Red Hat has issued an important security advisory for Red Hat AMQ Clients 2026.Q3 addressing multiple vulnerabilities in components such as Apache Qpid Proton-J, Jackson-databind, Netty, Spring Boot, and others. The vulnerabilities include denial of service, authentication bypass, arbitrary code execution, information disclosure, and HTTP request smuggling. These flaws affect message sending and receiving capabilities with AMQ Broker 7. The update also includes numerous bug fixes and enhancements. Users are advised to apply this update after ensuring all previous errata are applied.
Multiple security vulnerabilities have been identified in Red Hat AI Inference Server versions 3.4.0 through 3.4.5 (rocm). These vulnerabilities are collectively addressed in Red Hat Security Advisory RHSA-2026:69469. No specific fixes or patches are currently provided in the advisory. The vulnerabilities affect a range of security weaknesses as indicated by numerous CWE identifiers. The severity of these vulnerabilities is assessed as high.
A stack-based buffer overflow flaw was found in fetchmail when built with NTLM support. A malicious or compromised mail server advertising NTLM authentication can send a crafted Type 2 challenge that causes fetchmail to write past a fixed stack buffer while building the NTLM authenticate response. This may lead to remote code execution depending on stack-frame layout, or to authentication failure or process termination under memory hardening.
CVE-2026-80110 is a security vulnerability in the pki-core component of Red Hat Enterprise Linux 10. The flaw involves the v2 REST ACL filter incorrectly selecting permissions due to lexicographic string comparison rather than specificity, allowing a wildcard permission to override a more specific literal permission. This enables a lower-privileged user group to perform an administrative action intended to require higher privileges. The vulnerability impacts the confidentiality and integrity of the certificate authority's issuance policy. A security update addressing this issue is available from Red Hat.
CVE-2026-75939 is a vulnerability in the openshift/oc-mirror tool of Red Hat OpenShift Container Platform 4.18. The tool improperly verifies PGP release image signatures by checking for signature errors prematurely, allowing an attacker to bypass signature verification. This flaw could enable a remote attacker to craft a malicious release payload that the oc-mirror tool would accept and mirror into a disconnected registry, potentially compromising software deployment integrity. Red Hat has released OpenShift Container Platform 4.18.57 with fixes addressing this issue.
Multiple security vulnerabilities were identified in OpenSSH affecting both client and server components. These include an sftp client flaw allowing attackers to control the location of downloaded files (CVE-2026-59995), a security bypass in sshd due to improper handling of forwarding and tunneling options (CVE-2026-59999), and a use-after-free vulnerability in the ssh client leading to information disclosure and potential data corruption (CVE-2026-73282). Red Hat and Ubuntu have released patches addressing these issues. The vulnerabilities impact various OpenSSH versions distributed with Red Hat Enterprise Linux 8 and Ubuntu LTS releases. The issues are rated with high severity.
Red Hat Data Grid 8.6.3 includes multiple security fixes addressing vulnerabilities such as denial of service, information disclosure, cross-site scripting, and security bypass primarily in Netty components and related libraries. These issues affect the in-memory distributed NoSQL datastore and could impact availability, confidentiality, and integrity. The update replaces version 8.6.2 and resolves a range of CVEs including CVE-2026-44891 (Netty STOMP decoder DoS) and CVE-2026-49978 (DOMPurify XSS).
A flaw was found in the signature verification logic of noobaa-core, the core component of the NooBaa Multicloud Object Gateway. The issue occurs when the service processes S3 presigned URLs using Signature Version 4 (SigV4). Due to improper validation, the service fails to reject requests containing unsigned x-amz- headers, instead simply dropping them from the signature calculation. This allows an attacker who possesses a valid presigned PUT URL to add an unsigned x-amz-copy-source header, effectively converting a simple upload into a CopyObject operation. This can lead to unauthorized access and copying of any data the original signer is permitted to reach across the entire storage system.
