Threat database

A critical command injection vulnerability exists in Red Hat Satellite 6 API (rubygem-foreman_remote_execution) allowing attackers with job template execution permissions to inject arbitrary shell commands via the effective_user parameter when it is marked overridable. This flaw affects Red Hat Satellite versions from 6.16 up to but not including 6.19.5. The vulnerability arises from improper input sanitization during job execution environment instantiation, enabling command execution on target infrastructure with execution user privileges. Red Hat has released an official patch in version 6.19.5 to address this issue.

Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache Tomcat Servlet container, JBoss HTTP Connector (mod_cluster), the PicketLink Vault extension for Apache Tomcat, and the Tomcat Native library. This release of Red Hat JBoss Web Server 6.2.5 serves as a replacement for Red Hat JBoss Web Server 6.2.4. This release includes bug fixes, enhancements and component upgrades, which are documented in the Release Notes that are linked to in the References section. Security Fix(es): * tomcat-catalina: Apache Tomcat: Misleading security logs due to incorrect control flow (CVE-2026-55276) * tomcat-coyote-ffm: Apache Tomcat: Error condition not handled when configuring CRL (CVE-2026-53434) * jws6-tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valve (CVE-2026-59083) * tomcat: Apache Tomcat: Local information disclosure via Unix domain socket TOCTOU race condition (CVE-2026-65183) * tomcat: Apache Tomcat: Security constraint bypass due to improper access control (CVE-2026-65182) * tomcat: Apache Tomcat: Access control bypass due to off-by-one error in RewriteValve [N] flag processing (CVE-2026-65927) * tomcat: Apache Tomcat: Denial of Service via HTTP/2 allocation leak (CVE-2026-68763) * tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass (CVE-2026-68525) * tomcat: Apache Tomcat - DoS in WebSocket chat example (CVE-2026-66299) * tomcat: Apache Tomcat: Authenticated WebSocket session persists after HTTP session termination (CVE-2026-73180) * tomcat: Apache Tomcat: Improper Authorization allows bypass of declarative role constraints (CVE-2026-66422) * tomcat: Apache Tomcat: Improper Authentication due to principal lookup failure (CVE-2026-68569) * tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator (CVE-2026-65905) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A vulnerability in GitPython's TagReference.create() method allows an attacker to read arbitrary local files by bypassing unsafe option guards with a specially crafted positional argument. This causes the contents of arbitrary files to be returned in the annotated tag message. The issue affects GitPython versions up to 3.1.58 and requires the embedding application to forward a user-controlled reference value. A fix is available that properly checks positional arguments or separates them with '--' to prevent this bypass. This vulnerability is relevant to Red Hat Satellite and related container images as noted in the Red Hat security advisory.

CVE-2026-75899 is a high severity vulnerability affecting Red Hat Hardened Images RPMs, including the satellite/iop-vulnerability-frontend-rhel9 container image. The issue is addressed in updated packages such as grafana13.2. No known exploits are reported in the wild. The vulnerability impacts specific versions of node-ajv and related components within Red Hat's hardened images.

Red Hat Developer Hub (RHDH) versions prior to 1.9.9 contain a high severity security vulnerability identified as CVE-2026-19534. RHDH is an enterprise-grade, self-managed developer portal based on Backstage.io, supported on Kubernetes platforms including OpenShift. Red Hat released version 1.9.9 to address this and other issues. No CVSS score is provided for this vulnerability.

An off-by-one error in the GLib library's g_key_file_get_locale_string_list function can cause a one-byte out-of-bounds access or denial of service when processing a key file with an empty value. This vulnerability affects Red Hat OpenShift Container Platform 4.12 and related products. Red Hat has released security updates addressing this and other GLib vulnerabilities.

Red Hat has issued a security advisory for Red Hat Hardened Images RPMs, specifically updating the openshell packages to address multiple vulnerabilities identified by CVE-2026-102821, CVE-2026-102823, and CVE-2026-102824. The update includes new versions of openshell, openshell-gateway, and python3-openshell RPMs for aarch64 and x86_64 architectures. No explicit details on the nature of the vulnerabilities or their impact are provided in the advisory. The advisory does not list any fixed versions prior to these updates, indicating these RPM versions contain the security fixes.

Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache Tomcat Servlet container, JBoss HTTP Connector (mod_cluster), the PicketLink Vault extension for Apache Tomcat, and the Tomcat Native library. This release of Red Hat JBoss Web Server 6.2.5 serves as a replacement for Red Hat JBoss Web Server 6.2.4. This release includes bug fixes, enhancements and component upgrades, which are documented in the Release Notes that are linked to in the References section. Security Fix(es): * tomcat-catalina: Apache Tomcat: Misleading security logs due to incorrect control flow (CVE-2026-55276) * tomcat-coyote-ffm: Apache Tomcat: Error condition not handled when configuring CRL (CVE-2026-53434) * jws6-tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valve (CVE-2026-59083) * tomcat: Apache Tomcat: Local information disclosure via Unix domain socket TOCTOU race condition (CVE-2026-65183) * tomcat: Apache Tomcat: Security constraint bypass due to improper access control (CVE-2026-65182) * tomcat: Apache Tomcat: Access control bypass due to off-by-one error in RewriteValve [N] flag processing (CVE-2026-65927) * tomcat: Apache Tomcat: Denial of Service via HTTP/2 allocation leak (CVE-2026-68763) * tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass (CVE-2026-68525) * tomcat: Apache Tomcat - DoS in WebSocket chat example (CVE-2026-66299) * tomcat: Apache Tomcat: Authenticated WebSocket session persists after HTTP session termination (CVE-2026-73180) * tomcat: Apache Tomcat: Improper Authorization allows bypass of declarative role constraints (CVE-2026-66422) * tomcat: Apache Tomcat: Improper Authentication due to principal lookup failure (CVE-2026-68569) * tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator (CVE-2026-65905) * openssl.exe: Heap Use-After-Free in OpenSSL PKCS7_verify() (CVE-2026-45447) * jws-optional-native-components-win6-x86_64.zip: PKCS#12 Files with PBMAC1 Are Accepted with Short HMAC Keys (CVE-2026-34181) * jws-optional-native-components-win6-x86_64.zip: OpenSSL: Heap buffer over-read in ASN.1 decoding can lead to denial of service or information disclosure (CVE-2026-34180) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the container images for Red Hat OpenShift Container Platform 4.18.56. See the following advisory for the RPM packages for this release: https://access.redhat.com/errata/RHSA-2026:70614 Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes: https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/release_notes/ Security Fix(es): * urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion (CVE-2025-66418) * bind: BIND 9 server memory exhaustion during GSS-API TKEY negotiation (CVE-2026-3039) * bind: BIND: Denial of Service via specially crafted DNS messages (CVE-2026-5946) * dracut: dracut: Root code execution via DHCP options command injection (CVE-2026-6893) * bind9: bind: Potential wildcard CNAME RPZ policy bypass (CVE-2026-11331) * bind: bind9: DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field (CVE-2026-13321) * dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die() (CVE-2026-15816) * libarchive: Double-Free Vulnerability in RAR5 Decompression Logic via dangling filtered_buf pointer in init_unpack() (CVE-2026-14164) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. All OpenShift Container Platform 4.18 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html-single/updating_clusters/index#updating-cluster-cli.

Multiple security vulnerabilities affect Red Hat OpenShift Container Platform versions including 4.12.98, 4.14, 4.15, 4.16 through 4.22.11. These include a bypass vulnerability in cri-o allowing /etc/passwd injection via the HOME environment variable (CVE-2026-15809), denial of service issues in Go language packages, privilege escalation via incorrect Punycode processing, and cross-site scripting in Go's html/template package. Red Hat has released updated RPM packages and container images to address these issues. Users are advised to upgrade to the fixed versions using the OpenShift CLI or web console.

This advisory addresses security vulnerabilities in GVFS, the GNOME Virtual File System, affecting Red Hat Enterprise Linux 9. The update fixes a heap-based buffer overflow in the SFTP component and a local privilege escalation via a socket ownership race condition. These issues could allow local attackers to gain elevated privileges or cause memory corruption. The update is rated as important by Red Hat and applies to multiple architectures and variants of Red Hat Enterprise Linux 9.

Podman versions from 4.4.0 up to but not including 5.8.8, and from 6.0.0 up to but not including 6.1.3, contain a vulnerability where podman run treats images with the io.podman.annotations.checkpoint.runtime.name annotation as checkpoints. This causes podman to ignore user-supplied container creation restrictions such as --cap-drop=ALL, potentially allowing weaker sandbox settings and capabilities. Rootless containers are not affected. The issue is fixed in versions 5.8.8 and 6.1.3.

Red Hat has released a security advisory for Red Hat Hardened Images RPMs, including multiple nodejs26-related packages and the v8-devel package. The update addresses several vulnerabilities identified by CVE-2026-102276, CVE-2026-102277, and CVE-2026-102278. The advisory provides updated package versions to fix bugs and enhance security. The update is available for aarch64 and x86_64 architectures as well as noarch packages. No specific technical details or exploitation methods are provided.

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CVE-2026-64102) * kernel: vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CVE-2026-68299) * kernel: net/liquidio: drop cached VF pci_dev LUT (CVE-2026-72329) * kernel: dm-integrity: don't increment hash_offset twice (CVE-2026-72099) Bug Fix(es) and Enhancement(s): * [RHEL 8.10] "kernel BUG at lib/list_debug.c:28!": list_add corruption in register_trace_event RHEL 8.10 (JIRA:RHEL-214136) * request_key_auth use-after-free on every request-key upcall since 4.18.0-553.165.1 (regression from CVE-2026-63823 backport) (JIRA:RHEL-270349) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat has released an important security update for the OpenShift File Integrity Operator (v1.5.0) that addresses multiple bugs and security vulnerabilities, including CVE-2026-56853. The update includes enhancements such as schema extensions, network policy improvements, TLS profile consistency, and a base image switch. The vulnerability CVE-2026-56853 is rated as high severity. Users are advised to apply this update after ensuring all prior relevant errata are installed.