Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.
This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.15.68. See the following advisory for the container images for this release:
https://access.redhat.com/errata/RHSA-2026:56912
Security Fix(es):
* crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)
* net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811)
* crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption (CVE-2025-68121)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
All OpenShift Container Platform 4.15 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html-single/updating_clusters/index#updating-cluster-cli.
Red Hat build of MicroShift is Red Hat's light-weight Kubernetes
orchestration solution designed for edge device deployments and is built
from the edge capabilities of Red Hat OpenShift Container Platform.
MicroShift is an application that is deployed on top of Red Hat Enterprise
Linux devices at the edge, providing an efficient way to operate
single-node clusters in these low-resource environments.
This advisory contains the RPM packages for Red Hat build of MicroShift
4.16.69. Read the following advisory for the container images for this
release:
https://access.redhat.com/errata/RHSA-2026:56854
Security Fix(es):
* net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of
Service via malformed SETTINGS_MAX_FRAME_SIZE frame (CVE-2026-33814)
* net/mail: golang: Go net/mail: Denial of Service via crafted email inputs
(CVE-2026-39820)
* golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege
escalation via incorrect Punycode label processing (CVE-2026-39821)
* net/mail: golang: net/mail: Denial of Service via pathological email
address parsing (CVE-2026-42499)
All Red Hat build of MicroShift 4.16 users are advised to use these updated
packages and images when they are available in the RPM repository.
In DocSys-master V2.02.85, the uploadMarkdownPic interface in src/com/DocSystem/controller/DocController.java has an arbitrary file upload vulnerability:
A user reports unexpected URL wrapping in emails from their CEO, where links are rewritten to a domain 'linkprotect.cudasvc.com'. The organization is not a Barracuda customer and does not use Barracuda add-ons, yet the wrapped links have appeared since late 2025 and recently caused email delivery issues with a client using Proofpoint email filtering. The cause of the wrapping and the sudden failure of these links is unclear.
CVE-2026-55532 is an origin validation vulnerability in MervinPraison PraisonAI prior to version 4.6.58. The issue arises because the HTTP stream origin validation uses a startswith check, allowing attacker-controlled origins like localhost.attacker.com to bypass the localhost allowlist. This enables a webpage to send text/plain requests without preflight and invoke certain API calls without an API key, including file writes that can persist agent instructions. The vulnerability is fixed in version 4.6.58.
Joomla Extension - miniorange.com - Unauthenticated Authentication Bypass via SAMLResponse Parameter in miniOrange SAML SSO < 11.0.2, SAML SP Single Sign On – Login with ADFS < 6.4, SAML SP Single Sign On – SAML SSO login with Google Apps < 6.4 - This is due to the mo_saml_validate_signature() function performing a loose boolean check on the raw tri-state integer returned by PHP's openssl_verify(), causing an error return value of -1 to be evaluated as truthy and therefore treated as a successful signature verification. This makes it possible for unauthenticated attackers to log in as any existing Joomla user, including administrators, by submitting a crafted SAMLResponse containing an attacker-controlled NameID and a deliberately malformed signature value that triggers an OpenSSL processing error — bypassing verification entirely and resulting in wp_set_auth_cookie() being called for the targeted account.
CVE-2026-77997 is a medium severity vulnerability in the YOOtheme Pro extension for Joomla versions 1.0.0 through 5.0.41. It involves improper access control where users with com_template editing permissions can access information about arbitrary modules without having the necessary com_modules permissions. This could lead to unauthorized disclosure of privileged information.
CVE-2026-77996 is a high-severity stored cross-site scripting (XSS) vulnerability in the YOOtheme Pro extension for Joomla. It affects versions 1.0.0 through 5.0.41. The flaw arises from improper escaping of input in the location custom field, allowing authenticated privileged users to inject malicious scripts. This vulnerability does not require user interaction and has a high impact on confidentiality and integrity. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.
Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.
This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.21.30. See the following advisory for the container images for this release:
https://access.redhat.com/errata/RHSA-2026:57801
Security Fix(es):
* mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header (CVE-2026-42504)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
All OpenShift Container Platform 4.21 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html-single/updating_clusters/index#updating-cluster-cli.
Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.