Red Hat has released a security advisory addressing multiple vulnerabilities in the satellite/iop-host-inventory-frontend-rhel9 component used in Red Hat Satellite, part of Red Hat Lightspeed. This component analyzes system health and configuration locally without sending data externally. Several CVEs including CVE-2026-59879 are associated with this advisory. A patch is available for affected versions, and users are advised to update accordingly.
Multiple security vulnerabilities affecting Apache Tomcat as distributed by Red Hat have been identified and fixed. These include issues such as improper input validation, authentication bypass, HTTP/2 header validation flaws, information disclosure during WebSocket authentication, improper authorization, case sensitivity handling errors, and security constraint bypasses. The vulnerabilities have a moderate security impact and affect Red Hat Enterprise Linux versions from 10.1.0 up to but not including 10.1.49. Red Hat has released an update addressing these issues.
A vulnerability in CRI-O checkpoint restore allows a user who can create a pod from a malicious checkpointed container to bypass the destination Kubernetes security context. The restored process may retain credentials, Linux capabilities, no_new_privs, and seccomp state from the checkpoint instead of enforcing the destination configuration. This can allow execution with elevated privileges across the container security boundary.
Affected upstream supported versions are CRI-O 1.34 and later. Downstream Red Hat products are affected from OCP 4.17 onward. Fixes have been applied to supported branches but are not yet released.
Exploitation requires permission to create a pod from a malicious checkpoint image and checkpoint restore functionality to be available.
Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.
This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.22.7. See the following advisory for the container images for this release:
https://access.redhat.com/errata/RHSA-2026:44237
Security Fix(es):
* golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting (CVE-2026-25681)
* fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization (CVE-2026-13676)
* brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity (CVE-2026-13149)
* golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass (CVE-2026-27136)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
All OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.
A vulnerability was found in CRI-O related to the container checkpoint and restore feature. When CRI-O is configured to restore containers from checkpoint archives, insufficient validation of restore metadata may allow a user with sufficient privileges to perform unintended operations on the host filesystem. Successful exploitation requires that container checkpoint and restore functionality is enabled, which is not the default configuration. An attacker must also be able to trigger restoration of a container from untrusted checkpoint content.
Red Hat Developer Hub (RHDH) versions prior to 1.9.9 contain a high severity security vulnerability identified as CVE-2026-19534. RHDH is an enterprise-grade, self-managed developer portal based on Backstage.io, supported on Kubernetes platforms including OpenShift. Red Hat released version 1.9.9 to address this and other issues. No CVSS score is provided for this vulnerability.
A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients.
Security Fix(es):
* golang-fips: Golang FIPS zeroed buffer (CVE-2024-9355)
* golang: net/http: net/http: sensitive headers incorrectly sent after cross-domain redirect (CVE-2024-45336)
* crypto/internal/nistec: golang: Timing sidechannel for P-256 on ppc64le in crypto/internal/nistec (CVE-2025-22866)
* crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption (CVE-2025-68121)
* crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281)
* crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application (CVE-2026-33810)
* golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)
* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)
* crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)
* golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821)
* mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header (CVE-2026-42504)
* encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818)
* net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860)
* net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853)
* html/template: golang: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858)
* crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862)
* encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
A flaw was found in the authentication session management of Keycloak, an identity and access management solution. The issue occurs when an administrator enforces a stronger authentication flow, such as mandatory two-factor authentication (2FA) setup, through a client policy. A user can bypass this requirement by manually visiting a specific session restart web link during the login process. This action clears the internal markers that track the required security steps, allowing the user to log in with only a password and gain access without completing the mandated 2FA setup.
A flaw was found in the User-Managed Access (UMA) implementation of Keycloak. The issue occurs in the authorization token endpoint when processing permission tickets. If two different users own resources with the same name, the system incorrectly merges the permissions from both resources when one user requests an authorization token. This allows an attacker to gain access scopes on a victim's resource that were never intended to be shared.