Red Hat Linux Security Advisories & CVEs
13625 advisories tracked · Red Hat Security Data API · direct feeds checked every minute; rate-limited backstops use a safe source cadence
Android app · Google Play
Monitor Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Security advisories for your Red Hat release
Pick your distribution release to see every advisory issued for it and its severity mix. Fixes ship as errata — keep the system patched. This is the release's advisory history, not a per-package scan.
Official source
Red Hat Security Data API
Red Hat Enterprise Linux errata (RHSA) via the official Red Hat Security Data API — CVE severity, CVSS and affected packages. A credential-free official source.
Latest Red Hat advisories
High [CVE-2026-34966] Information disclosure via Server-Side Request Forgery (SSRF) bypass
Information disclosure via Server-Side Request Forgery (SSRF) bypass. Red Hat rates this important (CVSS 7.6). Weakness: CWE-918.
High [CVE-2026-71309] Backend Root Escape via Incomplete Path Validation
Backend Root Escape via Incomplete Path Validation. Red Hat rates this important (CVSS 8.1). Weakness: CWE-22.
High [CVE-2026-70428] Arbitrary file write via path traversal
Arbitrary file write via path traversal. Red Hat rates this important (CVSS 8.8). Weakness: CWE-22. Red Hat lists fixing advisory RHSA-2026:60250 with package ocp-tools-4/jenkins-rhel8:1786533565, ocp-tools-4/jenkins-rhel9:1787124635, ocp-tools-4/jenkins-rhel9:1787124925, ocp-tools-4/jenkins-rhel9:1787125069. Affected product named by the advisory: OpenShift Developer Tools and Services.
High [CVE-2026-70426] Arbitrary code execution via deserialization filter bypass
In Remoting 3384.v60d89463d9e0 and earlier, except 3355.3357.v931d3c992987, included in Jenkins 2.575 and earlier, LTS 2.568.1 and earlier, the JEP-200 class filter is not applied to classes resolved via a fallback path in the Remoting deserialization implementation, allowing agent processes, code running on agents, and attackers with Agent/Connect permission to bypass the JEP-200 deserialization filter for classes on the Jenkins core classpath. Successful exploitation could lead to arbitrary code execution on the Jenkins controller. This Important flaw in Jenkins Remoting allows authenticated attackers or compromised agent processes to execute arbitrary code on the Jenkins controller. The vulnerability stems from an incomplete deserialization filter bypass, enabling full compromise of the Jenkins environment. This impacts Red Hat OpenShift Developer Tools & Services deployments that utilize Jenkins agents, as it could lead to unauthorized control over the build and deployment infrastructure. Agent traffic in Red Hat OpenShift Developer Tools is restricted to a cluster's internal pod network which reduces the attack vector from Network to Adjacent. Red Hat severity: Important — CVSS 8.3 (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H). Weakness: CWE-502.
High [CVE-2026-70427] Arbitrary file write via crafted archives and symbolic links
Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not safely handle symbolic links with effectively empty names during the extraction of `.tar` and `.tar.gz` archives, allowing attackers able to control agent processes to provide crafted archives to the controller to write files to arbitrary locations on the file system, restricted only by file system access permissions of the user running Jenkins. A flaw was found in Jenkins. Successful exploitation allows an attacker to write files to arbitrary locations on the file system, potentially leading to unauthorized data modification or system compromise. This could result in arbitrary code execution and compromise of the Jenkins instance, for example by writing malicious scripts or plugins into the Jenkins home directory, but requires the attacker to already be able to run an agent process against the controller, limiting the attack surface to build infrastructure that is already at least partially trusted. This is an incomplete fix of a previously disclosed issue (CVE-2026-33001). Red Hat severity: Important — CVSS 8.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). Weakness: CWE-59. Affected products named by the advisory: OpenShift Developer Tools and Services 4.12; OpenShift Developer Tools and Services 4.13; OpenShift Developer Tools and Services 4.14; OpenShift Developer Tools and Services 4.15; and 7 more.
