Threats Tagged 'cve-2026-41178'

A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients. Security Fix(es): * crypto/internal/nistec: golang: Timing sidechannel for P-256 on ppc64le in crypto/internal/nistec (CVE-2025-22866) * crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281) * net/mail: golang: net/mail: Denial of Service via pathological email address parsing (CVE-2026-42499) * mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header (CVE-2026-42504) * github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers (CVE-2026-41178) * github.com/labstack/echo: Echo: Unauthorized Information Disclosure via URL Path Decoding Discrepancy (CVE-2026-55677) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat OpenShift Logging 6.6.1 is a cluster-wide logging solution for OpenShift that collects and manages applications, infrastructure, and audit logs.

CVE-2026-33818 affects the External Secrets Operator for Red Hat OpenShift, which integrates external secret management systems into Kubernetes. The vulnerability involves the Go net/http library used by the operator, specifically in handling unencrypted HTTP/2 connections where the ReadHeaderTimeout is not properly enforced during client preface reading. This flaw can allow a remote attacker to maintain open connections indefinitely, potentially leading to denial of service (DoS) by exhausting server resources. Red Hat has released patches addressing this issue in updated versions of the affected components.

Red Hat has issued a security advisory for osbuild-composer, a service used to build customized OS artifacts including VM images and OSTree commits. The update addresses multiple security vulnerabilities in underlying Golang components, including certificate validation bypass, denial of service via crafted inputs, cross-site scripting, and other issues. These vulnerabilities affect various Golang packages such as crypto/x509, net/mail, mime, encoding/asn1, net/url, net/http, html/template, crypto/tls, and encoding/xml. The advisory includes fixes for these issues and some bug fixes and enhancements. A patch is available for affected Red Hat Enterprise Linux 10 and related products. No known exploits in the wild have been reported.

This release of the Red Hat OpenShift distributed tracing platform (Tempo) provides new features, security improvements, and bug fixes. Breaking changes: * High availability defaults for TempoStack deployment sizes: Before this update, only the ingester component was scaled for high availability while all other components defaulted to a single replica, leaving the overall ingest and query paths vulnerable to single points of failure. With this update, when you set a non-demo deployment size (1x.pico, 1x.extra-small, 1x.small, or 1x.medium) in the spec.size field of the TempoStack custom resource, the Operator defaults each component to at least 2 replicas, and scales throughput-bound components at larger sizes. Watch your resource consumption, as running more replicas per component increases the total CPU and memory consumed by the deployment. Explicit per-component replicas values always take precedence. For more information, see https://redhat.atlassian.net/browse/TRACING-6169. Deprecations: * Jaeger Query is deprecated: The Jaeger Query component in the Tempo Operator is deprecated and will be removed in a future release. The Tempo Operator emits a warning when the Jaeger Query feature is enabled. To visualize traces, use the distributed tracing UI plugin as the recommended replacement for the Jaeger UI. For more information, see https://redhat.atlassian.net/browse/TRACING-6509. Technology Preview features: * None Enhancements: * High availability for TempoStack deployments: You can use the spec.replicationZones field in the TempoStack custom resource to define zone-aware replication. By using this feature, you can deploy TempoStack instances with higher resilience by spreading replicas across topology zones and ensuring minimum pod availability during disruptions. For more information, see https://redhat.atlassian.net/browse/TRACING-6168. * Service name and namespace auto-complete with query RBAC enabled: When you enable query Role-Based Access Control (RBAC) in a multi-tenant TempoStack deployment, the Tempo gateway supports auto-complete for non-sensitive attributes such as service name and namespace. Before this update, all tag value API endpoints were blocked when query RBAC was enabled, which prevented the Service Name drop-down filter in the distributed tracing console plugin from displaying results. With this update, the gateway allows the search tags API for non-sensitive attributes while still protecting sensitive span data. As a result, the Service Name filter and other non-sensitive attribute drop-down list items work correctly in multi-tenant RBAC mode. For more information, see https://redhat.atlassian.net/browse/TRACING-6485. Bug fixes: * TempoStack and TempoMonolithic status conditions accurately reflect pod readiness: Before this update, the status field of the TempoStack or TempoMonolithic custom resource might show Ready=false even when all pods were ready, or vice versa. With this update, the Operator watches Deployment and StatefulSet status changes, and the status conditions accurately reflect actual pod readiness. Deleted pods are removed from the pod status map. As a result, the status field reliably indicates the current state of the deployment. For more information, see https://redhat.atlassian.net/browse/TRACING-6453. * Gateway redirect URL respects the custom ingress hostname: Before this update, setting a custom hostname with the spec.template.gateway.ingress.host field in the TempoStack custom resource did not update the OpenShift OAuth redirect URL, so authentication redirects pointed to the wrong URL. With this update, the Operator uses the custom hostname when generating the redirect URL, and gateway authentication works correctly with custom ingress hostnames. For more information, see https://redhat.atlassian.net/browse/TRACING-6435. * Gateway starts on clusters that use external OIDC authentication: Before this update, on clusters using external OpenID Connect (OIDC) authentication instead of the built-in OpenShift OAuth server, the Tempo gateway container failed to start because it could not auto-discover the OpenShift OAuth endpoints. With this update, the gateway handles external authentication and starts correctly on such clusters. For more information, see https://redhat.atlassian.net/browse/TRACING-6646. Known issues: * None

