Threats Tagged 'cve-2026-48526'

The RHTAS Model Transparency CLI image can be used to sign and verify AI/ML workloads

Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to individual teams, while automation developers retain the freedom to write tasks that leverage existing knowledge without the overhead. Ansible Automation Platform makes it possible for users across an organization to share, vet, and manage automation content by means of a simple, powerful, and agentless language. Security Fix(es): * automation-controller: PyJWT: Authentication bypass due to forged JSON Web Tokens (CVE-2026-48526) * automation-eda-controller: ExternalEventStreamViewSet trusts Subject header without validation and leaks expected DN (CVE-2026-12383) * automation-eda-controller: Authentication bypass in Event-Driven Ansible via forged HTTP header (CVE-2026-18141) * automation-gateway-proxy: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811) * python3.12-aiohttp: Arbitrary code execution via untrusted input to CookieJar.load() (CVE-2026-34993) * python3.12-daphne: daphne: Denial of Service via excessive WebSocket message size (CVE-2026-44545) * python3.12-pillow: Denial of Service via crafted GD 2.x image file (CVE-2026-55380) * python3.12-pillow: Denial of Service via crafted BDF font file (CVE-2026-55379) * python3.12-pillow: Denial of Service via excessive memory allocation when processing font files (CVE-2026-54060) * python3.12-pillow: Denial of Service via crafted PCF font data (CVE-2026-54059) * python3.12-pillow: Native heap out-of-bounds write (CVE-2026-59197) * python3.12-pyasn1: Denial of Service via crafted ASN.1 REAL values (CVE-2026-59886) * python3.12-pyasn1: Denial of Service via crafted ASN.1 OBJECT IDENTIFIER (CVE-2026-59885) * receptor: quic-go: Denial of Service via excessive memory allocation in HTTP/3 trailers (CVE-2026-40898) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details about this release, refer to the release notes listed in the References section.

Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to individual teams, while automation developers retain the freedom to write tasks that leverage existing knowledge without the overhead. Ansible Automation Platform makes it possible for users across an organization to share, vet, and manage automation content by means of a simple, powerful, and agentless language. Security Fix(es): * automation-controller: PyJWT: Authentication bypass due to forged JSON Web Tokens (CVE-2026-48526) * automation-eda-controller: ExternalEventStreamViewSet trusts Subject header without validation and leaks expected DN (CVE-2026-12383) * automation-gateway-proxy: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811) * python3.12-aiohttp: Arbitrary code execution via untrusted input to CookieJar.load() (CVE-2026-34993) * python3.12-daphne: daphne: Denial of Service via excessive WebSocket message size (CVE-2026-44545) * python3.12-pillow: Denial of Service via crafted PCF font data (CVE-2026-54059) * python3.12-pillow: Denial of Service via excessive memory allocation when processing font files (CVE-2026-54060) * python3.12-pillow: Denial of Service via crafted BDF font file (CVE-2026-55379) * python3.12-pillow: Denial of Service via crafted GD 2.x image file (CVE-2026-55380) * python3.12-pillow: Native heap out-of-bounds write (CVE-2026-59197) * python3.12-pyasn1: Denial of Service via crafted ASN.1 REAL values (CVE-2026-59885) * python3.12-pyasn1: Denial of Service via crafted ASN.1 OBJECT IDENTIFIER (CVE-2026-59886) * receptor: quic-go: Denial of Service via excessive memory allocation in HTTP/3 trailers (CVE-2026-40898) * receptor: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (CVE-2026-27145) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details about this release, refer to the release notes listed in the References section.

Migration Toolkit for Applications (MTA) accelerates large-scale application modernization efforts across hybrid cloud environments on Red Hat OpenShift. This solution provides insight throughout the adoption process, at both the portfolio and application levels: inventory, assess, analyze, and manage applications for faster migration to OpenShift via the user interface.

Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to individual teams, while automation developers retain the freedom to write tasks that leverage existing knowledge without the overhead. Ansible Automation Platform makes it possible for users across an organization to share, vet, and manage automation content by means of a simple, powerful, and agentless language. For details about this release, refer to the release notes listed in the References section.

Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to individual teams, while automation developers retain the freedom to write tasks that leverage existing knowledge without the overhead. Ansible Automation Platform makes it possible for users across an organization to share, vet, and manage automation content by means of a simple, powerful, and agentless language. For details about this release, refer to the release notes listed in the References section.

Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to individual teams, while automation developers retain the freedom to write tasks that leverage existing knowledge without the overhead. Ansible Automation Platform makes it possible for users across an organization to share, vet, and manage automation content by means of a simple, powerful, and agentless language. Security Fix(es): * ansible-core: argument injection in ansible-galaxy role install leads to arbitrary code execution (CVE-2026-11332) * receptor: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass (CVE-2026-27136) * receptor: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (CVE-2026-27145) * receptor: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821) For details about this release, refer to the release notes listed in the References section.

Satellite provides a container image that you can use to run an MCP server locally. The MCP server for Satellite is designed for advanced reporting and data analysis that leverages AI capabilities. You can use it to generate dynamic and comprehensive reports from your Satellite inventory.

Red Hat Satellite is a system management solution that allows organizations to configure and maintain their systems without the necessity to provide public Internet access to their servers or other client systems. It performs provisioning and configuration management of predefined standard operating environments. Security Fix(es): * candlepin: mchange-commons-java: Arbitrary code execution via JNDI dereferencing of crafted objects (CVE-2026-27727) * yggdrasil-worker-forwarder: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679) * yggdrasil-worker-forwarder: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application (CVE-2026-33810) * yggdrasil-worker-forwarder: Root.Chmod can follow symlinks out of the root (CVE-2026-32282) * yggdrasil-worker-forwarder: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280) * yggdrasil-worker-forwarder: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283) * yggdrasil-worker-forwarder: Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281) * python-pillow: Pillow: Denial of Service via decompression bomb in FITS image processing (CVE-2026-40192) * python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens (CVE-2026-48526) * foreman: foreman: Cross-tenant private SSH key disclosure via taxonomy scoping bypass (CVE-2026-5142) * foreman: Foreman: Information disclosure via improper validation of nested request parameters (CVE-2026-5138) * foreman: Foreman: Privilege escalation to administrator-level access via usergroup role assignment manipulation (CVE-2026-5136) * foreman: Foreman: Unauthorized modification of host configurations via broken access control (CVE-2026-5135)

Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to individual teams, while automation developers retain the freedom to write tasks that leverage existing knowledge without the overhead. Ansible Automation Platform makes it possible for users across an organization to share, vet, and manage automation content by means of a simple, powerful, and agentless language. For details about this release, refer to the release notes listed in the References section.