A privilege escalation flaw was found in the scan_mysql actor of leapp-upgrade-el9toel10 (provided by leapp-repository). During RHEL 9 to RHEL 10 upgrades, the actor runs:
mysqld --validate-config --log-error-verbosity=2 directly as root in the Leapp actor context, bypassing the packaged MySQL systemd unit that normally starts the daemon as User=mysql.
A process compromised as the mysql OS identity can write a version-2 persisted configuration (mysqld-auto.cnf) and a malicious shared object into /var/lib/mysql (a directory owned by mysql). That persisted map can set plugin_dir to /var/lib/mysql and early_plugin_load (or related loader options such as plugin_load / plugin_load_add) so MySQL loads the attacker-controlled object during configuration validation. Plugin loading can reach dlopen() before MySQL’s runtime-user check and before plugin-symbol validation.
When an administrator subsequently runs the documented Leapp preupgrade or upgrade workflow, attacker-controlled code can execute as UID 0 with a full capability set in an unconfined SELinux domain (unconfined_t). The attack does not require write access to the default system plugin path under /usr; redirecting plugin_dir via mysql-owned persisted state is sufficient. Ordinary SQL privileges alone (including highly privileged SQL accounts) are not a sufficient startpoint — OS-level execution as the mysql service identity is required, plus later administrator invocation of Leapp.
A flaw was found in hawtio-operator. When a custom Route TLS secret is configured and the operator runs at debug log level 1 or higher, the entire Route object — including the TLS private key in PEM format — is serialized to JSON and written to the operator's standard output. Operator logs are typically forwarded to centralized logging systems and readable by anyone with pods/log access in the openshift-operators namespace. Debug level 1 is a low threshold commonly enabled during troubleshooting.
A flaw was found in hawtio-operator. The operator holds routes/custom-host:create permission cluster-wide and writes the tenant-supplied spec.routeHostName value from the Hawtio custom resource directly into the Route spec without validation or authorization checks. A namespace edit user, who normally cannot set custom Route hostnames, can use the operator as a confused deputy to claim arbitrary externally-routable hostnames, enabling subdomain takeover and, in combination with the auto-grant OAuthClient, OAuth redirect hijack.
Red Hat has issued an important security advisory for the Linux kernel packages in Red Hat Enterprise Linux 8, addressing multiple vulnerabilities including integer overflow, use-after-free, buffer overflow, and other flaws across various kernel components such as EDAC/bluefield, Wi-Fi drivers, KVM, net, blk-cgroup, scsi, and dm-verity. These vulnerabilities could lead to system crashes or other security impacts. The update requires a system reboot to take effect.
The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.
Security Fix(es):
* rsync: rsync 2.3.3 < 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink (CVE-2026-70460)
* rsync: rsync: TLS Certificate Validation Bypass allows interception of encrypted sessions (CVE-2026-70454)
* rsync: rsync: Arbitrary file deletion via malicious file list (CVE-2026-53789)
* rsync: rsync < 3.5.0 Command Injection via Multiple Code Paths (CVE-2026-53790)
* rsync: rsync: Memory corruption via crafted file entries (CVE-2026-70458)
* rsync: rsync: Denial of Service via handshake stall (CVE-2026-70464)
* rsync: rsync: Local Privilege Escalation via Symlink Following (CVE-2026-53803)
* rsync: rsync: Unauthorized File Access via Symlink Module Root (CVE-2026-53784)
* rsync: rsync: Authorization bypass via `auth users` directive parsing (CVE-2026-70463)
* rsync: rsync 3.1.0 < 3.5.0 Access Control Bypass via DNS Resolution Failure (CVE-2026-70452)
* rsync: rsync < 3.5.0 Daemon IP Spoofing via PROXY Protocol Header (CVE-2026-53791)
* rsync: rsync: Arbitrary file write via --temp-dir or --link-dest options (CVE-2026-53795)
* rsync: rsync: Heap Out-of-Bounds Write via crafted argument list (CVE-2026-70456)
* rsync: rsync < 3.5.0 Path Confinement Bypass via /./ Boundary Marker in Chroot Mode (CVE-2026-53793)
* rsync: rsync: Denial of Service via Algorithmic Complexity (CVE-2026-70453)
* rsync: rsync: Denial of Service via Zstandard compression thread exhaustion (CVE-2026-70455)
* rsync: rsync: Memory corruption via out-of-bounds write in size parsing (CVE-2026-70457)
* rsync: rsync: Information disclosure and denial of service via crafted files-from entry (CVE-2026-70461)
* rsync: rsync: Arbitrary File Read via Symlink Following (CVE-2026-53802)
* rsync: rsync: Arbitrary file write via path traversal in --relative mode (CVE-2026-53785)
* rsync: rsync: Directory escape via TOCTOU race condition in rrsync (CVE-2026-53783)
Bug Fix(es) and Enhancement(s):
* Rebase rsync to version 3.5.0 in RHEL10 (JIRA:RHEL-246094)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.
