Red Hat Linux Security Advisories & CVEs
12357 advisories tracked · Red Hat Security Data API · direct feeds checked every minute; rate-limited backstops use a safe source cadence
Android app · Google Play
Monitor Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Security advisories for your Red Hat release
Pick your distribution release to see every advisory issued for it and its severity mix. Fixes ship as errata — keep the system patched. This is the release's advisory history, not a per-package scan.
Official source
Red Hat Security Data API
Red Hat Enterprise Linux errata (RHSA) via the official Red Hat Security Data API — CVE severity, CVSS and affected packages. A credential-free official source.
Latest Red Hat advisories
Critical [CVE-2026-18963] Unauthenticated account takeover via reset-credentials flow bypass
A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials. The Red Hat Product Security team has assessed the severity of this vulnerability as Critical, given that it can be exploited by an unauthenticated remote attacker without any user interaction. Successful exploitation allows an attacker to gain full access to any user account by bypassing the email verification step in the password recovery process. The vulnerability's root cause is improper state validation within the reset-credentials authentication flow. Weakness: CWE-640. Affected Red Hat products: Red Hat build of Keycloak 26.4; Red Hat build of Keycloak 26.4.15; Red Hat build of Keycloak 26.6; Red Hat build of Keycloak 26.6.6. Red Hat lists Red Hat JBoss Enterprise Application Platform Expansion Pack; Red Hat Single Sign-On 7 as not affected. Red Hat fixing advisory: RHSA-2026:56519, RHSA-2026:56520, RHSA-2026:56524, RHSA-2026:56523.
Critical [CVE-2026-12564] Automation-controller: automation-controller: kubernetes service account token exfiltration via hashicorp vault credential ssrf
A flaw was found in the AAP Controller's HashiCorp Vault credential plugin. An authenticated attacker with credential-creation privileges can exfiltrate the service account token, gaining Kubernetes API access to the control plane namespaces with full pod CRUD and secret read permissions, including database credentials and the Django SECRET_KEY. The vulnerability is particularly impactful in AAP Cloud (managed service) environments where the Kubernetes control plane is managed by Red Hat and tenant isolation is a security boundary. On-premise deployments are also affected, though the impact is lower since the administrator already has access to the infrastructure. The vulnerable code path exists in all AAP versions that ship the hashivault credential plugin with kubernetes_role authentication support. Red Hat severity: Critical — CVSS 9.6 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N). Weakness: CWE-918. Affected Red Hat products: Red Hat Ansible Automation Platform 2. Red Hat does not currently list a fixing RHSA for this CVE.
High [CVE-2026-76038] Remote code execution via type confusion in crafted HTML.
Type confusion in V8 in Google Chrome prior to 151.0.7922.169 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) A flaw was found in V8, the open-source JavaScript engine used in Google Chrome. Exploitation occurs when a user visits a specially crafted HTML page, leading to potential compromise of the affected system. This vulnerability is rated as Important. A type confusion flaw in the V8 JavaScript engine can lead to remote code execution when processing a specially crafted HTML page. Exploitation requires user interaction, as an attacker must entice a user to visit a malicious website. This primarily impacts desktop environments and applications that render untrusted web content, such as Chromium and applications embedding QtWebEngine. Red Hat severity: Important — CVSS 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Weakness: CWE-843.
High [CVE-2026-76041] Information leak in Skia
Information leak in Skia in Google Chrome prior to 151.0.7922.169 allowed a remote attacker to potentially bypass web origin policy via a crafted HTML page. (Chromium security severity: High) An information leak flaw was found in the Skia component of the Chromium browser. Upstream bug(s): Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory. Red Hat severity: Important — CVSS 7.4 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N). Weakness: CWE-346. Affected Red Hat products: Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat package: webkitgtk4; Red Hat package: webkit2gtk3.
