Threats Tagged 'cve-2026-84292'

Red Hat Developer Hub (RHDH) versions prior to 1.9.9 contain a security vulnerability identified as CVE-2026-19534. Red Hat Developer Hub is an enterprise-grade, self-managed developer portal based on Backstage.io, supported on Kubernetes platforms including OpenShift. The advisory references a fix in version 1.9.9 that addresses this and other issues. No CVSS score is provided for this vulnerability.

Red Hat Satellite is a system management solution that allows organizations to configure and maintain their systems without the necessity to provide public Internet access to their servers or other client systems. It performs provisioning and configuration management of predefined standard operating environments. Security Fix(es): * rubygem-foreman_remote_execution: command injection in job invocations via effective_user parameter (CVE-2026-12405) * foreman: unauthenticated information disclosure via provisioning token validation flaw (CVE-2026-12423) * foreman: command injection in foreman-rake errors:fetch_log via request_id parameter (CVE-2026-12540) * foreman: command injection in foreman-rake database tasks (CVE-2026-12541) * foreman: command injection in foreman-tail (CVE-2026-12542) * foreman: SSTI and insecure deserialization in foreman-rake configuration (CVE-2026-12544) * rubygem-hammer_cli: command injection via insecure editor invocation (CVE-2026-12545) * python3.12-dynaconf: Dynaconf: Arbitrary code execution via Server-Side Template Injection (CVE-2026-33154) * yggdrasil-worker-forwarder: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818) * yggdrasil-worker-forwarder: Golang MIME: Denial of Service via maliciously-crafted MIME header (CVE-2026-42504) * nodejs-sanitize-html: PostCSS: Information disclosure and denial of service via crafted CSS input (CVE-2026-45623) * python-sqlparse: sqlparse: Denial of Service via quadratic CPU consumption in SQL parsing (CVE-2026-54284) * python3.12-sqlparse: sqlparse: Denial of Service via quadratic CPU consumption in SQL parsing (CVE-2026-54284) * rubygem-katello: SQL injection in Registry Proxy via labels (CVE-2026-56097) * rubygem-katello: improper authorization logic allows resource enumeration (CVE-2026-56098) * yggdrasil-worker-forwarder: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858) * yggdrasil-worker-forwarder: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860) * yggdrasil-worker-forwarder: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862) * nodejs-connected-react-router: Immutable.js: Denial of Service due to mishandling of large index values in List operations (CVE-2026-59879) * nodejs-sass: Immutable.js: Denial of Service due to mishandling of large index values in List operations (CVE-2026-59879) * python-sqlparse: sqlparse: Denial of Service via inefficient SQL parsing (CVE-2026-59893) * python3.12-sqlparse: sqlparse: Denial of Service via inefficient SQL parsing (CVE-2026-59893) * python-sqlparse: sqlparse: Denial of Service via quadratic CPU consumption in comment grouping (CVE-2026-71491) * python3.12-sqlparse: sqlparse: Denial of Service via quadratic CPU consumption in comment grouping (CVE-2026-71491) * nodejs-css-loader: nanoid: Predictable ID generation due to integer overflow (CVE-2026-73086) * nodejs-sanitize-html: nanoid: Predictable ID generation due to integer overflow (CVE-2026-73086) * nodejs-compression-webpack-plugin: fast-uri: Server-Side Request Forgery via repeated hostname percent-decoding (CVE-2026-75899) * nodejs-mini-css-extract-plugin: fast-uri: Server-Side Request Forgery via repeated hostname percent-decoding (CVE-2026-75899) * nodejs-webpack: fast-uri: Server-Side Request Forgery via repeated hostname percent-decoding (CVE-2026-75899) * nodejs-compression-webpack-plugin: fast-uri: Host confusion via skipped IDN canonicalization (CVE-2026-75931) * nodejs-mini-css-extract-plugin: fast-uri: Host confusion via skipped IDN canonicalization (CVE-2026-75931) * nodejs-webpack: fast-uri: Host confusion via skipped IDN canonicalization (CVE-2026-75931) * nodejs-compression-webpack-plugin: fast-uri: Server-side request forgery via malformed IPv6 normalization (CVE-2026-75975) * nodejs-mini-css-extract-plugin: fast-uri: Server-side request forgery via malformed IPv6 normalization (CVE-2026-75975) * nodejs-webpack: fast-uri: Server-side request forgery via malformed IPv6 normalization (CVE-2026-75975) * python3.12-gitpython: GitPython: Arbitrary file read via TagReference.create() (CVE-2026-78679) * rubygem-katello: Katello Content View History API Cross-Organization Authorization Bypass (CVE-2026-79654) * nodejs-compression-webpack-plugin: fast-uri: Authority Injection via Unvalidated Port Serialization (CVE-2026-84292) * nodejs-mini-css-extract-plugin: fast-uri: Authority Injection via Unvalidated Port Serialization (CVE-2026-84292) * nodejs-webpack: fast-uri: Authority Injection via Unvalidated Port Serialization (CVE-2026-84292) * nodejs-compression-webpack-plugin: fast-uri: Host confusion via unbalanced URI brackets can bypass security policies (CVE-2026-84394) * nodejs-mini-css-extract-plugin: fast-uri: Host confusion via unbalanced URI brackets can bypass security policies (CVE-2026-84394) * nodejs-webpack: fast-uri: Host confusion via unbalanced URI brackets can bypa

A security update for Red Hat Hardened Images RPMs addresses multiple vulnerabilities including CVE-2026-84292. The update affects several Red Hat products such as Red Hat Edge Manager, Red Hat OpenShift Container Platform, and Red Hat Satellite. The vulnerabilities involve issues identified by CWEs like CWE-140, CWE-1289, CWE-431, CWE-346, and CWE-116. A patch is available to remediate these issues.

