Threats Tagged 'cve-2026-42504'

A critical command injection vulnerability exists in Red Hat Satellite 6 API (rubygem-foreman_remote_execution) allowing attackers with job template execution permissions to inject arbitrary shell commands via the effective_user parameter when it is marked overridable. This flaw affects Red Hat Satellite versions from 6.16 up to but not including 6.19.5. The vulnerability arises from improper input sanitization during job execution environment instantiation, enabling command execution on target infrastructure with execution user privileges. Red Hat has released an official patch in version 6.19.5 to address this issue.

Red Hat Satellite versions from 6.16 up to but not including 6.19.5 contain multiple critical security vulnerabilities affecting various components. These include command injection, unauthenticated information disclosure, server-side template injection, SQL injection, denial of service, cross-site scripting, and authorization bypass. The vulnerabilities enable potential arbitrary code execution, denial of service, information disclosure, and privilege escalation. Red Hat has released security updates in Satellite 6.19.5 for RHEL 9 and related versions to address these issues.

Multiple security vulnerabilities affect Red Hat OpenShift Container Platform versions including 4.12.98, 4.14, 4.15, 4.16 through 4.22.11. These include a bypass vulnerability in cri-o allowing /etc/passwd injection via the HOME environment variable (CVE-2026-15809), denial of service issues in Go language packages, privilege escalation via incorrect Punycode processing, and cross-site scripting in Go's html/template package. Red Hat has released updated RPM packages and container images to address these issues. Users are advised to upgrade to the fixed versions using the OpenShift CLI or web console.

Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the container images for Red Hat OpenShift Container Platform 4.18.55. See the following advisory for the RPM packages for this release: https://access.redhat.com/errata/RHSA-2026:66385 Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes: https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/release_notes/

The multicluster engine for Kubernetes provides the foundational components that are necessary for the centralized management of multiple Kubernetes-based clusters across data centers, public clouds, and private clouds. You can use the engine to create new Red Hat OpenShift Container Platform clusters or to bring existing Kubernetes-based clusters under management by importing them. After the clusters are managed, you can use the APIs that are provided by the engine to distribute configuration based on placement policy.

Red Hat Ansible Automation Platform 2.1 delivers an Ansible-first Red Hat Developer Hub user experience that simplifies the automation experience for Ansible users of all skill levels. The Ansible plug-ins provide curated content and features to accelerate Ansible learner onboarding and streamline Ansible use case adoption across your organization.

Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the container images for Red Hat OpenShift Container Platform 4.16.71. See the following advisory for the RPM packages for this release: https://access.redhat.com/errata/RHSA-2026:67934 Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes: https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html/release_notes/

Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.13.61. See the following advisory for the container images for this release: https://access.redhat.com/errata/RHSA-2025:18241 Security Fix(es): * golang-jwt/jwt: jwt-go allows excessive memory allocation during header parsing (CVE-2025-30204) * helm.sh/helm/v3: Helm Chart Code Execution (CVE-2025-53547) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. All OpenShift Container Platform 4.13 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.13/html-single/updating_clusters/index#updating-cluster-within-minor.

Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to individual teams, while automation developers retain the freedom to write tasks that leverage existing knowledge without the overhead. Ansible Automation Platform makes it possible for users across an organization to share, vet, and manage automation content by means of a simple, powerful, and agentless language. For details about this release, refer to the release notes listed in the References section.

Red Hat Ansible Automation Platform 2.5 for RHEL 9 contains multiple critical security vulnerabilities affecting its automation-controller and related components. These include remote code execution, privilege escalation, information disclosure, denial of service, command injection, cross-tenant data exposure, and other serious flaws. The vulnerabilities impact features such as GitPython integration, workflow job templates, credential handling, Jinja template rendering, and mesh certificate issuance. Red Hat has issued a security advisory with updates to address these issues.