Threats Tagged 'cve-2026-17615'

Red Hat has released a security update for the Red Hat build of Keycloak 26.6.7 images used in OpenShift Container Platform. This update addresses multiple security vulnerabilities including information disclosure, privilege escalation, authorization bypasses, remote code execution, and denial of service issues. The update provides new container images that align with the standalone Keycloak product release. Users of Red Hat build of Keycloak 26.6.7 are advised to apply the update to mitigate these risks.

Red Hat has released a security update for Red Hat build of Keycloak 26.6.7 addressing multiple vulnerabilities. These include issues such as information disclosure, privilege escalation, authorization bypasses, remote code execution, and denial of service. The update fixes a wide range of security flaws affecting authentication, authorization, token handling, and endpoint protections. Users of affected versions are advised to apply the update to mitigate these risks.

A Server-Side Template Injection (SSTI) vulnerability (CVE-2026-12894) exists in the ReflectionValueResolver component of the Qute template engine used by Quarkus. This flaw allows an attacker who can influence template text to bypass restrictions and execute unauthorized commands on the server. The issue affects Red Hat Build of Apache Camel 4.18 for Quarkus versions up to 3.33.0. Red Hat has released an update (RHBQ 3.33.3.SP1) addressing this and other vulnerabilities. The update is rated as important by Red Hat Product Security.

CVE-2026-17615 is a high severity vulnerability in Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP1 involving improper restriction of XML External Entity (XXE) references. This vulnerability allows remote unauthenticated file read via the RESTeasy SourceProvider component. Red Hat has released an important security update addressing this and other related vulnerabilities in the product.

CVE-2026-17615 is an XML External Entity (XXE) vulnerability in the RESTEasy SourceProvider component used by Red Hat Build of Apache Camel 3.33.3.SP1. An unauthenticated attacker can send a crafted XML payload with an external entity reference to trick the server into disclosing sensitive file contents in the HTTP response. This occurs because the SAXParser used in SourceProvider.writeTo() does not disable external entity resolution. Red Hat has issued an important security advisory with an update that addresses this vulnerability.