Threats Tagged 'cve-2026-85152'

Red Hat Ansible Automation Platform 2.2 includes updated Ansible plug-ins for the Red Hat Developer Hub that enhance user experience and automation capabilities. A security advisory has been issued covering multiple CVEs including CVE-2026-47686. No fixes or patches are currently provided in the advisory. The advisory does not specify affected versions or detailed vulnerability descriptions. The severity is marked critical, but no CVSS score is available.

Red Hat Ansible Automation Platform 2.1 includes updated Ansible plug-ins for the Red Hat Developer Hub that enhance the automation experience and provide curated content for users. A security advisory has been published identifying multiple CVEs including CVE-2026-47686 affecting this platform. The advisory notes new features, bug fixes, and enhancements but does not specify any fixes for the listed vulnerabilities. No patch or remediation guidance is currently provided in the vendor advisory.

Kiali 2.27.3, for Red Hat OpenShift Service Mesh 3.4, provides observability for the service mesh by offering a visual representation of the mesh topology and metrics, helping users monitor, trace, and manage efficiently. Security Fix(es): * CVE-2026-45623 openshift-service-mesh/kiali-ossmc-rhel9: PostCSS: Information disclosure and denial of service via crafted CSS input (OSSM-15115) * CVE-2026-45623 openshift-service-mesh/kiali-rhel9: PostCSS: Information disclosure and denial of service via crafted CSS input (OSSM-15110) * CVE-2026-54272 openshift-service-mesh/kiali-ossmc-rhel9: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address misclassification (OSSM-15124) * CVE-2026-54272 openshift-service-mesh/kiali-rhel9: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address misclassification (OSSM-15125) * CVE-2026-69153 openshift-service-mesh/kiali-rhel9: PostCSS: Information disclosure via crafted sourceMappingURL (OSSM-15160) * CVE-2026-69153 openshift-service-mesh/kiali-ossmc-rhel9: PostCSS: Information disclosure via crafted sourceMappingURL (OSSM-15164) * CVE-2026-69152 openshift-service-mesh/kiali-ossmc-rhel9: brace-expansion: Denial of Service via unbounded intermediate arrays (OSSM-15178) * CVE-2026-69152 openshift-service-mesh/kiali-rhel9: brace-expansion: Denial of Service via unbounded intermediate arrays (OSSM-15179) * CVE-2026-69192 openshift-service-mesh/kiali-ossmc-rhel9: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass (OSSM-15188) * CVE-2026-69192 openshift-service-mesh/kiali-rhel9: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass (OSSM-15189) * CVE-2026-14257 openshift-service-mesh/kiali-rhel9: Brace-expansion: Denial of Service via memory exhaustion in expand() function (OSSM-15194) * CVE-2026-14257 openshift-service-mesh/kiali-ossmc-rhel9: Brace-expansion: Denial of Service via memory exhaustion in expand() function (OSSM-15220) * CVE-2026-73088 openshift-service-mesh/kiali-ossmc-rhel9: Browserslist: Prototype pollution leading to denial of service (OSSM-15285) * CVE-2026-73088 openshift-service-mesh/kiali-rhel9: Browserslist: Prototype pollution leading to denial of service (OSSM-15286) * CVE-2026-73089 openshift-service-mesh/kiali-ossmc-rhel9: Browserslist: Denial of Service via unbounded memory growth from distinct query results (OSSM-15299) * CVE-2026-73089 openshift-service-mesh/kiali-rhel9: Browserslist: Denial of Service via unbounded memory growth from distinct query results (OSSM-15300) * CVE-2026-41178 openshift-service-mesh/kiali-rhel9: OpenTelemetry-Go: Denial of Service via oversized baggage headers (OSSM-15339) * CVE-2026-67321 openshift-service-mesh/kiali-ossmc-rhel9: axios: Denial of Service via object serialization bypass (OSSM-15472) * CVE-2026-67321 openshift-service-mesh/kiali-rhel9: axios: Denial of Service via object serialization bypass (OSSM-15473) * CVE-2026-67313 openshift-service-mesh/kiali-ossmc-rhel9: axios: Denial of Service via uncontrolled recursion in formDataToJSON (OSSM-15482) * CVE-2026-67313 openshift-service-mesh/kiali-rhel9: axios: Denial of Service via uncontrolled recursion in formDataToJSON (OSSM-15483) * CVE-2026-67320 openshift-service-mesh/kiali-ossmc-rhel9: axios: Information disclosure via Prototype Pollution in Node HTTP adapter (OSSM-15491) * CVE-2026-67320 openshift-service-mesh/kiali-rhel9: axios: Information disclosure via Prototype Pollution in Node HTTP adapter (OSSM-15493) * CVE-2026-67314 openshift-service-mesh/kiali-ossmc-rhel9: axios: Outbound Request Tampering via Prototype Pollution in Basic Auth (OSSM-15496) * CVE-2026-67314 openshift-service-mesh/kiali-rhel9: axios: Outbound Request Tampering via Prototype Pollution in Basic Auth (OSSM-15497) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A vulnerability in the undici HTTP client library versions 8.10.0 and 8.10.1 allows cross-origin cache poisoning due to missing origin isolation in cache and deduplication interceptors. This flaw causes cache keys to omit the destination origin, enabling an attacker controlling one origin's response to poison the cache for another trusted origin. The issue does not affect the default Agent-based dispatch path. A patch is available in version 8.10.2.

CVE-2026-84292 is a vulnerability in the node-ajv package where the fast-uri component serializes the port part of a URI without validating it. This issue is part of a set of vulnerabilities addressed in a Red Hat Hardened Images RPM security update affecting multiple Red Hat products. The vulnerability has a CVSS score of 7.5 (medium severity) and impacts integrity without affecting confidentiality or availability. A patch is available from Red Hat as part of their security advisory RHSA-2026:63782.

Red Hat has issued a security advisory for Red Hat Hardened Images RPMs, including updates to nodejs24 packages. The advisory addresses multiple vulnerabilities identified by CVE identifiers such as CVE-2026-18149 and others. The update provides bug fixes and enhancements to affected RPMs across architectures aarch64 and x86_64. A patch is available to remediate these issues.