A flaw was found in the JWT Bearer authorization grant implementation within the keycloak-services component of Red Hat Build of Keycloak. This component handles various OAuth2 and OpenID Connect grant types used for issuing access tokens. The issue occurs because the JWT Bearer grant fails to check if a client requires user consent before issuing a token. This allows an authenticated attacker with valid client credentials and a trusted identity provider assertion to bypass the consent requirement and obtain unauthorized access to a user account at a consent-gated client.
This release of Red Hat build of Apicurio Registry 3.3.1 GA includes the following security fixes.
Security Fix(es):
* DOMPurify: Cross-site scripting vulnerability allows code execution [rhint-serv-3] (CVE-2026-49978)
* apicurio-registry: Unhardened SAXParser in content-type detection leads to blind XXE / SSRF / billion-laughs DoS [rhint-serv-3] (CVE-2026-12975)
* apicurio-registry: SSRF via wsdl4j import dereference in WSDL FULL validation [rhint-serv-3] (CVE-2026-12992)
* apicurio-registry: XML entity-expansion denial of service via internal DTD subset [rhint-serv-3] (CVE-2026-12993)
* Axios: Client-side Denial of Service via unescaped regex metacharacters in XSRF cookie name [rhint-serv-3] (CVE-2026-44496)
* DOMPurify: Cross-Site Scripting (XSS) via inconsistent tag sanitization [rhint-serv-3] (CVE-2026-41240)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
A vulnerability in libgit2 prior to versions 1.8.6 and 1.9.5 causes incorrect validation of IP-literal HTTPS URLs when using OpenSSL. This flaw allows a network attacker with a CA-trusted certificate containing any IP SubjectAltName to intercept connections. The issue affects only OpenSSL builds and does not impact DNS SubjectAltName validation or other TLS backends. The vulnerability is fixed in libgit2 versions 1.8.6 and 1.9.5. Red Hat has released updated packages including libgit2-1.9.7-1.hum1 to address this issue.
CVE-2026-78701 is a vulnerability in the 389-ds-base component of Red Hat Enterprise Linux 10 that affects the Simple Authentication and Security Layer (SASL) UNBIND process. A remote, authenticated attacker can exploit this flaw by sending a specially crafted request to cause a connection stall, leading to resource exhaustion and a denial of service (DoS) condition on the server. The vulnerability has a CVSS score of 6.5, indicating a medium severity impact focused on availability. Red Hat has published an advisory indicating that this issue is related to an incomplete fix for a previous CVE and that updates are available for Red Hat Enterprise Linux 9, but no explicit patch information for version 10 is provided in the advisory content. No known exploits are reported in the wild at this time.
CVE-2026-78322 is a stack buffer overflow vulnerability in file-roller on Red Hat Enterprise Linux 6. It occurs when opening or extracting malicious 7z or RAR archives containing file entries with excessively long paths. The vulnerability causes file-roller to terminate unexpectedly, resulting in a denial of service. Exploitation requires user interaction by opening or extracting a crafted archive. The vulnerability does not lead to confidentiality or integrity loss but impacts availability.
The resource-agents packages provide the Pacemaker and RGManager service managers with a set of scripts. These scripts interface with several services to allow operating in a high-availability (HA) environment.
Security Fix(es):
* pyasn1: pyasn1: Denial of Service via crafted ASN.1 REAL values (CVE-2026-59886)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
A flaw was found in CRI-O's container-creation environment-variable handling
(`mergeEnvs` in `server/utils.go`, consumed by `setupContainerEnvironmentAndWorkdir` in
`server/container_create.go`). When a `CreateContainer` request supplies a `nil` CRI
`Envs` field, CRI-O falls back to using the target OCI image's `config.Env` entries
unfiltered, in contrast to the normal merge path, which validates each entry for a
`key=value` form before use. An OCI image whose `config.Env` contains an entry with no
`=` character (e.g. a bare `NOEQUALS` string) causes CRI-O to split that entry into a
single-element slice and then index its second element, which is out of range. This
triggers an unrecovered Go runtime panic in the `crio` daemon process, crashing it and
terminating the container-runtime service for all workloads on the node until it is
restarted.
Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to individual teams, while automation developers retain the freedom to write tasks that leverage existing knowledge without the overhead. Ansible Automation Platform makes it possible for users across an organization to share, vet, and manage automation content by means of a simple, powerful, and agentless language.
For details about this release, refer to the release notes listed in the References section.