Security Fix(es):
* golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security key bypass due to missing user presence check (CVE-2026-39831)
* golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs (CVE-2026-46597)
* golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters (CVE-2026-39829)
* golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses (CVE-2026-39830)
* golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions (CVE-2026-39832)
* golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey (CVE-2026-42508)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
CVE-2026-90996 is an integer underflow vulnerability in the sssd component of Red Hat Enterprise Linux 10. A local unprivileged user can send a specially crafted request with a zero-length body to the Network Security Services (NSS) responder, potentially causing it to become unstable or terminate. This results in a denial-of-service condition affecting system availability. The vulnerability has a medium severity rating with a CVSS score of 4. No specific affected versions or patch information are provided in the available data.
A flaw was found in SSSD (System Security Services Daemon). A local attacker with privileges to connect to the PAM (Pluggable Authentication Modules) responder socket can send a specially crafted protocol request. If the `pam_app_services` configuration is enabled and the service item is omitted from the request, a NULL pointer dereference can occur. This vulnerability leads to a denial of service, causing the PAM responder to crash and disrupt authentication services.
CVE-2026-90994 is a medium severity vulnerability in Red Hat Enterprise Linux 10's sssd PAM responder. A local client with access to the PAM responder's UNIX socket can trigger an out-of-bounds read by sending an empty or truncated PAM request body when negotiating protocol v1. This may cause the PAM responder to terminate or restart, resulting in a local denial of service.
A flaw was found in the sssd NSS responder. This input validation vulnerability allows a local attacker, by sending specially crafted service lookup requests to the NSS responder's UNIX socket, to cause an out-of-bounds read. This out-of-bounds read may lead to a denial of service (DoS) by crashing the NSS responder process. While unprivileged local clients can typically reach the socket, there is no evidence of privilege escalation or reliable data disclosure.
A vulnerability in GIMP's Lighting Effects filter in Red Hat Enterprise Linux 8 allows an out-of-bounds write when processing a crafted lighting preset file. This flaw can lead to memory corruption, potentially causing a crash or enabling arbitrary code execution if a user opens a malicious preset file. Red Hat has issued an important security update addressing this issue in GIMP packages for Red Hat Enterprise Linux 9. The vulnerability has a CVSS score of 7.8, indicating high severity.
CVE-2026-90949 is a high-severity vulnerability in GIMP's PSP file loader on Red Hat Enterprise Linux 6. It involves a heap-based buffer overflow triggered by a mismatch between allocated buffer size and decompressed data when processing compressed selection channels. A remote attacker can exploit this by crafting a malicious PSP file that, when opened in GIMP, may cause a crash or enable arbitrary code execution.
A heap-based buffer overflow vulnerability exists in GIMP's ICO file loader due to an integer overflow during buffer size calculation when processing ICO files with embedded PNG images. This flaw could allow a remote attacker to execute arbitrary code or cause a crash by crafting a malicious ICO file and convincing a user to open it. Red Hat has issued a security update for GIMP in Red Hat Enterprise Linux 9 to address this issue.
This Red Hat security advisory addresses multiple vulnerabilities and bug fixes in the Linux kernel packages for Red Hat Enterprise Linux 8 and 9. It includes a denial of service vulnerability in the qla2xxx SCSI driver (CVE-2025-68745) and several other security issues affecting Bluetooth, DRM, SCTP, Wi-Fi, and other kernel subsystems. The update is rated as important by Red Hat and requires a system reboot to apply. The advisory also contains non-security bug fixes and enhancements.
GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-base packages contain a collection of well-maintained base plug-ins.
Security Fix(es):
* gstreamer1-plugins-base: gstreamer: NULL/invalid-pointer dereference in gst_rtsp_message_parse_auth_credentials() when parsing a crafted Digest Authorization/WWW-Authenticate header (CVE-2026-85150)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Multiple security vulnerabilities have been identified and addressed in Apache Tomcat as packaged in Red Hat JBoss Web Server and Red Hat Enterprise Linux. These include improper input validation, authentication bypasses, HTTP/2 header validation issues, information disclosure, improper authorization, case sensitivity handling flaws, and security constraint bypasses. The update to Red Hat JBoss Web Server 6.0.3 includes fixes for these issues. The vulnerabilities affect various versions of Tomcat and related components within Red Hat products. A security update is available to remediate these issues.
This Red Hat security advisory addresses multiple vulnerabilities and bug fixes in the Linux kernel, including three specific security fixes: a signed comparison issue in io_uring polling (CVE-2026-52933), a heap overflow in USB serial driver io_ti (CVE-2026-53196), and a double-free in SMB client query directory replay (CVE-2026-64387). The advisory also includes various bug fixes and enhancements. A patch is available to remediate these issues. The vulnerabilities are rated as high severity, but no known exploits are reported in the wild at this time.
A flaw was found in `multipathd`. A local attacker with access to the `multipathd` UNIX control socket can exploit this vulnerability by sending valid commands and then ceasing to read replies. This action can cause the `multipathd` listener thread to block, leading to a Denial of Service (DoS) where legitimate Inter-Process Communication (IPC) operations may hang or time out. This issue does not result in privilege escalation, arbitrary code execution, or impact data confidentiality or integrity.