Red Hat Linux Security Advisories & CVEs
5946 advisories tracked · Red Hat Security Data API · direct feeds checked every minute; rate-limited backstops use a safe source cadence
Android app · Google Play
Monitor Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Security advisories for your Red Hat release
Pick your distribution release to see every advisory issued for it and its severity mix. Fixes ship as errata — keep the system patched. This is the release's advisory history, not a per-package scan.
Official source
Red Hat Security Data API
Red Hat Enterprise Linux errata (RHSA) via the official Red Hat Security Data API — CVE severity, CVSS and affected packages. A credential-free official source.
Latest Red Hat advisories
Medium [CVE-2026-67315] NO_PROXY bypass allows exposure of local services
axios versions 0.31.0 before 0.33.0 and 1.15.0 before 1.18.0 fail to recognize 0.0.0.0 as a loopback address in shouldBypassProxy.js, allowing requests to 0.0.0.0 to bypass NO_PROXY rules. Attackers can supply 0.0.0.0 URLs to route requests through configured proxies, potentially exposing local services when the proxy can reach the destination. A flaw was found in axios. This vulnerability occurs because the software fails to correctly identify 0.0.0.0 as a local loopback address when evaluating NO_PROXY rules. A remote attacker could exploit this by providing a 0.0.0.0 URL, causing requests to bypass intended proxy restrictions. This could lead to the exposure of internal services to the configured proxy, potentially allowing unauthorized access to local resources. Red Hat severity: Moderate — CVSS 5.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N). Weakness: CWE-115. Affected products named by the advisory: Red Hat Hardened Images; Migration Toolkit for Applications 8; Migration Toolkit for Containers; Multicluster Engine for Kubernetes; and 15 more.
Medium [CVE-2026-67319] Information disclosure and data manipulation via prototype pollution
axios before 0.33.0 (and 1.x before 1.18.0) can consume inherited properties from nested request option objects when the JavaScript process's Object.prototype has already been polluted by another component. While the top-level merged config uses a null prototype, nested plain objects such as auth and paramsSerializer are cloned into ordinary objects and read without own-property checks. When an application passes placeholder nested objects such as auth: {} or paramsSerializer: {}, inherited username/password values can cause silent injection of an Authorization: Basic header, and inherited encode/serialize values can alter query-string serialization (full serializer replacement requires a function-valued pollution primitive). This is exploitable only in the presence of pre-existing prototype pollution. A flaw was found in axios. When the JavaScript environment's `Object.prototype` has been previously compromised through a technique known as prototype pollution, axios can inadvertently use malicious properties from nested configuration objects. This can lead to the silent injection of unauthorized authentication headers, potentially exposing sensitive credentials. Additionally, it could allow an attacker to alter how data is formatted for requests, leading to data manipulation.
Medium [CVE-2026-67291] Denial of Service via heap out-of-bounds read
Denial of Service via heap out-of-bounds read. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-125.
Medium [CVE-2026-67303] Denial of Service via unsupported serial device control request
Denial of Service via unsupported serial device control request. Red Hat rates this moderate (CVSS 4.3). Weakness: CWE-617.
Medium [CVE-2026-67288] Denial of Service via crafted smartcard cache requests
FreeRDP before 3.29.0 contains a null pointer dereference vulnerability in smartcard cache request decoders that accept NULL NDR pointers for LookupName in SCARD_IOCTL_READCACHEA and SCARD_IOCTL_WRITECACHEA operations. When smartcard emulation is enabled, attackers can send crafted smartcard cache requests with NULL lookup-name pointers to trigger strlen() on a null pointer, causing client process termination. A flaw was found in FreeRDP. This can lead to a null pointer dereference, causing the client process to terminate and disrupting active remote desktop sessions. A Moderate denial of service flaw affects FreeRDP in Red Hat products. When smartcard emulation is enabled, a remote attacker can exploit this vulnerability by sending malformed smartcard cache requests, leading to a null pointer dereference and subsequent termination of the FreeRDP client process. This can disrupt active remote desktop sessions for affected users. Red Hat severity: Moderate — CVSS 5.3 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H). Weakness: CWE-476. Affected products named by the advisory: Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Enterprise Linux 7 Extended Lifecycle Support; Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support; Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On; and 8 more.
Medium [CVE-2026-66402] Server Identity Verification Bypass via TLS Certificate Validation Weaknesses
FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains multiple TLS certificate identity validation weaknesses in tls_verify_certificate(), tls_match_hostname(), and x509_utils_get_dns_names(). Because FreeRDP performs custom Common Name and DNS SAN string matching instead of using OpenSSL's length-aware identity validation APIs, it (1) truncates DNS SAN values at embedded NUL bytes (accepting e.g. 'victim.example\0.attacker.example' as 'victim.example'), (2) accepts a matching Common Name even when non-matching DNS SAN entries are present, and (3) accepts IP-literal targets via DNS/CN matching without comparing iPAddress SANs. Under a trusted or misissued certificate chain, an attacker positioned to present such a certificate can bypass server identity verification, weakening TLS server authentication. A flaw was found in FreeRDP. This flaw involves multiple weaknesses in how FreeRDP validates TLS (Transport Layer Security) certificates. FreeRDP's custom validation logic can incorrectly process DNS Subject Alternative Name (SAN) values, accept Common Names without proper comparison to other SAN entries, and fail to validate IP address SANs for IP-literal targets. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; and 2 more.
