Threats Tagged 'cve-2026-42264'

Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the container images for Red Hat OpenShift Container Platform 4.22.10. See the following advisory for the RPM packages for this release: https://access.redhat.com/errata/RHBA-2026:54768 Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes: https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/

Red Hat OpenShift Dev Spaces provides a cloud developer workspace server and a browser-based IDE built for teams and organizations. Dev Spaces runs in OpenShift and is well-suited for container-based development. The 3.30 release is based on Eclipse Che 7.121 and uses the DevWorkspace engine to provide support for workspaces based on devfile v2.1 and v2.2. Users still using the v1 standard should migrate as soon as possible. https://devfile.io/docs/2.2.0/migrating-to-devfile-v2 Dev Spaces supports OpenShift EUS releases v4.16 and higher. Users are expected to update to supported OpenShift releases in order to continue to get Dev Spaces updates. https://access.redhat.com/support/policy/updates/openshift#crw

Kiali 2.11.14, for Red Hat OpenShift Service Mesh 3.1, provides observability for the service mesh by offering a visual representation of the mesh topology and metrics, helping users monitor, trace, and manage efficiently. Security Fix(es): * CVE-2026-42264 openshift-service-mesh/kiali-rhel9: Axios: Prototype pollution allows information disclosure and request manipulation (OSSM-14595) * CVE-2026-42264 openshift-service-mesh/kiali-ossmc-rhel9: Axios: Prototype pollution allows information disclosure and request manipulation (OSSM-14600) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat Advanced Cluster Security for Kubernetes (RHACS) versions 4.10 up to but not including 4.11.1 have multiple security vulnerabilities and bugs addressed in the 4.11.1 update. The advisory references a collection of CVEs fixed in this release along with performance and functionality improvements. Users are advised to upgrade to RHACS 4.11.1 to benefit from these security patches and bug fixes.

A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). Central does not limit the depth of GraphQL queries served on the authenticated GraphQL API. An authenticated user with a valid API token can send deeply nested queries that cause excessive resource consumption in Central, resulting in a denial of service for the management plane.

This security update for agama-web-ui addresses multiple vulnerabilities including HTTP response header manipulation, shell command injection, and prototype pollution leading to authentication bypass and credential injection. The update also includes dependency updates reported by npm audit. No specific affected versions are stated. The severity is assessed as medium based on the described impact.

Migration Toolkit for Applications (MTA) accelerates large-scale application modernization efforts across hybrid cloud environments on Red Hat OpenShift. This solution provides insight throughout the adoption process, at both the portfolio and application levels: inventory, assess, analyze, and manage applications for faster migration to OpenShift via the user interface.