Threats Tagged 'cve-2026-75838'

This update includes the following RPMs: grafana13.2: * grafana13.2-13.2.1-0.7.hum1 (aarch64, x86_64) * grafana13.2-13.2.1-0.7.hum1.src (src) Security Fix(es): grafana13.2: * CVE-2026-93450 * CVE-2026-86472 * CVE-2026-93981 * CVE-2026-75838

Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to individual teams, while automation developers retain the freedom to write tasks that leverage existing knowledge without the overhead. Ansible Automation Platform makes it possible for users across an organization to share, vet, and manage automation content by means of a simple, powerful, and agentless language. Security Fix(es): * automation-controller: GitPython: Remote Code Execution via Git directory impersonation (CVE-2026-87817) * automation-controller: Job template enumeration via unauthenticated Bitbucket webhook oracle (CVE-2026-84717) * automation-controller: Command argument injection via SystemJob extra_vars (CVE-2026-84724) * automation-controller: Masked credential data disclosure via workflow job node artifact search (CVE-2026-84720) * automation-controller: Instance-group privilege escalation via workflow job template copy (CVE-2026-84719) * automation-controller: Audit log falsification via unrestricted X-Forwarded-For trust (CVE-2026-84718) * automation-controller: Mesh certificate issuance for arbitrary hostnames via install bundle (CVE-2026-84716) * automation-controller: Template injection via sanitize_jinja regex bypass (CVE-2026-84714) * automation-controller: Automation mesh topology disclosure via unauthenticated ping endpoint (CVE-2026-84712) * automation-controller: Arbitrary file read via Project scm_branch git argument injection (CVE-2026-84711) * automation-controller: Denial of service via credential type injector Jinja rendering (CVE-2026-84709) * automation-controller: Control-plane secret exposure via container group pod spec override (CVE-2026-84708) * automation-controller: Unauthorized job output disclosure via host filter query traversal (CVE-2026-84707) * automation-controller: Code execution via credential type environment-injector blocklist bypass (CVE-2026-84706) * automation-controller: Cross-tenant credential exposure via execution environment binding (CVE-2026-84703) * automation-controller: Cross-tenant execution privilege bypass via workflow job template node patch (CVE-2026-84692) * automation-controller: Secret key and database credential disclosure via format-string injection (CVE-2026-84691) * automation-controller: Cross-tenant job hijack via Bulk Job Launch node reference (CVE-2026-84689) * automation-controller: Credential token disclosure via notification template type-switch replay (CVE-2026-84686) * automation-controller: Privilege escalation via constructed inventory attachment (CVE-2026-84684) * automation-controller: Stored cross-site scripting via ANSI hyperlink sequence in job output (CVE-2026-84683) * automation-controller: Credential-use privilege escalation via organization Galaxy credential attachment (CVE-2026-84680) * automation-controller: Arbitrary environment variable injection via AWX_TASK_ENV setting (CVE-2026-84679) * automation-controller: Server-side request forgery via Thycotic Secret Server credential test (CVE-2026-84644) * automation-controller: Cross-organization credential exposure via Project signature-validation binding (CVE-2026-84643) * automation-controller: Instance-group privilege escalation via Schedule and workflow node attachment (CVE-2026-84638) * automation-controller: Remote code execution via Project scm_url git argument injection (CVE-2026-84502) * automation-controller: Survey password disclosure via validation error message (CVE-2026-84499) * automation-controller: Unauthenticated scheduler-trigger endpoint exposure (regression) (CVE-2026-84486) * automation-controller: Privilege escalation via provisioning-callback host-match bypass (CVE-2026-84474) * automation-controller: Instance-group privilege escalation via Bulk Job Launch permission check (CVE-2026-84470) * automation-controller: GitPython: Arbitrary file read via TagReference.create() (CVE-2026-78679) * automation-controller: awx: Privilege escalation to OpenShift namespace via pod_spec_override injection in container groups (CVE-2026-75884) * automation-controller: Command-line argument injection via ad hoc command limit field (CVE-2026-71465) * automation-controller: Git argument-injection guard bypass via Schedule scm_branch prompt (CVE-2026-71464) * automation-controller: Stack trace disclosure via notification-template Jinja whitelist bypass (CVE-2026-71463) * automation-controller: Filesystem path-existence oracle via CUSTOM_VENV_PATHS validation (CVE-2026-71462) * automation-controller: Cross-tenant job event data exposure via missing RBAC check (CVE-2026-71459) * automation-controller: Cross-tenant resource enumeration via Named-URL 404 response oracle (CVE-2026-71458) * automation-controller: Unrestricted subscription and license information disclosure (CVE-2026-71460) * automation-controller: GitPython: Command Injection via Git option

A cross-site scripting (XSS) vulnerability (CVE-2026-75838) was found in DOMPurify used by Red Hat Hardened Images RPMs, specifically in the grafana13.2 package. The flaw occurs during IN_PLACE sanitization when element-removal hooks fail to neutralize detached subtrees, allowing execution of malicious scripts via specially crafted HTML with event handlers. This vulnerability requires a non-default DOMPurify configuration with an element-removal hook and user interaction with malicious content. The vulnerability can lead to unauthorized script execution, potentially causing information disclosure or unauthorized actions. Red Hat has released updated RPMs including grafana13.2-13.2.1-0.6.hum1 to address this issue. Mitigation involves avoiding the use of DOMPurify with custom IN_PLACE sanitization configurations that include element-removal hooks; default configurations are not affected.

This update includes the following RPMs: grafana13.2: * grafana13.2-13.2.1-0.4.hum1 (aarch64, x86_64) * grafana13.2-13.2.1-0.4.hum1.src (src) Security Fix(es): grafana13.2: * CVE-2026-90771

Red Hat Ansible Automation Platform 2.2 delivers the Ansible Automation Portal as a bootable container (bootc) image. The image provides a self-contained automation portal with pre-configured services, dynamic plugins, and support for air-gapped deployments.

Red Hat Ansible Automation Platform 2.2 delivers an Ansible-first Red Hat Developer Hub user experience that simplifies the automation experience for Ansible users of all skill levels. The Ansible plug-ins provide curated content and features to accelerate Ansible learner onboarding and streamline Ansible use case adoption across your organization.

DOMPurify versions before 3.4.13 contain a cross-site scripting (XSS) vulnerability in the IN_PLACE sanitization method. The vulnerability arises because element-removal hooks fail to neutralize detached subtrees, allowing attackers to inject HTML with event handlers on descendant elements that execute after sanitization. This occurs even though the returned root element appears clean after sanitization.

This update includes the following RPMs: golang1.26: * golang1.26-1.26.6-0.1.hum1 (aarch64, x86_64) * golang1.26-bin-1.26.6-0.1.hum1 (aarch64, x86_64) * golang1.26-docs-1.26.6-0.1.hum1 (noarch) * golang1.26-misc-1.26.6-0.1.hum1 (noarch) * golang1.26-src-1.26.6-0.1.hum1 (noarch) * golang1.26-tests-1.26.6-0.1.hum1 (noarch) * golang1.26-1.26.6-0.1.hum1.src (src)

This update includes the following RPMs: grafana13.1: * grafana13.1-13.1.1-0.3.hum1 (aarch64, x86_64) * grafana13.1-13.1.1-0.3.hum1.src (src) Security Fix(es): grafana13.1: * CVE-2026-67213 * CVE-2026-67214