This release of the Red Hat OpenShift distributed tracing platform (Tempo) provides new features, security improvements, and bug fixes. Breaking changes: * High availability defaults for TempoStack deployment sizes: Before this update, only the ingester component was scaled for high availability while all other components defaulted to a single replica, leaving the overall ingest and query paths vulnerable to single points of failure. With this update, when you set a non-demo deployment size (1x.pico, 1x.extra-small, 1x.small, or 1x.medium) in the spec.size field of the TempoStack custom resource, the Operator defaults each component to at least 2 replicas, and scales throughput-bound components at larger sizes. Watch your resource consumption, as running more replicas per component increases the total CPU and memory consumed by the deployment. Explicit per-component replicas values always take precedence. For more information, see https://redhat.atlassian.net/browse/TRACING-6169. Deprecations: * Jaeger Query is deprecated: The Jaeger Query component in the Tempo Operator is deprecated and will be removed in a future release. The Tempo Operator emits a warning when the Jaeger Query feature is enabled. To visualize traces, use the distributed tracing UI plugin as the recommended replacement for the Jaeger UI. For more information, see https://redhat.atlassian.net/browse/TRACING-6509. Technology Preview features: * None Enhancements: * High availability for TempoStack deployments: You can use the spec.replicationZones field in the TempoStack custom resource to define zone-aware replication. By using this feature, you can deploy TempoStack instances with higher resilience by spreading replicas across topology zones and ensuring minimum pod availability during disruptions. For more information, see https://redhat.atlassian.net/browse/TRACING-6168. * Service name and namespace auto-complete with query RBAC enabled: When you enable query Role-Based Access Control (RBAC) in a multi-tenant TempoStack deployment, the Tempo gateway supports auto-complete for non-sensitive attributes such as service name and namespace. Before this update, all tag value API endpoints were blocked when query RBAC was enabled, which prevented the Service Name drop-down filter in the distributed tracing console plugin from displaying results. With this update, the gateway allows the search tags API for non-sensitive attributes while still protecting sensitive span data. As a result, the Service Name filter and other non-sensitive attribute drop-down list items work correctly in multi-tenant RBAC mode. For more information, see https://redhat.atlassian.net/browse/TRACING-6485. Bug fixes: * TempoStack and TempoMonolithic status conditions accurately reflect pod readiness: Before this update, the status field of the TempoStack or TempoMonolithic custom resource might show Ready=false even when all pods were ready, or vice versa. With this update, the Operator watches Deployment and StatefulSet status changes, and the status conditions accurately reflect actual pod readiness. Deleted pods are removed from the pod status map. As a result, the status field reliably indicates the current state of the deployment. For more information, see https://redhat.atlassian.net/browse/TRACING-6453. * Gateway redirect URL respects the custom ingress hostname: Before this update, setting a custom hostname with the spec.template.gateway.ingress.host field in the TempoStack custom resource did not update the OpenShift OAuth redirect URL, so authentication redirects pointed to the wrong URL. With this update, the Operator uses the custom hostname when generating the redirect URL, and gateway authentication works correctly with custom ingress hostnames. For more information, see https://redhat.atlassian.net/browse/TRACING-6435. * Gateway starts on clusters that use external OIDC authentication: Before this update, on clusters using external OpenID Connect (OIDC) authentication instead of the built-in OpenShift OAuth server, the Tempo gateway container failed to start because it could not auto-discover the OpenShift OAuth endpoints. With this update, the gateway handles external authentication and starts correctly on such clusters. For more information, see https://redhat.atlassian.net/browse/TRACING-6646. Known issues: * None

