index#acm-release-notes
Multiple security vulnerabilities affecting the Linux kernel have been addressed in a Red Hat kernel live patch targeted for kernel-5.14.0-570.17.1.el9_6. The fixes include issues in IPv6 ICMP handling, distributed lock manager validation, netfilter flowtable action limits, IPv6 inner header offset desynchronization, and a use-after-free in network traffic control. These vulnerabilities have high severity and could potentially be exploited to compromise system integrity. The patch is part of a broader Linux kernel security update also addressed by Ubuntu and other vendors. Users must apply the update and reboot to ensure protection.
Red Hat OpenShift Container Platform is Red Hat's cloud computing
Kubernetes application platform solution designed for on-premise or private
cloud deployments.
This advisory contains the container images for Red Hat OpenShift Container
Platform 4.22.10. See the following advisory for the RPM packages for this
release:
https://access.redhat.com/errata/RHBA-2026:54768
Space precludes documenting all of the container images in this advisory.
See the following Release Notes documentation, which will be updated
shortly for this release, for details about these changes:
https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/
Security Fix(es):
* kernel: xen: AMD Zen 2 Processors: Privilege escalation via improper CPU
cache isolation (CVE-2025-54518)
* samba: Missing access check on reparse point operations (CVE-2026-1933)
* sssd: sssd: sudo LDAP provider searches entire directory tree for
sudoRole objects by default, enabling privilege escalation (CVE-2026-14474)
* sg3_utils: sg3_utils: arbitrary command execution via udev property
injection in sg_inq --export (CVE-2026-16313)
* rsync: TOCTOU symlink race condition allowing local privilege escalation
in daemon mode without chroot. (CVE-2026-29518)
* unbound: Unbound: Denial of Service via excessive EDNS options
(CVE-2026-41292)
* vim: Vim: Arbitrary Code Execution via crafted directory names
(CVE-2026-47162)
* vim: Vim: Arbitrary code execution via crafted step-definition patterns
(CVE-2026-47167)
* vim: Vim: Arbitrary code execution via Python omni-completion
(CVE-2026-52858)
* acl: Symlink traversal privilege escalation via libacl functions
(CVE-2026-54369)
* vim: Vim: Arbitrary code execution via malicious docstrings in Python
omni-completion (CVE-2026-57456)
* openssh: OpenSSH: Use-after-free vulnerability during host key
re-exchange on the client side (CVE-2026-60002)
* kernel: KVM: x86: Don't (re)check L1 intercepts when completing userspace
I/O (CVE-2025-40026)
* libarchive: Double-Free Vulnerability in RAR5 Decompression Logic via
dangling filtered_buf pointer in init_unpack() (CVE-2026-14164)
* sssd: sssd: GPO cache path traversal via unsanitized gPCFileSysPath
allows Kerberos authentication bypass (CVE-2026-14476)
* unbound: Unbound: Cache manipulation via 'ghost domain names' attack
(CVE-2026-40622)
* vim: Vim: Out-of-bounds Write in Spell File Word Count (CVE-2026-55693)
* vim: Vim: Denial of Service via stack out-of-bounds write in
spell_soundfold_sofo() (CVE-2026-57455)
* vim: Vim: Arbitrary code execution via crafted PHP file in
omni-completion (CVE-2026-59856)
* vim: Vim: Arbitrary command execution via crafted tags file in C
omni-completion (CVE-2026-59858)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
All OpenShift Container Platform 4.22 users are advised to upgrade to these
updated packages and images when they are available in the appropriate
release channel. To check for available updates, use the OpenShift CLI (oc)
or web console. Instructions for upgrading a cluster are available at
https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.
A security update for Red Hat Hardened Images addresses multiple vulnerabilities in OpenSSL 3, including memory growth issues, heap buffer overflows, invalid pointer dereferences, and cryptographic forgery risks. These vulnerabilities affect components such as QUIC server processing, CMP response validation, and PKCS#12 file handling. The update fixes these issues in OpenSSL version 3.5.6-0.5.hum1 and related packages. The update is available and should be applied to mitigate the risks.
A denial of service vulnerability (CVE-2026-55204) exists in HAProxy related to HPACK dynamic table insertions. This affects the haproxy packages used as network load balancers for TCP and HTTP applications in Red Hat Enterprise Linux 8. A security update is available to address this issue.
Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to individual teams, while automation developers retain the freedom to write tasks that leverage existing knowledge without the overhead. Ansible Automation Platform makes it possible for users across an organization to share, vet, and manage automation content by means of a simple, powerful, and agentless language.
For details about this release, refer to the release notes listed in the References section.
The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based applications.
Security Fix(es):
* haproxy: HAProxy: Denial of Service via HPACK dynamic table insertions (CVE-2026-55204)
* haproxy: HAProxy: Response smuggling due to integer overflow in FastCGI record length handling (CVE-2026-55203)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Red Hat issued a critical security advisory for Multicluster Global Hub version 1.4.8 addressing multiple vulnerabilities. The update includes security fixes, bug fixes, and updated container images but does not provide explicit patch links or detailed remediation instructions. The advisory references several CVEs with a critical severity rating. Multicluster Global Hub enables management of multiple hub clusters from a single hub cluster.
The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.
Security Fix(es):
* kernel: mm/slub: avoid accessing metadata when pointer is invalid in object_err() (CVE-2025-39902)
* kernel: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CVE-2026-43206)
* kernel: crypto: ccp - copy IV using skcipher ivsize (CVE-2026-53016)
* kernel: drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CVE-2026-53136)
* kernel: drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CVE-2026-53329)
* kernel: drm/amdgpu: zero-initialize GART table on allocation (CVE-2026-53374)
* kernel: drm/i915: Fix potential UAF in TTM object purge (CVE-2026-63884)
* kernel: drm/amdgpu: fix amdgpu_hmm_range_get_pages (CVE-2026-63879)
* kernel: drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CVE-2026-64219)
* kernel: can:bcm: arbitrary kernel code execution leading to escalate privileges (CVE-2026-17523)
Bug Fix(es) and Enhancement(s):
* Backport "sched/deadline: Fix bandwidth reclaim equation in GRUB" to RHEL 8.10 (JIRA:RHEL-189997)
* vhost: reset the vring metadata cache on vring reconfiguration [rhel-8.10.z] (JIRA:RHEL-224556)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
This is a kernel live patch module which can be loaded by the kpatch command line utility to modify the code of a running kernel. This patch module is targeted for kernel-6.12.0-211.16.1.el10_2.
Security Fix(es):
* kernel: rxrpc: Fix RxGK token loading to check bounds (CVE-2026-31641)
* kernel: ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (CVE-2026-43038)
* kernel: netfilter: flowtable: strictly check for maximum number of actions (CVE-2026-43329)
* kernel: netfilter: nft_inner: Fix IPv6 inner_thoff desync (CVE-2026-46244)
* kernel: net: sched: UAF via missing handler for TC_ACT_CONSUMED in tcf_qevent_handle (CVE-2026-64530)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.
Security Fix(es):
* kernel: net/sched: act_api: use RCU with deferred freeing for action lifecycle (CVE-2026-53264)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages contain a collection of well-supported plug-ins of good quality and under the LGPL license.
Security Fix(es):
* gstreamer1-plugins-good: gstreamer: unsigned integer underflow in avidemux FUJIFILM strd parsing leading to out-of-bounds read/write (CVE-2026-73433)
* gstreamer1-plugins-good: gstreamer: out-of-bounds read in avidemux vprp video field descriptor parsing (CVE-2026-73434)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Multiple security vulnerabilities have been identified and fixed in the curl packages provided by Red Hat Enterprise Linux 10. These vulnerabilities include improper certificate validation, authentication bypass, unauthorized access due to connection reuse, OAuth2 token leakage, man-in-the-middle attacks via SSH host key bypass, and other security feature bypasses. The update addresses these issues to improve the security of libcurl and the curl utility.
When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication state between requests. Specifically, if the initial transfer authenticates against `proxyA` using Digest auth, a subsequent transfer routed through `proxyB` erroneously leaks the `Proxy-Authorization:` header intended solely for `proxyA`.
Two high-severity security vulnerabilities have been identified in the X.Org X11 libXfont2 runtime library affecting Red Hat Enterprise Linux 10 and related products. These include an out-of-bounds read/write issue (CVE-2026-59679) and a privilege escalation via heap buffer overflow (CVE-2026-44950) in the Font Server Client component. Red Hat has released official security updates addressing these issues across multiple architectures. Users are advised to apply the provided patches to remediate these vulnerabilities.