Medium [CVE-2026-67338] Stored cross-site scripting in Extension Manager allows arbitrary code execution
Stored cross-site scripting in Extension Manager allows arbitrary code execution. Red Hat rates this moderate (CVSS 6.1). Weakness: CWE-79. Affected products named by the advisory: Migration Toolkit for Applications 8; Red Hat OpenShift AI (RHOAI).
Medium [CVE-2026-67296] Denial of Service due to RDPEI message processing
Denial of Service due to RDPEI message processing. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-20.
Medium [CVE-2026-67304] Denial of Service via null pointer dereference in smartcard cleanup
Denial of Service via null pointer dereference in smartcard cleanup. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-476.
Medium [CVE-2026-67289] HTTP Proxy Request Injection via Redirection
FreeRDP before 3.29.0 (affected versions <= 3.28.0) does not validate CRLF and control characters in the server-controlled RDP redirection TargetNetAddress field. This value is copied into the client's ServerHostname and, when the client connects through an HTTP proxy, is written directly into the proxy CONNECT request line and Host header by http_proxy_connect() without filtering. A malicious or compromised RDP server can send a crafted redirection PDU containing embedded control characters to inject arbitrary headers/requests into the HTTP proxy CONNECT request. A flaw was found in FreeRDP. This injection could allow an attacker to manipulate the proxy's behavior or bypass certain network security policies. Moderate: This client-side vulnerability in FreeRDP allows for HTTP proxy request injection. Exploitation requires a FreeRDP client to be configured to use an HTTP proxy and to connect to a malicious or compromised RDP server, which then sends a crafted redirection PDU. This limits the attack surface to specific client configurations and interactions with untrusted RDP endpoints. Red Hat severity: Moderate — CVSS 5 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L). Weakness: CWE-93.
Medium [CVE-2026-67293] Weakens TLS server authentication due to improper wildcard certificate hostname validation
FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains an improper certificate hostname validation vulnerability. The TLS hostname matcher (tls_match_hostname() in libfreerdp/crypto/tls.c) treats a wildcard pattern such as *.example.com as matching any hostname ending in.example.com, so it incorrectly accepts a wildcard certificate for multi-label subdomains like a.b.example.com (which OpenSSL's X509_check_host() rejects). This weakens TLS server authentication under wildcard-certificate conditions. A flaw was found in FreeRDP, a free implementation of the Remote Desktop Protocol (RDP). The software's Transport Layer Security (TLS) hostname matcher incorrectly validates wildcard certificates, allowing it to accept certificates for multi-label subdomains that should not be covered. This vulnerability could enable a remote attacker to impersonate a legitimate server, potentially compromising the authenticity of the connection. This weakens the overall security of TLS server authentication. This could allow a malicious RDP server to impersonate a legitimate server if a client attempts to connect to a subdomain covered by an improperly validated wildcard certificate. Red Hat severity: Moderate — CVSS 4.2 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N). Weakness: CWE-295.
Medium [CVE-2026-67317] Denial of Service via maxBodyLength bypass with ReadableStream
axios versions 1.7.0 before 1.18.0 fail to enforce maxBodyLength for WHATWG ReadableStream request bodies in the fetch adapter when Content-Length cannot be determined. Attackers can supply unknown-length stream data to bypass upload size limits and cause uncontrolled network egress or resource exhaustion. A flaw was found in axios. This can lead to uncontrolled network egress or resource exhaustion, resulting in a Denial of Service (DoS) for the affected system. Moderate: This flaw in `axios` allows for a denial of service by bypassing `maxBodyLength` enforcement. Red Hat severity: Moderate — CVSS 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Weakness: CWE-770. Affected Red Hat products: Red Hat Hardened Images; Migration Toolkit for Applications 8; Migration Toolkit for Containers; Multicluster Engine for Kubernetes; Network Observability Operator; OpenShift Pipelines; OpenShift Service Mesh 3; Red Hat Advanced Cluster Management for Kubernetes 2; Red Hat Advanced Cluster Security 4; Red Hat Ansible Automation Platform 2; Red Hat build of Apicurio Registry 3; Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat OpenShift AI (RHOAI); Red Hat OpenShift Container Platform 4; Red Hat OpenShift Dev Spaces; Red Hat OpenShift Virtualization 4; Red Hat Quay 3; Red Hat Satellite 6; Red Hat Trusted Profile Analyzer; Self-service automation portal 2.
Medium [CVE-2026-67297] Resource exhaustion due to oversized chunked HTTP responses
Resource exhaustion due to oversized chunked HTTP responses. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-770.
Medium [CVE-2026-67301] Memory disclosure or denial of service via crafted RDP update orders
Memory disclosure or denial of service via crafted RDP update orders. Red Hat rates this moderate (CVSS 5.9). Weakness: CWE-125.
