Threats Tagged 'cve-2026-50151'

Red Hat multicluster global hub is a set of components that enable you to import one or more hub clusters and manage them from a single hub cluster.

yggdrasil-worker-package-manager is a simple package manager yggd worker. It knows how to install and remove packages, add, remove, enable and disable repositories, and does rudimentary detection of the host it is running on to guess the package manager to use. It only installs packages that match one of the provided allow-pattern regular expressions. Security Fix(es): * golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat issued a security advisory for Multicluster Global Hub 1.8.2 addressing a high severity vulnerability identified as CVE-2026-17106. The vulnerability affects the component that manages multiple hub clusters from a single hub cluster. The advisory also includes updates to Red Hat Hardened Images RPMs, specifically podman packages. A fix is available in updated packages including podman-6.0.2-2.2.hum1. No CVSS score is provided. The advisory provides instructions for applying the update.

Red Hat Advanced Cluster Management for Kubernetes provides the capabilities to address common challenges that administrators and site reliability engineers face as they work across a range of public and private cloud environments. Clusters and applications are all visible and managed from a single console—with security policy built in. This advisory contains the container images for Red Hat Advanced Cluster Management for Kubernetes, which add new features and enhancements, bug fixes, and updated container images. See the following Release Notes documentation, which will be updated shortly for this release, for additional details about this release: https://docs.redhat.com/en/documentation/red_hat_advanced_cluster_management_for_kubernetes/2.11/html-single/release_notes/index#acm-release-notes

grpc-gateway version 2.28.0 contains an incorrect access control vulnerability involving the processing of the X-HTTP-Method-Override header in ServeMux.ServeHTTP. The application does not properly restrict allowed HTTP methods, which can lead to unintended method overrides when handling POST requests with Content-Type application/x-www-form-urlencoded. This vulnerability is assigned CVE-2026-37236 and is rated medium severity. No patch or CVSS score is currently available, and no known exploits have been reported in the wild.

This security update for Helm addresses multiple vulnerabilities across several dependencies, including grpc-gateway, OpenTelemetry baggage parsing, oras-go registry authentication, and grpc-go components. The issues range from HTTP method override bypasses, denial of service via oversized inputs or crashes, credential exfiltration risks, to authorization bypasses and memory exhaustion. The update consolidates fixes into Helm version 3.21.1.

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, registry/remote/repository.go in blobStore.completePushAfterInitialPost follows a registry-controlled Location header during monolithic blob upload and reuses the Authorization header from the initial POST request for the subsequent PUT request, allowing a malicious registry to return a cross-host Location and receive the caller's credentials at an attacker-controlled endpoint. This issue is fixed in version 2.6.1.

Multiple security issues have been addressed in the trivy-0.72.0-2.1 package for openSUSE Tumbleweed. These vulnerabilities are fixed in this package version, which is available on GA media. The issues have a medium severity level and no known exploits in the wild have been reported.

These are all security issues fixed in the trivy-0.72.0-2.1 package on the GA media of openSUSE Tumbleweed.

VolSync v0.15 is a Kubernetes operator that enables asynchronous replication of persistent volumes within a cluster, or across clusters. After deploying the VolSync operator, it can create and maintain copies of your persistent data. For more information about VolSync, see: https://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.16/html/business_continuity/business-cont-overview#volsync or the VolSync open source community website at: https://volsync.readthedocs.io/en/stable/.