This release of the Red Hat OpenShift distributed tracing platform (Tempo) provides new features, security improvements, and bug fixes.
Breaking changes:
* High availability defaults for TempoStack deployment sizes: Before this update, only the ingester component was scaled for high availability while all other components defaulted to a single replica, leaving the overall ingest and query paths vulnerable to single points of failure. With this update, when you set a non-demo deployment size (1x.pico, 1x.extra-small, 1x.small, or 1x.medium) in the spec.size field of the TempoStack custom resource, the Operator defaults each component to at least 2 replicas, and scales throughput-bound components at larger sizes. Watch your resource consumption, as running more replicas per component increases the total CPU and memory consumed by the deployment. Explicit per-component replicas values always take precedence. For more information, see https://redhat.atlassian.net/browse/TRACING-6169.
Deprecations:
* Jaeger Query is deprecated: The Jaeger Query component in the Tempo Operator is deprecated and will be removed in a future release. The Tempo Operator emits a warning when the Jaeger Query feature is enabled. To visualize traces, use the distributed tracing UI plugin as the recommended replacement for the Jaeger UI. For more information, see https://redhat.atlassian.net/browse/TRACING-6509.
Technology Preview features:
* None
Enhancements:
* High availability for TempoStack deployments: You can use the spec.replicationZones field in the TempoStack custom resource to define zone-aware replication. By using this feature, you can deploy TempoStack instances with higher resilience by spreading replicas across topology zones and ensuring minimum pod availability during disruptions. For more information, see https://redhat.atlassian.net/browse/TRACING-6168.
* Service name and namespace auto-complete with query RBAC enabled: When you enable query Role-Based Access Control (RBAC) in a multi-tenant TempoStack deployment, the Tempo gateway supports auto-complete for non-sensitive attributes such as service name and namespace. Before this update, all tag value API endpoints were blocked when query RBAC was enabled, which prevented the Service Name drop-down filter in the distributed tracing console plugin from displaying results. With this update, the gateway allows the search tags API for non-sensitive attributes while still protecting sensitive span data. As a result, the Service Name filter and other non-sensitive attribute drop-down list items work correctly in multi-tenant RBAC mode. For more information, see https://redhat.atlassian.net/browse/TRACING-6485.
Bug fixes:
* TempoStack and TempoMonolithic status conditions accurately reflect pod readiness: Before this update, the status field of the TempoStack or TempoMonolithic custom resource might show Ready=false even when all pods were ready, or vice versa. With this update, the Operator watches Deployment and StatefulSet status changes, and the status conditions accurately reflect actual pod readiness. Deleted pods are removed from the pod status map. As a result, the status field reliably indicates the current state of the deployment. For more information, see https://redhat.atlassian.net/browse/TRACING-6453.
* Gateway redirect URL respects the custom ingress hostname: Before this update, setting a custom hostname with the spec.template.gateway.ingress.host field in the TempoStack custom resource did not update the OpenShift OAuth redirect URL, so authentication redirects pointed to the wrong URL. With this update, the Operator uses the custom hostname when generating the redirect URL, and gateway authentication works correctly with custom ingress hostnames. For more information, see https://redhat.atlassian.net/browse/TRACING-6435.
* Gateway starts on clusters that use external OIDC authentication: Before this update, on clusters using external OpenID Connect (OIDC) authentication instead of the built-in OpenShift OAuth server, the Tempo gateway container failed to start because it could not auto-discover the OpenShift OAuth endpoints. With this update, the gateway handles external authentication and starts correctly on such clusters. For more information, see https://redhat.atlassian.net/browse/TRACING-6646.
Known issues:
* None
CVE-2026-74859 is a path traversal vulnerability in the GNOME Shell theme installer component of gnome-tweaks on Red Hat Enterprise Linux 8. The flaw allows crafted theme archives to write files outside the intended ~/.themes directory by exploiting improper validation of archive member paths. Exploitation requires a user to deliberately install a malicious theme, limiting the attack surface. The vulnerability has a CVSS score of 6.8 and is rated moderate in severity by Red Hat.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: can: bcm: add locking for bcm_op runtime updates (CVE-2025-38004)
* kernel: ipv6: add NULL checks for idev in SRv6 paths (CVE-2026-23442)
* kernel: udp: Fix wildcard bind conflict check when using hash2 (CVE-2026-31503)
* kernel: ipv6: prevent possible UaF in addrconf_permanent_addr() (CVE-2026-43339)
* kernel: tcp: call sk_data_ready() after listener migration (CVE-2026-46015)
* kernel: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (CVE-2026-46266)
* kernel: flow_dissector: do not dissect PPPoE PFC frames (CVE-2026-46306)
* kernel: io_uring/poll: fix signed comparison in io_poll_get_ownership() (CVE-2026-52933)
* kernel: ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (CVE-2026-53075)
* kernel: KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CVE-2026-53277)
* kernel: ipv6: sit: reload inner IPv6 header after GSO offloads (CVE-2026-53228)
* kernel: net: add pskb_may_pull() to skb_gro_receive_list() (CVE-2026-53235)
* kernel: net: guard timestamp cmsgs to real error queue skbs (CVE-2026-53223)
* kernel: ipv6: mcast: Fix use-after-free when processing MLD queries (CVE-2026-53275)
* kernel: ipv6: anycast: insert aca into global hash under idev->lock (CVE-2026-53259)
* kernel: ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CVE-2026-64002)
* kernel: vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (CVE-2026-63993)
* kernel: fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (CVE-2026-64265)
* kernel: nvmet-auth: validate reply message payload bounds against transfer length (CVE-2026-64319)
* kernel: KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CVE-2026-64287)
* kernel: rhashtable: clear stale iter->p on table restart (CVE-2026-64563)
* kernel: smb: client: fix double-free in SMB2_close() replay (CVE-2026-64597)
Bug Fix(es) and Enhancement(s):
* Customer needs "netfilter: nfnetlink_queue: optimize verdict lookup with hash table" patch [RHEL 10.2] (JIRA:RHEL-132852)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
A high severity security advisory from Red Hat addresses vulnerabilities in Red Hat Hardened Images RPMs, specifically affecting the jaeger package version 2.20.0-0.6.hum1 for aarch64 and x86_64 architectures. The advisory relates to CVE-2026-67213 and includes fixes that should be applied to mitigate the vulnerabilities. The update is available and covers components of the Red Hat Ansible Automation Platform.