Medium [CVE-2026-67290] Denial of Service via malformed media data
Denial of Service via malformed media data. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-125.
Medium [CVE-2026-18321] Denial of Service via buffer overflow in Zyfer refclock
Buffer overflow in NTPsec's Zyfer refclock allows local attacker to crash ntpd A flaw was found in NTPsec. This could result in a denial of service (DoS), making the network time synchronization service unavailable. This flaw does not affect Red Hat Products, it only affects community projects. Red Hat severity: Low — CVSS 4.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-120.
Medium [CVE-2026-17350] pgAdmin 4: Permission bypass allows authenticated users to access restricted tools
The per-tool permission system (custom roles / role-based tool permissions, introduced in pgAdmin 4 9.3) did not enforce its permission check consistently. In SERVER mode, pgAdmin 4 gates each tool behind a per-tool Flask-Security permission, but the permission decorator (permissions_required) was applied only to a single "front door" route per tool. Every other backend route and Socket.IO handler in that tool's workflow relied solely on pga_login_required/socket_login_required, which check authentication but not the tool permission. The reporter verified three cases against a test build: (1) a user without tools_query_tool permission received 403 on the protected sqleditor initialization route, but the same session went on to connect the server, initialize the viewdata backend chain, and retrieve real table row content; (2) a user without tools_grant_wizard received 403 on the protected acl route, but the same session still enumerated grantable objects, generated GRANT SQL, and successfully applied it -- confirmed database-side via has_table_privilege(); (3) a user without tools_schema_diff received 403 on the protected panel route, but the same session initialized schema diff, enumerated and connected databases, and obtained real DDL differences via the compare_database Socket.IO handler.
Medium [CVE-2026-17348] pgAdmin 4: Unauthenticated access allows data manipulation and information disclosure
In SERVER mode, pgAdmin 4 enforces authentication per route via the @pga_login_required decorator; the application's before_request hook only handles desktop-mode auto-login and the Kerberos/Webserver-auth redirect, so any route shipped without the decorator is reachable without authentication (CWE-306). This is the same defect class previously fixed as CVE-2026-12046 (the sqleditor close/update_connection routes). A follow-up sweep, prompted by a report describing an incomplete fix for CVE-2026-12046, found further routes missing @pga_login_required: the Constraints blueprint's nodes and proplist (object listing) routes and its delete route (a state-mutating DELETE that removes table constraints); preferences.get_all_cli (GET, discloses all CLI-settable preference values); debugger.close (DELETE); and schema_diff.close (DELETE). An unauthenticated network client could therefore enumerate constraint metadata, delete table constraints, read preference values, and force-close debugger or schema-diff sessions belonging to other users, without ever authenticating. Fix adds the missing @pga_login_required decorator (and the corresponding import to the Constraints module) to each of these routes. The change is decorator-only; no behavioral changes to the underlying handlers. A flaw was found in pgAdmin 4.
Medium [CVE-2026-18214] Google external access-token exchange bypasses hosted-domain restriction
Keycloak allows users to log in using Google accounts and can be configured to only allow users from specific Google Workspace domains. A flaw was found where the token exchange feature, which allows swapping a Google token for a Keycloak token, does not check these domain restrictions. This means an attacker with a valid Google account from a different domain could bypass the security check and gain access to the Keycloak realm. The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate, given that it requires the preview Token Exchange V1 feature to be enabled and specific client permissions to be granted. Successful exploitation allows an attacker to bypass Google hosted-domain restrictions and obtain unauthorized Keycloak tokens. The vulnerability's root cause is a missing validation check for the hosted-domain claim during the external access-token exchange process. Weakness: CWE-862. Affected Red Hat products: Red Hat build of Keycloak 26.6; Red Hat build of Keycloak 26.6.7. Red Hat lists Red Hat Data Grid 8; Red Hat JBoss Enterprise Application Platform Expansion Pack; Red Hat Single Sign-On 7 as not affected. Red Hat fixing advisory: RHSA-2026:68277, RHSA-2026:68278.
Medium [CVE-2026-18203] Group policy extendChildren matches sibling group path prefixes
A flaw was found in the group policy evaluation logic of Keycloak, an identity and access management solution. When a group policy is set to extend permissions to child groups, the system incorrectly uses a simple text-based prefix check to verify group membership. This allows a user who belongs to a different group with a similar starting name to bypass security checks and gain unauthorized access to administrative functions or protected resources. The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate, given that exploitation requires a specific group naming collision and the extendChildren policy setting to be active. Successful exploitation allows an attacker to gain unauthorized integrity-impacting permissions within the realm. The vulnerability's root cause is an improper string prefix comparison during group path validation in the authorization services. Weakness: CWE-863. Affected Red Hat products: Red Hat Build of Keycloak. Red Hat lists Red Hat Data Grid 8; Red Hat JBoss Enterprise Application Platform Expansion Pack; Red Hat Single Sign-On 7 as not affected. Red Hat does not currently list a fixing RHSA for this CVE.