Red Hat OpenShift Data Foundation 4.22.3 security, enhancement & bug fix update FIXED BUGS: ========== DFBUGS-10056: [Backport to odf-4.22.z] [IBM_Support]Capturing the db dump is failing in ODF 4.19 DFBUGS-9935: [ODF 4.22.z] ODF Upgrade fails when client operator completes upgrade before ocs-operator DFBUGS-9720: [Backport to odf-4.22.3] [RDR] odf dr validate application validation failes when there are more the one pair for RDR cluster DFBUGS-9561: [Fusion-Access MDR] With multiple apps(managed+disapp) there can be a race flip global vgr to secondary during cleanup DFBUGS-9401: on TNF - mon-c svc created with the wrong label selector during installation DFBUGS-9376: [Fusion-Access MDR][CNSA]: CNSA controller memory limit incorrectly reconciled to 400Mi by odf-operator DFBUGS-9015: [Backport to odf-4.22.z] [GSS] PVPool pod failing to start while nooba operator is scaled up DFBUGS-9002: [Fusion-Access MDR]: DRPC Progression state incorrectly reports "Completed" after failover while applications remain active on primary site (C1) DFBUGS-8993: [Fusion-Access MDR][Tracker-CNSA-11777]: collectFsRecoveryData.sh script collects all filesystem resources instead of target filesystem, causing risk of overwriting existing C2 configurations DFBUGS-8904: [Rook] Operator fails trying to mute a non existent - AUTH_INSECURE_SERVICE_KEY_TYPE error. DFBUGS-8878: [FusionAccess-MDR]: Add LUN group creation failing on secondary (c2) cluster due to missing devicefinder configmap for compute-0 DFBUGS-8860: [Fusion-Access MDR][UI]: On c2, UI incorrectly displays "Unhealthy" status for Filesystem (FS) resource when status is empty DFBUGS-8838: Update Rook toolbox to use keyring from volume mount instead of env var DFBUGS-8290: [FusionAcess-Migration] Post migration Data Foundation service is not showing in installed services list DFBUGS-8204: [Migration] After Fusion Access migration not able to create PVC using new Storageclass DFBUGS-8118: [FusionAcess-Migration]Migration tool doesn't handle case where kmm-operator is installed in NS other than ibm-fusion-access DFBUGS-6369: [DRBD UI] Correct the pre-requisite re-direct link once odf tnf docs are ready

OpenShift Virtualization is Red Hat's virtualization solution designed for Red Hat OpenShift Container Platform. This advisory contains OpenShift Virtualization v4.22 images.

Red Hat Lightspeed in Satellite analyzes system health and configuration by applying predefined rules to a small set of local data, such as installed packages, running services, and configuration settings. When you install Red Hat Lightspeed in Satellite locally, you can generate Red Hat Lightspeed recommendations without sending system data to Red Hat services.

Red Hat has released a new container image for the satellite/iop-host-inventory-frontend-rhel9 component used in Red Hat Satellite. This component is part of Red Hat Lightspeed in Satellite, which analyzes system health and configuration locally without sending data to Red Hat services. Multiple CVEs including CVE-2026-59879 are associated with this advisory. A patch is available for affected versions, and users are advised to update accordingly.

Red Hat Lightspeed in Satellite analyzes system health and configuration by applying predefined rules to a small set of local data, such as installed packages, running services, and configuration settings. When you install Red Hat Lightspeed in Satellite locally, you can generate Red Hat Lightspeed recommendations without sending system data to Red Hat services.

Red Hat has announced the general availability of the satellite/iop-host-inventory-frontend-rhel9 container image for Red Hat Satellite 6.19. This container image supports Red Hat Lightspeed in Satellite, which analyzes system health and configuration locally by applying predefined rules to limited system data. This allows generating recommendations without sending data to Red Hat services. No specific fixes or patches are mentioned in the advisory.

Red Hat Edge Manager (RHEM) provides simple, scalable, and security-focused management of edge devices and applications. It supports image-mode RHEL and container workloads that run on Podman/Docker or Kubernetes. RHEM is now available as a standalone feature, providing greater flexibility for edge deployments. In addition to the standalone version, RHEM continues to be offered as a plugin for the following platforms: * Red Hat Advanced Cluster Management (RHACM): Extends fleet management to edge devices. * Red Hat Ansible Automation Platform (AAP): Integrates edge management with Ansible automation. This integration enables organizations to optimize the management and orchestration of their fleets of edge devices; whether its thousands of dispersed retail point-of-sale systems or industrial machinery on remote factory floors. Value for customers and partners: * This solution not only helps customers manage thousands of devices but helps scale operations. * To manage large-scale deployments, customers need to be able to integrate with their existing management systems, support remote configuration and over-the-air updates, and collect telemetry data for advanced analytics. * Red Hat Edge Manager offers a simple and security-focused lifecycle management, from onboarding to decommissioning of edge devices. This complete end-to-end solution empowers organizations to gain the most value from the fleets of devices that generate data, all from a centralized location.