Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server.

Security Fix(es):

* crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates (CVE-2026-111943)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat Security Advisory: git-lfs security update

CVE-2026-111943 is a key-generation flaw in the external certificate authority eMudhra/emSign that made intermediate CA private keys recoverable. Three root certificates—AAA Certificate Services, emSign Root TLS CA - G3, and emSign ECC Root CA - G3—were included in AWS trust bundles. This exposure allows soft-fail TLS clients to be vulnerable to man-in-the-middle attacks. AWS is actively removing these affected roots from their trust bundles. Customers using CloudFront custom origins or Application Load Balancer OIDC/JWT authentication should verify if their certificates chain to any of the affected roots and reissue certificates from a different CA before enforcement occurs.

CVE-2026-111943: eMudhra intermediate CA key recovery in AWS trust bundles

These are all security issues fixed in the okteto-3.24.1-1.1 package on the GA media of openSUSE Tumbleweed.

okteto-3.24.1-1.1 on GA media

These are all security issues fixed in the istioctl-1.31.3-1.1 package on the GA media of openSUSE Tumbleweed.

istioctl-1.31.3-1.1 on GA media

These are all security issues fixed in the buildpacks-cli-0.40.10-1.1 package on the GA media of openSUSE Tumbleweed.

buildpacks-cli-0.40.10-1.1 on GA media

Multiple subordinate Certificate Authority private keys from eMudhra (emSign) were compromised, affecting TLS clients and container runtimes that trust these authorities. This vulnerability allows active network Man-in-the-Middle (MitM) interception and traffic spoofing on external TLS connections. Internal GKE cluster mTLS communication remains unaffected due to isolated per-cluster PKI. All currently supported GKE Standard and Autopilot versions running Container-Optimized OS or Ubuntu node images are impacted. Node images and system containers are being updated to distrust the compromised CAs. Customer application containers must be updated independently as they do not inherit the host node's root CA store. Patches are available in specific GKE versions, and mitigations include enforcing image pull integrity, verifying webhook caBundle configurations, applying live-node OS mitigations, and rebuilding container workloads with patched base images.

GCP-2026-071

This update includes the following RPMs:

spire1.15:
  * spire1.15-1.15.5-0.2.hum1 (aarch64, s390x, x86_64)
  * spire1.15-agent-1.15.5-0.2.hum1 (aarch64, s390x, x86_64)
  * spire1.15-oidc-discovery-provider-1.15.5-0.2.hum1 (aarch64, s390x, x86_64)
  * spire1.15-server-1.15.5-0.2.hum1 (aarch64, s390x, x86_64)
  * spire1.15-1.15.5-0.2.hum1.src (src)

Security Fix(es):

spire1.15:
  * CVE-2026-111943

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

This update includes the following RPMs:

opentofu1.12:
  * opentofu1.12-1.12.8-0.2.hum1 (aarch64, s390x, x86_64)
  * opentofu1.12-1.12.8-0.2.hum1.src (src)

Security Fix(es):

opentofu1.12:
  * CVE-2026-111943

This update includes the following RPMs:

prometheus3.5:
  * prometheus3.5-3.5.5-0.9.hum1 (aarch64, x86_64)
  * prometheus3.5-3.5.5-0.9.hum1.src (src)

Security Fix(es):

prometheus3.5:
  * CVE-2026-111943

This update includes the following RPMs:

grafana12.4:
  * grafana12.4-12.4.13-0.2.hum1 (aarch64, x86_64)
  * grafana12.4-12.4.13-0.2.hum1.src (src)

Security Fix(es):

grafana12.4:
  * CVE-2026-111943

This update includes the following RPMs:

distribution:
  * distribution-3.1.2-0.3.hum1 (aarch64, s390x, x86_64)
  * distribution-3.1.2-0.3.hum1.src (src)

Security Fix(es):

distribution:
  * CVE-2026-111943

This update includes the following RPMs:

loki3.7:
  * loki3.7-3.7.8-0.4.hum1 (aarch64, x86_64)
  * loki3.7-canary-3.7.8-0.4.hum1 (aarch64, x86_64)
  * loki3.7-logcli-3.7.8-0.4.hum1 (aarch64, x86_64)
  * loki3.7-3.7.8-0.4.hum1.src (src)

Security Fix(es):

loki3.7:
  * CVE-2026-111943

This update includes the following RPMs:

prometheus3.13:
  * prometheus3.13-3.13.4-0.2.hum1 (aarch64, x86_64)
  * prometheus3.13-3.13.4-0.2.hum1.src (src)

Security Fix(es):

prometheus3.13:
  * CVE-2026-111943

This update includes the following RPMs:

hugo:
  * hugo-0.168.0-0.2.hum1 (aarch64, s390x, x86_64)
  * hugo-0.168.0-0.2.hum1.src (src)

Security Fix(es):

hugo:
  * CVE-2026-111943

This update includes the following RPMs:

tempo3.0:
  * tempo3.0-3.0.4-0.2.hum1 (aarch64, x86_64)
  * tempo3.0-3.0.4-0.2.hum1.src (src)

Security Fix(es):

tempo3.0:
  * CVE-2026-111943

grafana-pcp

A security update has been issued for the grafana-pcp plugin in Red Hat Enterprise Linux 9.4 to address a vulnerability in the golang crypto/x509 package (CVE-2026-111943) that could allow man-in-the-middle attacks via untrusted intermediate certificates. This vulnerability affects the handling of intermediate certificates in TLS connections. Red Hat has released updated packages to fix this issue for multiple architectures and product variants of RHEL 9.4.

Search: CVE-2026-111943