Red Hat OpenShift Data Foundation 4.22.3 security, enhancement & bug fix update FIXED BUGS: ========== DFBUGS-10056: [Backport to odf-4.22.z] [IBM_Support]Capturing the db dump is failing in ODF 4.19 DFBUGS-9935: [ODF 4.22.z] ODF Upgrade fails when client operator completes upgrade before ocs-operator DFBUGS-9720: [Backport to odf-4.22.3] [RDR] odf dr validate application validation failes when there are more the one pair for RDR cluster DFBUGS-9561: [Fusion-Access MDR] With multiple apps(managed+disapp) there can be a race flip global vgr to secondary during cleanup DFBUGS-9401: on TNF - mon-c svc created with the wrong label selector during installation DFBUGS-9376: [Fusion-Access MDR][CNSA]: CNSA controller memory limit incorrectly reconciled to 400Mi by odf-operator DFBUGS-9015: [Backport to odf-4.22.z] [GSS] PVPool pod failing to start while nooba operator is scaled up DFBUGS-9002: [Fusion-Access MDR]: DRPC Progression state incorrectly reports "Completed" after failover while applications remain active on primary site (C1) DFBUGS-8993: [Fusion-Access MDR][Tracker-CNSA-11777]: collectFsRecoveryData.sh script collects all filesystem resources instead of target filesystem, causing risk of overwriting existing C2 configurations DFBUGS-8904: [Rook] Operator fails trying to mute a non existent - AUTH_INSECURE_SERVICE_KEY_TYPE error. DFBUGS-8878: [FusionAccess-MDR]: Add LUN group creation failing on secondary (c2) cluster due to missing devicefinder configmap for compute-0 DFBUGS-8860: [Fusion-Access MDR][UI]: On c2, UI incorrectly displays "Unhealthy" status for Filesystem (FS) resource when status is empty DFBUGS-8838: Update Rook toolbox to use keyring from volume mount instead of env var DFBUGS-8290: [FusionAcess-Migration] Post migration Data Foundation service is not showing in installed services list DFBUGS-8204: [Migration] After Fusion Access migration not able to create PVC using new Storageclass DFBUGS-8118: [FusionAcess-Migration]Migration tool doesn't handle case where kmm-operator is installed in NS other than ibm-fusion-access DFBUGS-6369: [DRBD UI] Correct the pre-requisite re-direct link once odf tnf docs are ready

Submariner is a Kubernetes operator that enables cross-cluster connectivity for services and pods, implementing KEP-1645 (Multi-Cluster Services API). After deploying the Submariner operator, it can enable direct networking between pods and services across different Kubernetes clusters. For more information about Submariner, see the Submariner open source community website at: https://submariner.io/.

The fluent-operator-fips package version 3.10.0-r1 addresses a medium severity vulnerability identified as CVE-2026-41178. This update fixes the vulnerability present in earlier versions of the software. No CVSS score is provided for this vulnerability.

Red Hat Advanced Cluster Management for Kubernetes versions 2.16.0 through 2.16.4 contain multiple security vulnerabilities addressed in the v2.16.4 update. This update includes security fixes, bug fixes, and updated container images to improve the security posture of the product. The vulnerabilities span a wide range of common weakness enumerations (CWEs), indicating multiple potential security issues. No known exploits in the wild have been reported for these vulnerabilities. The update is rated as important by Red Hat Product Security.