A vulnerability in vLLM, the inference engine used by Red Hat AI Inference Server, allows unauthenticated attackers to execute arbitrary code by loading malicious HuggingFace models when vLLM runs in Python optimized mode. This affects Red Hat AI Inference Server versions prior to 0.22.0 that include the vulnerable pooler activation loader. Exploitation requires supplying untrusted models and running with Python optimization enabled. Red Hat rates the impact as Important for AI Inference Server and OpenShift AI vLLM serving images, and Moderate for RHEL AI bootc images bundling vLLM. No fix is currently available. Mitigations include avoiding Python optimization mode, loading models only from trusted sources, restricting deployment permissions, and applying network controls.
Two heap-based buffer overflow vulnerabilities in the gstreamer1-plugins-good package for Red Hat Enterprise Linux 10 can lead to remote code execution. These flaws occur during parsing of MRF and PNG files. Red Hat has issued an important security update to address these issues.
Red Hat Ansible Automation Platform 2.5 has multiple security vulnerabilities affecting components such as automation-controller, automation-gateway, python3.12-aiohttp, python3.12-django, and python3.12-gitpython. These include remote code execution, server-side request forgery (SSRF), path traversal, denial of service, command injection, and memory exhaustion issues. The vulnerabilities allow attackers to execute arbitrary code, leak credentials, perform directory escapes, and cause service disruptions. A security update addressing these issues is available from Red Hat.
CVE-2026-19685 is a vulnerability in NetworkManager on Red Hat Enterprise Linux 10 that allows an unprivileged local user with specific permissions to bypass server certificate validation for WPA-Enterprise (802.1X) connections. This flaw is due to an incomplete fix of a previous vulnerability (CVE-2025-9615) where the private_user restriction was not applied to certain 802.1x CA path properties. Exploitation requires an active local user session with settings.modify.own polkit permission. The vulnerability enables credential theft via a rogue access point but does not affect open or WPA2-Personal networks.
CVE-2026-71366 is a server-side request forgery (SSRF) vulnerability affecting multiple notification backends in Red Hat Ansible Automation Platform 2.5 for RHEL 8. The affected backends (webhook, Mattermost, Rocket.Chat, and Grafana) do not validate notification template URLs against private, loopback, or reserved IP ranges, allowing an organization notification administrator to cause the AWX control node to send HTTP requests to internal or loopback addresses. The webhook backend also follows HTTP redirects and resends Basic Authentication credentials to redirected hosts without validation, risking credential exfiltration. The Grafana backend exposes its API key to the configured target URL. Red Hat has rated this vulnerability as having an Important impact and has released a security update to fix it.
CVE-2026-71364 is a path traversal vulnerability in Red Hat Ansible Automation Platform 2.5 for RHEL 8. The vulnerability occurs in the project_archive action plugin, which extracts archive members without proper path normalization or boundary validation. This allows an attacker controlling the archive content to write files outside the intended directory, potentially leading to arbitrary file writes and remote code execution. Red Hat has issued an important security advisory with a patch to address this issue.
CVE-2026-17527 is a high-severity vulnerability in Red Hat OpenShift Virtualization's containerized-data-importer (CDI) component. The aggregated cdi.kubevirt.io:view ClusterRole, which is intended to provide read-only access, incorrectly grants create permission on the datavolumes/source subresource. This flaw allows a user or service account with view role cluster-wide and write access to any namespace to clone and exfiltrate the contents of any PersistentVolumeClaim (PVC) across namespaces, bypassing namespace isolation. The vulnerability affects default aggregated RBAC roles in CDI and downstream consumers including OpenShift Virtualization. No fix is currently available, and mitigation involves avoiding cluster-wide binding of the vulnerable role and auditing role bindings to prevent combined view and write access across namespaces.
CVE-2026-78367 is a high-severity vulnerability in Red Hat Hardened Images involving improper control of code generation in RPM's rpmbuild tarball processing. An attacker can craft a source archive with malicious tar member names that inject RPM macros, including Lua expressions, leading to arbitrary code execution with the privileges of the user running rpmbuild. This occurs when rpmbuild processes attacker-controlled source tarballs in tarball mode. Red Hat has released an official security update addressing this issue.
A high severity security vulnerability identified as CVE-2026-67214 affects the jaeger package version 2.20.0-0.7.hum1 included in Red Hat Hardened Images RPMs. Red Hat has issued a security update addressing this vulnerability. The advisory does not provide detailed technical information about the nature of the vulnerability or its exploitation but confirms the availability of an update to fix the issue.