Advisory severityMedium5.5Red Hat Linux Updated

Medium [CVE-2026-100690] Arbitrary file read via symbolic link sandbox escape

This medium-severity Red Hat Linux advisory covers CVE-2026-100690; related products: Cluster Observability Operator 1.5.3, Red Hat Hardened Images, Red Hat OpenShift GitOps.

Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.

CVE-2026-100690 Source published Sep 26, 2026Source updated Sep 26, 2026

VulniPulse record published Sep 29, 2026Record updated Oct 4, 2026

CVE-2026-100690

Monitor future Red Hat Linux CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery

Get CVE alerts See app features

Summary

Arbitrary file read via symbolic link sandbox escape. Red Hat rates this moderate (CVSS 5.5).

Weakness: CWE-59. Red Hat lists fixing advisory RHSA-2026:74609 with package hugo-main-0.166.0-0.1.hum1, cluster-observability-operator/korrel8r-rhel9:1790854490.

Affected products named by the advisory: Cluster Observability Operator 1.5.3; Red Hat Hardened Images; Red Hat OpenShift GitOps.

Affected versions

161.0
165.0

Official advisory · high-confidence parse· fetched 2 days ago·verify at source

Fixed versions

hugo-main-0.166.0-0.1.hum1
cluster-observability-operator/korrel8r-rhel9:1790854490
RHSA-2026:74609

Official advisory · high-confidence parse· fetched 2 days ago·verify at source

Mitigation checklist

Recommended fix / mitigation

To mitigate this issue, implement the following operational controls: 1. Avoid processing untrusted pull requests, themes, or repository branches that execute Node.js transformation pipelines (such as PostCSS, TailwindCSS, or Babel). Builds that do not execute Node.js tools are unaffected. 2. Isolate Hugo builds inside dedicated containers or ephemeral sandboxes that have no sensitive host directories or files mounted, and run the build process with minimal privileges. Caveat: Disabling or avoiding Node.js asset transformations may prevent custom stylesheets or scripts from compiling properly, which can alter the appearance or functionality of the generated site.

Official advisory · high-confidence parse· fetched 2 days ago·verify at source

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.