Threat database

A flaw was found in the foreman_remote_execution plugin's template invocations controller. The show_template_invocation_by_host action resolves the job invocation by ID without evaluating the caller's view_job_invocations permission filter against the record. An authenticated user whose job invocation visibility is restricted by a permission filter can enumerate job invocation IDs and read the live output, rendered script, and input values for other users' job invocations within their own organizations.

Valkey is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets. You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing set intersection, union and difference; or getting the member with highest ranking in a sorted set. In order to achieve its outstanding performance, Valkey works with an in-memory dataset. Depending on your use case, you can persist it either by dumping the dataset to disk every once in a while, or by appending each command to a log. Valkey also supports trivial-to-setup master-slave replication, with very fast non-blocking first synchronization, auto-reconnection on net split and so forth. Other features include Transactions, Pub/Sub, Lua scripting, Keys with a limited time-to-live, and configuration settings to make Valkey behave like a cache. You can use Valkey from most programming languages also. Security Fix(es): * redis: Redis: Remote Code Execution via specially crafted RESTORE payload (CVE-2026-66373) * valkey: Valkey: Remote code execution via use-after-free in stream deserialization (CVE-2026-63639) * valkey: Valkey: Remote code execution via TLS pending-data processing use-after-free (CVE-2026-56684) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

CVE-2026-92925 is a high-severity vulnerability in Redis as packaged in Red Hat Enterprise Linux 9. It involves an out-of-bounds read in the cluster bus packet parser due to improper validation of string-carrying extensions lacking null-termination. This flaw allows a remote attacker to craft malicious packets that can cause sensitive information disclosure or a denial of service. Red Hat has released an important security update for the redis:7 module in RHEL 9.4 to address this issue.

A flaw was found in the foreman_ansible plugin's Ansible inventory API. The controller builds its host query using an unscoped Host.where call that does not enforce the search filter associated with the caller's view_hosts permission. An authenticated user whose host visibility is restricted by a permission filter can supply arbitrary host IDs within their organization and receive the full Ansible inventory for those hosts, including parameter values marked as hidden.

A flaw was found in the foreman_ansible plugin's Ansible override values API. The destroy action resolves the target LookupValue record by ID without verifying it belongs to an AnsibleVariable the caller is authorized to edit. An authenticated user with the edit_ansible_variables permission can delete any LookupValue by ID, including override values for Ansible variables outside their permission filter scope and override values belonging to Puppet smart class parameters.

Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the container images for Red Hat OpenShift Container Platform 4.18.55. See the following advisory for the RPM packages for this release: https://access.redhat.com/errata/RHSA-2026:66385 Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes: https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/release_notes/ Security Fix(es): * bind: BIND: Denial of Service via maliciously crafted DNSSEC-validated zone (CVE-2026-1519) * samba: group policy certificate enrollment uses http:// without validation (CVE-2026-3012) * bind: BIND 9 server memory exhaustion during GSS-API TKEY negotiation (CVE-2026-3039) * bind: BIND: Denial of Service via specially crafted DNS messages (CVE-2026-5946) * dracut: dracut: Root code execution via DHCP options command injection (CVE-2026-6893) * bind9: bind: Potential wildcard CNAME RPZ policy bypass (CVE-2026-11331) * sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data (CVE-2026-11822) * sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5 (CVE-2026-11824) * bind: bind9: DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field (CVE-2026-13321) * dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die() (CVE-2026-15816) * sg3_utils: sg3_utils: arbitrary command execution via udev property injection in sg_inq --export (CVE-2026-16313) * golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821) * kernel: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CVE-2026-43112) * samba: vfs_worm does not block directory modification (CVE-2026-2340) * gnutls: GnuTLS: Policy bypass due to case-sensitive nameConstraints comparison (CVE-2026-3833) * bind: bind9: Incorrect acceptance of NSEC3 records (CVE-2026-10723) * libarchive: Double-Free Vulnerability in RAR5 Decompression Logic via dangling filtered_buf pointer in init_unpack() (CVE-2026-14164) * systemd: systemd: Arbitrary code execution or Denial of Service via spurious IPC API call data (CVE-2026-29111) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. All OpenShift Container Platform 4.18 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html-single/updating_clusters/index#updating-cluster-cli.

A flaw was found in flatpak-builder where Git hooks are not disabled when applying patch sources with use-git-am: true. An attacker who can provide a malicious source containing a Git post-applypatch hook can cause the hook to execute on the host during the build process, resulting in arbitrary code execution with the privileges of the user running flatpak-builder.

Red Hat has issued a security advisory for multiple vulnerabilities in the Linux kernel packages of Red Hat Enterprise Linux 10. These include out-of-bounds reads, buffer overflows, use-after-free conditions, denial of service, and privilege escalation issues. The update also contains bug fixes and enhancements. A system reboot is required after applying the update. Red Hat recommends prompt installation to mitigate potential risks.

CVE-2026-85469 is a high severity vulnerability in Red Hat Quay 3 involving the quay-builder-qemu component. The flaw arises from reliance on the upstream Noelware/docker-manifest-action pinned to a mutable branch in the release workflow. This allows a remote attacker to inject arbitrary code, potentially leading to exfiltration of sensitive registry credentials or publication of malicious container images. The workflow also exposes the default GitHub token, which increases the risk and impact of the compromise.

A moderate severity vulnerability (CVE-2026-15711) exists in the libsoup library used by GNOME, where an oversized control frame in the WebSocket implementation can cause a remote denial of service. Red Hat has issued a security advisory and released updates for Red Hat Enterprise Linux 8 to address this issue.

Two security vulnerabilities have been identified in the libsoup HTTP client and server library for GNOME, affecting Red Hat Enterprise Linux 9. These include a remote denial of service caused by unbounded decompression in the WebSocket permessage-deflate extension (CVE-2026-15709) and a remote denial of service via an oversized control frame protocol violation in WebSocket connections (CVE-2026-15711). Red Hat has released security updates addressing these issues with a moderate severity rating.

CVE-2026-42784 is a vulnerability in the sequoia-openpgp library used by Red Hat Ansible Automation Platform 2.6 for RHEL 9. The flaw involves improper verification of cryptographic signatures due to incorrect inference of key flags when a key flags subpacket is missing. This allows an attacker to bypass back-signature checks and forge signatures by illegitimately binding arbitrary subkeys to their own certificate, compromising cryptographic integrity.

CVE-2026-19607 is a medium severity vulnerability in the Red Hat build of Keycloak 26.4 that affects the first-broker-login flow. An attacker can register a matching username on an external identity provider, causing a username collision in Keycloak and locking out the legitimate user from their account. Red Hat has released updated Keycloak images (26.4.16 and 26.6.7) that address this issue among other security fixes.

Red Hat has issued a security advisory for its Hardened Images RPMs, specifically updating multiple python3.13 packages to address several vulnerabilities including CVE-2026-82049. The update provides security fixes for these RPMs on aarch64 and x86_64 architectures. No explicit patch version ranges are provided in the advisory. The severity of the vulnerabilities addressed is high.

Red Hat has issued a security update for the Red Hat build of Keycloak 26.6.7 images used in OpenShift Container Platform. The update addresses multiple security vulnerabilities including information disclosure, privilege escalation, authorization bypasses, remote code execution, and denial of service. Users are advised to apply the update to mitigate these risks.

Keycloak is an open-source identity and access management solution. A vulnerability was discovered where a user with the impersonation role can impersonate a realm administrator. This allows the attacker to gain full administrative control over the realm, including the ability to manage users, clients, and roles.