Red Hat has issued a security advisory for Red Hat Hardened Images RPMs, specifically updating multiple ruby3.3 packages to address security vulnerabilities identified by CVE-2026-80212 and CVE-2026-80213. The update affects various architectures including aarch64 and x86_64. The advisory provides updated package versions to mitigate these vulnerabilities.
This update includes the following RPMs:
tempo3.0:
* tempo3.0-3.0.3-0.2.hum1 (aarch64, x86_64)
* tempo3.0-3.0.3-0.2.hum1.src (src)
Security Fix(es):
tempo3.0:
* CVE-2026-81092
Red Hat has issued a security advisory for Red Hat Hardened Images RPMs, including multiple erlang27 packages, addressing several vulnerabilities. The update provides bug fixes and enhancements for these packages across aarch64 and x86_64 architectures. The advisory references multiple CVEs related to these packages and indicates a high severity level. A patch is available to address these issues.
A flaw was found in the first-broker-login flow of the Keycloak identity management service. When a user links a social identity provider account to their local account, the verification proof generated is not strictly bound to the specific upstream identity being verified. This allows an attacker with a different account on the same social provider to intercept the process and link their own account to the victim's local profile, gaining unauthorized access.
A vulnerability in dracut allows an attacker controlling a rogue DHCP server on an adjacent network to inject shell commands that execute as root during boot failure handling. This occurs because the die() error-handling function writes unescaped messages derived from the DHCP ROOT_PATH option into a shell script sourced by dracut's emergency hook. The flaw affects multiple versions of dracut in SUSE and Ubuntu distributions, as well as Red Hat Enterprise Linux 9. A security update is available from Red Hat and other vendors to address this issue.
A flaw was found in Ansible Automation Platform's automation-controller (AWX).
The Bulk Job Launch API (POST /api/v2/bulk/job_launch/) authorizes the
requested instance_groups with only a read-level permission check, whereas the
standard single-job launch path requires use-level permission on the same
field. A principal that holds read (but not use) permission on an instance
group -- for example the built-in read-only System Auditor role -- together
with execute permission on a job template can launch bulk jobs onto instance
groups they are not authorized to use, bypassing execution-placement
isolation.
Red Hat OpenShift Dev Spaces provides a cloud developer workspace server and a browser-based IDE built for teams and organizations. Dev Spaces runs in OpenShift and is well-suited for container-based development.
The 3.30 release is based on Eclipse Che 7.121 and uses the DevWorkspace engine to provide support for workspaces based on devfile v2.1 and v2.2.
Users still using the v1 standard should migrate as soon as possible.
https://devfile.io/docs/2.2.0/migrating-to-devfile-v2
Dev Spaces supports OpenShift EUS releases v4.16 and higher. Users are expected to update to supported OpenShift releases in order to continue to get Dev Spaces updates.
https://access.redhat.com/support/policy/updates/openshift#crw
CVE-2026-84218 is a vulnerability in Red Hat AMQ Broker 7 related to Jolokia's JSR-160 proxy functionality. It involves insufficient validation of client-controlled JMX service URLs, allowing bypass of an existing denylist. This flaw permits the use of alternative valid JMX service URL forms, such as ldaps:// schemes or LDAP URLs with non-empty JMX host components, which can lead to server-side request forgery (SSRF), credential forwarding, and potentially remote code execution.
A flaw was found in openshift/oauth-server. The OAuth login and error page endpoints pass the unauthenticated Accept-Language header to golang.org/x/text/language.ParseAcceptLanguage() without input validation. A bypass of the CVE-2022-32149 mitigation exists: the upstream guard counts only '-' characters but the internal BCP 47 scanner aliases '_' to '-' after the guard check. An unauthenticated attacker can send a crafted Accept-Language header using '_' separators to trigger quadratic-time parsing, consuming excessive CPU and denying authentication to all cluster users.
A flaw was found in pulpcore's content serving application. Files uploaded to Pulp file-type repositories are served with their original content type (e.g., text/html for .html files, image/svg+xml for .svg files) and without a Content-Disposition: attachment header when using local filesystem storage. An authenticated user or attacker with content upload permissions can upload a specially crafted HTML or SVG file containing JavaScript, which executes in the browser of any user who visits the file URL, resulting in stored cross-site scripting (XSS) in the context of the host application.
A flaw was found in rpm. A local attacker could supply a specially crafted `.gem` filename containing RPM macro syntax. When a user or automated workflow invokes `rpmuncompress -x` on this file, the macro expansion occurs during command construction. This allows the attacker to execute arbitrary commands with the privileges of the invoking account, leading to a compromise of confidentiality, integrity, and availability.
An unauthenticated client can query the Security Domain hosts inventory via GET /ca/rest/securityDomain/hosts and receive a structured response enumerating internal PKI/CA hosts and roles (security domain topology and participating subsystems), without requiring a principal, client certificate, or session.
An Apache-proxied Dogtag CA REST endpoint exposed by IdM (POST /ca/rest/certrequests) returns HTTP 500 with internal Java stack traces for unauthenticated malformed requests. The same unauthenticated error path emits large multi-line stack traces into the CA debug log, creating a log-amplification resource exhaustion vector (disk growth and I/O contention) without requiring authentication.
This Red Hat Security Advisory addresses multiple vulnerabilities and bugs in the Linux kernel packages for Red Hat Enterprise Linux 10 and related products. The update includes fixes for several security issues such as use-after-free, out-of-bounds reads, heap overflows, race conditions, and arbitrary code execution vulnerabilities. The advisory also contains bug fixes and enhancements for various kernel subsystems. Red Hat rates the security impact as Important and recommends applying the update promptly, requiring a system reboot for changes to take effect.
Multiple remote code execution vulnerabilities have been identified in Valkey, an advanced key-value store used in Red Hat Enterprise Linux and Red Hat Hardened Images. These include use-after-free flaws in stream deserialization and TLS pending-data processing. An update rebasing Valkey to version 8.0.10 and later 9.0.6 addresses these issues. The vulnerabilities are rated with high severity by Red Hat Product Security.
Red Hat Discovery, also known as Discovery, is an inspection and reporting tool that finds,
identifies, and reports environment data, or facts, such as the number of physical and virtual
systems on a network, their operating systems, and relevant configuration data stored within
them. Discovery also identifies and reports more detailed facts for some versions of key
Red Hat packages and products that it finds in the network.
A flaw was found in the Windows Machine Config Operator (WMCO) for Red Hat OpenShift Container Platform. The WICD CSR auto-approver validates that a Certificate Signing Request contains the organization system:wicd-nodes but does not reject additional organization values such as system:masters. A compromised Windows worker node that holds WICD credentials can submit a CSR that is auto-approved and signed by the cluster, yielding a client certificate that grants cluster-administrator privileges and enabling full cluster takeover.
CVE-2026-13732 is a high-severity vulnerability in the GNU Debugger (GDB) STABS debug format parser affecting Red Hat Enterprise Linux 8. The flaw is an out-of-bounds write caused by a linked list removal bug in the read_member_functions() function, which mishandles destructor entries in C++ class member functions. An attacker can craft a malicious ELF binary that triggers this vulnerability when opened in GDB and performing symbol inspection operations, potentially allowing arbitrary command execution within the GDB process. Red Hat has released security updates addressing this issue for multiple Red Hat Enterprise Linux 8 variants.