Red Hat OpenShift Data Foundation 4.22.3 includes a security update addressing multiple issues including CVE-2026-16221 and other vulnerabilities. The update fixes bugs related to database dump capturing, upgrade processes, application validation, resource status reporting, and operator failures. The advisory indicates a high severity level and confirms that a patch is available for affected versions.
CVE-2026-76561 is a high-severity vulnerability in Dogtag PKI, part of FreeIPA's certificate authority component in Red Hat Enterprise Linux 10. The certificate profile import functionality does not fully validate uploaded profile content beyond the profile ID, allowing an authenticated user with CA Administrator privileges to execute arbitrary commands via the ExternalProcessConstraint mechanism. This results in code execution as the pkiuser account. A security update is available to address this issue.
A high severity vulnerability (CVE-2026-69248) exists in the python3.14-cryptography package for Red Hat Enterprise Linux 9. The issue allows the verifier to accept wildcard DNS names that can escape from permittedSubtrees. Red Hat has released patches to address this vulnerability in updated packages.
Multiple critical security vulnerabilities have been identified and fixed in the 389 Directory Server (389-ds-base) package for Red Hat Enterprise Linux 9.4. These include a heap buffer overflow, a pre-authentication NULL pointer dereference, privilege escalation via SASL PLAIN authentication, and bypass of bind-rule checks by anonymous LDAP clients. The update addresses these issues and includes additional bug fixes and enhancements.
A heap-based buffer overflow vulnerability exists in the HDR file parsing component of GIMP's use of the GEGL (Generic Graphics Library) framework. This flaw could allow arbitrary code execution. The issue is tracked as CVE-2026-2050 and affects certain versions of GEGL used in Red Hat Enterprise Linux 8. A security update addressing this vulnerability is available from Red Hat.
The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.
Security Fix(es):
* kernel: crypto: pcrypt - Fix handling of MAY_BACKLOG requests (CVE-2026-43493)
* kernel: netfilter: conntrack: remove sprintf usage (CVE-2026-53002)
* kernel: netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CVE-2026-64007)
* kernel: rhashtable: clear stale iter->p on table restart (CVE-2026-64563)
* kernel: smb: client: validate DFS referral PathConsumed (CVE-2026-68343)
* kernel: nvmet-rdma: handle inline data with a nonzero offset (CVE-2026-72129)
* kernel: net: bridge: stop fast-leave after deleting a port group (CVE-2026-74480)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
CVE-2026-86469 is a local vulnerability in GLib2 used by Red Hat Enterprise Linux 10. It occurs when g_file_replace() is called with G_FILE_CREATE_REPLACE_DESTINATION and the creation of a temporary file fails, causing the destination file to be unlinked and recreated without exclusive creation or symlink protection. This allows a local attacker with write access to the destination directory to exploit a race condition and redirect writes to an unintended file. Exploitation requires specific conditions including local access, write permission to the directory, and winning a race condition. The vulnerability has a medium severity with a CVSS score of 5.3. The vendor advises avoiding use of g_file_replace() with G_FILE_CREATE_REPLACE_DESTINATION on directories writable by less-privileged users as mitigation.
CVE-2026-19843 is an OS command injection vulnerability in the Cockpit 389 Console LDAP editor of Red Hat Directory Server. The issue arises because the LDAP editor embeds an LDAP entry's distinguished name (DN) into a shell command without proper escaping. An LDAP user with delegated privileges can craft a malicious DN containing shell metacharacters, which executes with root privileges when viewed by a Cockpit administrator.
CVE-2026-18922 is a critical improper authentication vulnerability in 389 Directory Server (Red Hat Directory Server 11.5 E4S for RHEL 8). It allows an attacker to escalate privileges to Directory Manager by exploiting stale identity data carried in a Cyrus SASL auxiliary property during SASL PLAIN authentication. An attacker can send a failed SASL PLAIN bind as Directory Manager, then complete a successful SASL ANONYMOUS or low-privileged bind on the same connection, causing the server to grant Directory Manager authority without valid credentials. A security update addressing this issue is available from Red Hat.