High [CVE-2026-76047] Arbitrary code execution via type confusion in V8
Type confusion in V8 in Google Chrome prior to 151.0.7922.169 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) A flaw was found in chromium-browser. A remote attacker could exploit a type confusion vulnerability in the V8 JavaScript engine by enticing a user to visit a specially crafted HTML page. This could allow the attacker to execute arbitrary code within the browser's sandbox, potentially compromising the user's system. Exploitation requires user interaction, specifically visiting a specially crafted HTML page, but the potential for remote code execution elevates its severity. Red Hat severity: Important — CVSS 8.3 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Weakness: CWE-843.
High [CVE-2026-76045] Arbitrary code execution via use-after-free
Use after free in WebGL in Google Chrome prior to 151.0.7922.169 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) This can be achieved by enticing a user to visit a specially crafted HTML page, leading to a high-severity security risk. This vulnerability is rated Important as it allows a remote attacker to execute arbitrary code within the browser's sandbox by enticing a user to visit a specially crafted HTML page. The use-after-free flaw in WebGL affects the Chromium browser, which is available in Red Hat Community Projects. Successful exploitation could lead to significant impact on confidentiality, integrity, and availability. Red Hat severity: Important — CVSS 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Weakness: CWE-825.
High [CVE-2026-76043] Arbitrary code execution via incorrect calculation in HTML processing
Incorrect calculation in V8 in Google Chrome prior to 151.0.7922.169 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) This could lead to arbitrary code execution within the browser's sandbox environment. Exploitation requires user interaction, where a remote attacker could entice a user to visit a specially crafted HTML page. Red Hat severity: Important — CVSS 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Weakness: CWE-190.
High [CVE-2026-76039] Information disclosure via incorrect reference resolution
Incorrect reference resolution in Core in Google Chrome on on Android prior to 151.0.7922.169 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: High) A flaw was found in Chromium, specifically in its Core component on Android. By leveraging social engineering and a specially crafted HTML page, an attacker could exploit this flaw to disclose confidential data. While exploitation requires user interaction via social engineering and a crafted HTML page, successful attacks could expose sensitive user information in Red Hat environments utilizing Chromium-based browsers. Red Hat severity: Important — CVSS 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N). Weakness: CWE-386.
High [CVE-2026-76040] Arbitrary code execution via use-after-free vulnerability
Use after free in Browser in Google Chrome on on Mac prior to 151.0.7922.169 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) This could lead to a complete compromise of the affected system. Exploitation requires social engineering to entice a user to visit a specially crafted HTML page, making user interaction a prerequisite for a successful attack. Red Hat severity: Important — CVSS 8.3 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Weakness: CWE-825.
High [CVE-2026-76037] Arbitrary Code Execution via Link Following
Link following in CredentialProvider in Google Chrome on on Windows prior to 151.0.7922.169 allowed a local attacker to potentially execute arbitrary code outside the sandbox via a local program. (Chromium security severity: High) This vulnerability affects Chromium-based browsers and applications utilizing QtWebEngine in Red Hat Community Projects. Exploitation requires user interaction, such as clicking a malicious link. Red Hat severity: Important — CVSS 8.2 (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H). Weakness: CWE-59.
High [CVE-2026-76033] Site isolation bypass due to inappropriate CORS implementation
Inappropriate implementation in CORS in Google Chrome prior to 151.0.7922.169 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: High) A flaw was found in Google Chrome's handling of Cross-Origin Resource Sharing (CORS). This could allow the attacker to bypass site isolation, a security feature designed to prevent malicious websites from accessing data from other websites, potentially leading to unauthorized data access. This could lead to unauthorized access to sensitive data from other websites, significantly undermining a core browser security boundary. Red Hat severity: Important — CVSS 8.7 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N). Weakness: CWE-653.
High [CVE-2026-76036] Dawn in Google Chrome: Arbitrary code execution via crafted HTML page
Buffer overflow in Dawn in Google Chrome on on Android prior to 151.0.7922.169 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical) This can be achieved by enticing a user to visit a specially crafted HTML page. This occurs when a user visits a specially crafted HTML page, leading to a buffer overflow. The impact is significant due to the potential for arbitrary code execution, even though user interaction is required. Red Hat severity: Important — CVSS 8.3 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Weakness: CWE-120.