This advisory contains the container images for Red Hat OpenShift Container Platform 4.20.35. There are no RPM packages for this release.
Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes:
https://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html/release_notes/
Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.
This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.21.30. See the following advisory for the container images for this release:
https://access.redhat.com/errata/RHSA-2026:57801
Security Fix(es):
* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
All OpenShift Container Platform 4.21 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html-single/updating_clusters/index#updating-cluster-cli.
The npm package 'css-import-order' version 1.1.0 declares its own name as a dependency and devDependency pointing to an untrusted, non-registry HTTP URL (http://pack.nppacks.com/npm/css-import-order). This allows npm install to fetch and execute potentially attacker-controlled code during installation, bypassing integrity checks and version pinning. The local module code is benign, but the installation process is the attack vector.
CVE-2026-77310 is a Server-Side Request Forgery (SSRF) vulnerability in the jackson-databind library's deserialization of java.net.InetAddress. Unlike the previously fixed InetSocketAddress deserialization which avoids DNS resolution, the InetAddress deserialization still performs eager DNS lookups on attacker-controlled input. This can lead to DNS-based SSRF allowing out-of-band interaction or internal host enumeration via DNS queries during JSON deserialization.
A critical authorization bypass vulnerability (CVE-2026-77995) exists in the miniOrange OAuth Client (free) extension for Joomla. Versions prior to 3.2.0 for miniOrange OAuth Client and prior to 1.2.2 for related OAuth Single Sign-On extensions are affected. The flaw allows an attacker to manipulate a cookie value to log in as arbitrary users, including administrators, leading to arbitrary account takeover.
## Summary
`hydra.utils.instantiate()` resolves and calls Python objects from config. If an
application passes untrusted config to `instantiate()`, an attacker who controls
`_target_` and its arguments can cause arbitrary code execution in the consuming
process.
Hydra is not a network service. Exploitation requires a consuming application,
library, or user workflow to load attacker-controlled config, CLI overrides, or
model metadata and pass it to `hydra.utils.instantiate()`.
## Details
Hydra's instantiate API is designed to construct objects and call functions from
configuration. For example:
```yaml
component:
_target_: package.module.Class
arg: value
```
When this config is passed to `hydra.utils.instantiate()`, Hydra resolves
`_target_` and calls it with the provided arguments.
This is intended for trusted application configuration. However, if untrusted
input controls `_target_`, the config becomes a callable-selection mechanism. A
malicious config can select a callable capable of executing code or commands and
provide attacker-controlled arguments.
This issue is the same general class of problem discussed by Unit 42 for
downstream AI/ML libraries such as NVIDIA NeMo, where untrusted model metadata
was passed into Hydra instantiate:
https://unit42.paloaltonetworks.com/rce-vulnerabilities-in-ai-python-libraries/
Hydra 1.3.4 includes a blacklist for some dangerous `_target_` values. That
blacklist is defense-in-depth and is not a complete security boundary. The
blacklist is not present in the released `hydra-core` 1.3.3 package, so this
issue should not be described as a bypass of a released 1.3.3 blacklist.
## Impact
A successful attack can execute code in the process that calls
`hydra.utils.instantiate()`. The impact is limited to the privileges and
environment of that process.
Potential impact includes:
- Reading files, credentials, environment variables, or data accessible to the
process
- Modifying files, outputs, checkpoints, or application state writable by the
process
- Terminating or disrupting the process
## Affected Usage
Applications and libraries are affected when they pass untrusted or semi-trusted
config, model metadata, CLI overrides, or other externally controlled data to
`hydra.utils.instantiate()` without constraining which targets may be
instantiated.
Trusted application-owned configuration is not affected in the same way.
## Remediation
Hydra 1.3.4 hardens the existing behavior by adding a blacklist of obvious
dangerous targets. It is a substantial security improvement, and users remaining
on the 1.3 release line should upgrade to 1.3.4 or a newer version.
The unreleased Hydra 1.4 development line uses an allowlist-based instantiation
model that fully addresses this vulnerability class. The allowlist must come
from trusted application code or another trusted channel, not from the untrusted
config being instantiated.
Applications that consume untrusted or semi-trusted config should not pass it
directly to `hydra.utils.instantiate()`. They should validate `_target_` values
against a trusted allowlist before instantiation.