High [CVE-2026-48995] Supply chain compromise from unverified dependencies
This high-severity Red Hat Linux advisory covers CVE-2026-48995 affecting Red Hat Build of Keycloak.
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
pnpm is a package manager. Prior to 10.33.4 and 11.0.7, a malicious codeload.github.com server can serve whatever tarball it wants and pnpm will install it regardless of the lockfile.
The lockfile does not store the hash of the dependencies from. This means that if this server was compromised or a person's machine configuration was compromised, pnpm would download and install these dependencies.
This vulnerability is fixed in 10.33.4 and 11.0.7. This vulnerability allows a remote attacker to serve malicious software packages if the `codeload.github.com` server is compromised or a user's machine configuration is tampered with.
This could lead to the installation of unverified and potentially malicious code, resulting in arbitrary code execution on the affected system. This Important vulnerability in pnpm, as shipped in Red Hat products, exposes users to supply chain attacks by failing to verify the integrity of dependencies sourced from `codeload.github.com`.
This risk is heightened in environments where developers rely on GitHub git dependencies without additional integrity checks. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).
Weakness: CWE-494. Affected Red Hat products: Red Hat Build of Keycloak.
- < 10.33.4
- < 11.0.7
Official advisory · high-confidence parse· fetched 14 days ago·verify at source
- 10.33.4
- 11.0.7
Official advisory · high-confidence parse· fetched 14 days ago·verify at source
Mitigation
Upgrade to a fixed release: 10.33.4, 11.0.7. That is the remediation for this advisory.
The vendor advisory may list additional interim mitigations or workarounds not captured here — review it before change work.
Official advisory · high-confidence parse· fetched 14 days ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.