High [CVE-2026-15571] Predictable account-linking hash enables account takeover via malicious OIDC client
A flaw was found in the legacy client-initiated account-linking endpoint of Keycloak, a widely used open-source identity and access management solution. The mechanism used to protect the account-linking process from unauthorized requests relies on a hash that can be predicted by a malicious OIDC client. By tricking a user into authenticating, an attacker-controlled client can forge a valid linking URL to connect the victim's account to an attacker's external identity. This results in a full account takeover, allowing the attacker to log in as the victim. The Red Hat Product Security team has assessed the severity of this vulnerability as Important, given that it enables full account takeover through a predictable security hash. Successful exploitation allows an attacker to link an unauthorized identity to a victim's account and subsequently impersonate that user across the realm. The vulnerability's root cause is the use of predictable session identifiers and client-known metadata in the construction of the account-linking CSRF protection hash. Weakness: CWE-341. Affected Red Hat products: Red Hat build of Keycloak 26.6; Red Hat build of Keycloak 26.6.6. Red Hat lists Red Hat Data Grid 8; Red Hat JBoss Enterprise Application Platform Expansion Pack; Red Hat Single Sign-On 7 as not affected. Red Hat fixing advisory: RHSA-2026:56524, RHSA-2026:56523.
High [CVE-2026-17106] Arbitrary file write via link following in tar extraction
The tar extraction routines in moby/go-archive (Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers) do not confine filesystem operations to the destination directory. The extractor decides where each archive entry lands using lexical string checks and then performs the filesystem operation on a path that is resolved by the OS, so links introduced by the archive can be followed out of the destination directory. An attacker who controls the contents of an archive can create or overwrite files at arbitrary paths writable by the extracting process. This could lead to unauthorized modification of system files or potentially arbitrary code execution. This Important severity vulnerability in `moby/go-archive` allows for arbitrary file writes during tar extraction. An attacker providing a specially crafted tar archive can exploit symlink following to create or overwrite files outside the intended directory, potentially leading to system compromise in environments processing untrusted archives, such as container build systems. Red Hat severity: Important — CVSS 7.8 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Weakness: CWE-59. Affected products named by the advisory: Red Hat Enterprise Linux 10; Logging Subsystem for Red Hat OpenShift 6.6; Multicluster Global Hub 1.8.2; Red Hat Advanced Cluster Management for Kubernetes 2.17; and 18 more.
High [CVE-2026-54552] Incomplete privilege drop allows child processes to retain privileged group access.
sh provides Python process launching. Prior to 2.2.4, the _uid option in sh.py performs an incomplete privilege drop on Linux and Unix-like systems. When sh runs from an elevated process and launches a command with _uid set to an unprivileged user, the child changes its UID but can retain the parent process's supplementary groups because the privilege-drop sequence does not fully establish the target user's UID, primary GID, and supplementary groups. The child can therefore retain access to files or resources granted to privileged groups such as root, docker, disk, shadow, or sudo, violating the expected _uid privilege boundary. This issue is fixed in version 2.2.4. This incomplete privilege drop can allow the child process to retain access to files or resources granted to privileged groups, leading to unauthorized access and potential privilege escalation. Red Hat severity: Important — CVSS 7.9 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N). Weakness: CWE-273. Red Hat lists Red Hat OpenShift Virtualization 4 as not affected.
High [CVE-2026-75924] Hub addon-manager ClusterRole grants cluster-wide Secret read/write and CSR approval
A flaw was found in managed-serviceaccount. A compromised addon-manager pod, due to its ClusterRole granting excessive permissions, can read any secret across all namespaces. Additionally, it can approve arbitrary Certificate Signing Requests (CSRs), which could lead to information disclosure and privilege escalation within the cluster. This vulnerability is rated Important as a compromised `addon-manager` pod in Red Hat Advanced Cluster Management for Kubernetes could gain extensive cluster-wide privileges. Red Hat severity: Important — CVSS 8.7 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N). Weakness: CWE-269. Red Hat lists Multicluster Engine for Kubernetes; Red Hat Advanced Cluster Management for Kubernetes 2 as not affected.
