Threats Tagged 'cve-2026-48491'

Red Hat OpenShift Dev Spaces provides a cloud developer workspace server and a browser-based IDE built for teams and organizations. Dev Spaces runs in OpenShift and is well-suited for container-based development. The 3.30 release is based on Eclipse Che 7.121 and uses the DevWorkspace engine to provide support for workspaces based on devfile v2.1 and v2.2. Users still using the v1 standard should migrate as soon as possible. https://devfile.io/docs/2.2.0/migrating-to-devfile-v2 Dev Spaces supports OpenShift EUS releases v4.16 and higher. Users are expected to update to supported OpenShift releases in order to continue to get Dev Spaces updates. https://access.redhat.com/support/policy/updates/openshift#crw

A high severity vulnerability in Traefik's domain-fronting protection (SNICheck) allows an unauthenticated client to bypass mutual TLS enforcement when wildcard TLSOptions are used. The issue arises because SNICheck resolves TLS options for HTTP Host headers using exact matches only, ignoring wildcard mappings. This enables an attacker to complete a TLS handshake under permissive options and then send an HTTP Host header targeting a wildcard-protected backend, bypassing client certificate requirements. The vulnerability affects HTTPS and HTTP/2 traffic and does not require HTTP/3. A fix is available in Traefik version 3.7.3 and later.