Threat database

Two security vulnerabilities were identified in the lrzsz package used in Red Hat Enterprise Linux 10. These include an arbitrary file overwrite via absolute path traversal in restricted mode (CVE-2026-105840) and arbitrary command execution via crafted file names in pipe mode (CVE-2026-105841). Red Hat has issued an important security advisory with updates that fix these issues. The vulnerabilities affect multiple architectures of Red Hat Enterprise Linux 10 and its extended update support versions. The advisory also includes bug fixes and enhancements unrelated to the security issues. No CVSS score is provided, but the impact is considered high. Users are advised to apply the provided updates to remediate these vulnerabilities.

Red Hat has issued a security advisory for Red Hat Hardened Images RPMs, specifically updating golang1.27 packages to version 1.27.3-1.hum1. The update addresses multiple CVEs including CVE-2026-94440, CVE-2026-97030, and CVE-2026-111943. The advisory provides updated RPM packages for several architectures and includes bug fixes and enhancements. No explicit details on the vulnerabilities or their exploitation are provided in the advisory.

CVE-2026-84268 is a heap-based buffer overflow vulnerability in the GNOME gvfs component, specifically in the SFTP protocol handling function read_reply(). This vulnerability has a high severity with a CVSS score of 8.8, indicating it can lead to high impact on confidentiality, integrity, and availability. The issue affects Red Hat Enterprise Linux 8 and related distributions. A security update addressing this vulnerability is available from Red Hat.

The Azure Key Vault KMS provider in Kroxylicious accepts an untrusted vaultName from wire-deserialized EDEK bytes without format validation, enabling SSRF that exfiltrates the proxy's Azure bearer token to an attacker-controlled host. Token replay against the real Key Vault defeats the entire record-encryption trust model.

Cruise Control's Jetty ConstraintSecurityHandler registers security constraints on exact path specs without a catch-all wildcard constraint and without calling setDenyUncoveredHttpMethods(true). The servlet routes requests using Path.of(pathInfo).getFileName(), which strips all leading segments and trailing slashes. Requests like POST /kafkacruisecontrol/x/rebalance bypass authentication entirely but still dispatch to admin endpoints. All 15 admin endpoints become reachable without authentication. In AMQ Streams, the Strimzi operator's NetworkPolicy restricts Cruise Control port 9090 to operator pods only, reducing effective severity to Important.

A Kubernetes tenant with create permission on Console custom resources can set spec.containers.api.spec.image to an arbitrary container image. The operator deploys this image into a pod whose ServiceAccount is bound via ClusterRoleBinding to a ClusterRole granting cluster-wide get/list/watch on all Strimzi CRDs (including KafkaUsers), patch on Kafkas/KafkaRebalances, and cluster-monitoring-view. The attacker's code reads the projected SA token and gains cross-tenant Strimzi control-plane read+write access.

The StreamsHub Console operator acts as a confused deputy: a Kubernetes tenant with permission to create a Console custom resource can set spec.kafkaClusters[].credentials.kafkaUser.namespace to any namespace. The operator, running with cluster-wide Secrets RBAC, reads the victim-namespace KafkaUser Secret (SASL credentials or TLS private keys) and writes the plaintext material into a Secret in the attacker's namespace. No same-namespace check or allowlist exists anywhere in the code path.

A flaw was found in cockpit-machines. When saving Virtual Network Computing (VNC) console settings, the configured password is passed directly as a command-line argument to an underlying system utility. A local unprivileged attacker on a host that allows cross-user process inspection could read the exposed password from the process list while another user modifies settings. This credential disclosure can allow unauthorized access to the guest virtual machine's graphical console.

A flaw was found in cockpit-machines. Red Hat Subscription Management (RHSM) authentication tokens are passed as command-line arguments to background helper processes during image retrieval operations. A local, unprivileged attacker on a system permitting cross-user process inspection can view these arguments while the process is active. This flaw can lead to information disclosure, potentially allowing unauthorized access to RHSM resources within the token's validity period.

Multiple security issues affecting the shadowsocks-rust package version 1.25.0-2.1 on openSUSE Tumbleweed and Red Hat Hardened Images have been addressed. These issues relate to a CWE-125 vulnerability tracked under CVE-2026-93599. Red Hat has released updated RPM packages as part of advisory RHSA-2026:70694 to fix these issues. No known exploits are reported in the wild. The severity is assessed as medium.

Releases of Red Hat OpenShift Builds 1.6.5

A flaw was found in Ghostscript as shipped with Red Hat Enterprise Linux 8. The correction for CVE-2019-14869 was omitted during the rebase from version 9.25 to 9.27, leaving privileged .forceput operations in the .charkeys procedure insufficiently protected. Processing a specially crafted PostScript file may allow an attacker to bypass -dSAFER restrictions and access files outside the permitted paths or execute commands with the permissions of the Ghostscript process.

CVE-2026-84375 is a medium severity vulnerability affecting Red Hat Hardened Images RPMs, specifically impacting OpenShift Virtualization v4.12 images and related packages including grafana13.2. The issue relates to CWE-835 and has no known exploits in the wild. Red Hat has issued an update to the grafana13.2 package to version 13.2.0-0.1.4.hum1 to address this vulnerability.

A flaw was found in GIMP. Opening a crafted XCF that selects a path and then fails to load that path can cause a use-after-free in the main process, leading to a crash and potentially arbitrary code execution.

A flaw was found in GIMP. The XCF loader can leave a dangling pointer in the linked-channels list when a linked channel is later destroyed via a selection property. Opening a crafted XCF file can cause a use-after-free in the main GIMP process, leading to a crash and potentially arbitrary code execution.

A flaw was found in GIMP. The PSD thumbnail resource loader performs a BGR-to-RGB channel swap with a fixed 3-byte stride and does not verify that the JPEG thumbnail is RGB. A crafted grayscale PSD thumbnail can cause a heap out-of-bounds read and write in the plug-in process, leading to a crash and potentially arbitrary code execution when the victim browses or opens the file.

A medium severity vulnerability (CVE-2026-58374) exists in hostapd, specifically in wpa_supplicant's AP-mode Wi-Fi 7 Multi-Link Operation association request processing. The flaw is due to a missing bounds check that allows an unauthenticated attacker to send a crafted management frame causing an out-of-bounds write, leading to denial of service. The issue affects Red Hat Enterprise Linux 10 and related packages. Red Hat has released a security update to address this vulnerability. There are no known exploits in the wild.

A flaw was found in GIMP. Opening a crafted XCF with a malformed text-layer parasite can cause a heap out-of-bounds read, disclosing adjacent heap data into layer text and causing denial of service.