High [CVE-2026-71365] webhook status callback SSRF leaks the Git PAT
A server-side request forgery (SSRF) vulnerability was found in AWX's webhook status callback mechanism. When processing GitHub pull request webhooks, AWX extracts the status callback URL (pull_request.statuses_url) from the incoming webhook payload without validating the target host against the expected Git provider. This URL is persisted in job extra variables and later used to send authenticated status updates. A user with admin role on a webhook-enabled job template can read the template's webhook signing key, forge a signed GitHub webhook payload with an arbitrary statuses_url, and cause AWX to POST status updates to an attacker-controlled or internal URL. The status update request includes the configured Git Personal Access Token (PAT) in the Authorization header, resulting in credential leakage to the attacker-specified endpoint. Red Hat has assessed this vulnerability as Important impact. The webhook status callback code in AWX does not validate the target URL host before sending authenticated status updates, allowing a job template administrator to redirect status callbacks to arbitrary endpoints and exfiltrate the configured Git PAT credential.
High [CVE-2026-66793] arbitrary container image override via ManagedClusterAddOn annotation enables RCE on spoke
A flaw was found in the governance-policy-addon-controller component of Red Hat Advanced Cluster Management for Kubernetes. A user with permissions to annotate the namespaced ManagedClusterAddOn resource can override the governance-policy container image. This allows an attacker to run a controlled image with cluster-admin privileges on the managed cluster, leading to arbitrary code execution and privilege escalation. This Critical vulnerability in Red Hat Advanced Cluster Management for Kubernetes enables remote code execution on managed clusters. Red Hat severity: Important — CVSS 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Weakness: CWE-20. Red Hat fixing advisory: RHSA-2026:60387, RHSA-2026:60390, RHSA-2026:60388, RHSA-2026:60389, RHSA-2026:60391, RHSA-2026:60386. Affected products named by the advisory: Red Hat Advanced Cluster Management for Kubernetes 2.11; Red Hat Advanced Cluster Management for Kubernetes 2.13; Red Hat Advanced Cluster Management for Kubernetes 2.14; Red Hat Advanced Cluster Management for Kubernetes 2.15; and 2 more. Affected products named by the advisory: Red Hat Advanced Cluster Management for Kubernetes 2.16; Red Hat Advanced Cluster Management for Kubernetes 2.17.
High [CVE-2026-63639] Remote code execution via use-after-free in stream deserialization
Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's RESTORE command accepts a malformed RDB stream payload that assigns one Pending Entry List NACK to multiple consumers during stream consumer-group deserialization, causing a use-after-free when one consumer is deleted while another still references the shared NACK and potentially allowing remote code execution. This issue is fixed in versions 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1. This occurs when a malformed data stream is processed during stream deserialization, causing a shared resource to be improperly managed. If successfully exploited, this flaw could lead to remote code execution. Red Hat severity: Important — CVSS 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Weakness: CWE-825. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Enterprise Linux 9; Red Hat Hardened Images. Red Hat fixing advisory: RHSA-2026:64796, RHSA-2026:68601, RHSA-2026:64807, RHSA-2026:61884. Affected products named by the advisory: Red Hat package: valkey.
High [CVE-2026-56684] Remote code execution via TLS pending-data processing use-after-free
Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's tlsProcessPendingData function iterates pending_list while an authenticated client can trigger CLIENT KILL, causing connTLSClose to delete the iterator's cached next node and producing a use-after-free that can crash the server or potentially allow remote code execution when TLS is enabled. This issue is fixed in versions 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1. A flaw was found in Valkey. This flaw, when Transport Layer Security (TLS) is enabled, may result in a server crash or potentially allow a remote attacker to achieve arbitrary code execution. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Weakness: CWE-825. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Enterprise Linux 9; Red Hat Hardened Images. Red Hat fixing advisory: RHSA-2026:64796, RHSA-2026:68601, RHSA-2026:64807, RHSA-2026:61884. Affected products named by the advisory: Red Hat package: valkey.