High [CVE-2026-15572] DCR protocol mapper type-swap policy bypass allows privilege escalation
DCR protocol mapper type-swap policy bypass allows privilege escalation. Red Hat rates this important (CVSS 8.8). Weakness: CWE-843. Red Hat lists fixing advisory RHSA-2026:50848 with package rhbk/keycloak-rhel9:26.6-11, rhbk/keycloak-operator-bundle:26.4.14-1, rhbk/keycloak-rhel9, rhbk/keycloak-rhel9-operator:26.6-11. Affected products named by the advisory: Red Hat build of Keycloak 26.4.14; Red Hat build of Keycloak 26.6.5.
High [CVE-2026-16442] SAML IdP-initiated broker login bypasses link-only restriction
SAML IdP-initiated broker login bypasses link-only restriction. Red Hat rates this important (CVSS 7.4). Weakness: CWE-346. Red Hat lists fixing advisory RHSA-2026:50848 with package rhbk/keycloak-rhel9:26.6-11, rhbk/keycloak-operator-bundle:26.4.14-1, rhbk-keycloak-rhel9/rhbk-keycloak-rhel9, keycloak-services. Affected products named by the advisory: Red Hat build of Keycloak 26.4; Red Hat build of Keycloak 26.6.
High [CVE-2026-16102] Default DCR policy allows role forgery via User Property mappers
Default DCR policy allows role forgery via User Property mappers. Red Hat rates this important (CVSS 8.1). Red Hat lists fixing advisory RHSA-2026:50848 with package rhbk/keycloak-rhel9:26.6-11, rhbk/keycloak-operator-bundle:26.4.14-1, rhbk-keycloak-rhel9/rhbk-keycloak-rhel9, keycloak-services. Affected products named by the advisory: Red Hat build of Keycloak 26.4; Red Hat build of Keycloak 26.6; Red Hat Single Sign-On 7.
High [CVE-2026-15573] Authorization bypass via unnormalized URI matching in PathMatcher
Authorization bypass via unnormalized URI matching in PathMatcher. Red Hat rates this important (CVSS 8.1). Red Hat lists fixing advisory RHSA-2026:50848 with package rhbk/keycloak-rhel9:26.6-11, rhbk/keycloak-operator-bundle:26.4.14-1, rhbk/keycloak-rhel9, keycloak-services. Affected products named by the advisory: Red Hat build of Keycloak 26.4; Red Hat build of Keycloak 26.6; Red Hat Data Grid 8; Red Hat Single Sign-On 7.
High [CVE-2026-16443] SAML broker metadata import disables response signature validation
SAML broker metadata import disables response signature validation. Red Hat rates this important (CVSS 7.4). Weakness: CWE-347. Red Hat lists fixing advisory RHSA-2026:50848 with package rhbk/keycloak-rhel9:26.6-11, rhbk/keycloak-operator-bundle:26.4.14-1, rhbk-keycloak-rhel9/rhbk-keycloak-rhel9, keycloak-services. Affected products named by the advisory: Red Hat build of Keycloak 26.4; Red Hat build of Keycloak 26.6.
High [CVE-2026-71226] Memory corruption via uncanceled AIO requests on error in libkcapi's one-shot AIO path
Memory corruption via uncanceled AIO requests on error in libkcapi's one-shot AIO path. Red Hat rates this moderate (CVSS 7.3). Weakness: CWE-416. Red Hat lists fixing advisory RHSA-2026:56985 with package libkcapi-main-1.5.1-0.1.hum1. Affected products named by the advisory: Red Hat Hardened Images; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; and 1 more. Affected products named by the advisory: Red Hat OpenShift Container Platform 4; Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Enterprise Linux 9.6 Extended Update Support.
High [CVE-2026-71287] Blind SQL injection due to improper input sanitization
Cacti's sanitize_sql_column (lib/functions.php) sanitizes user-supplied ORDER BY column names using the regex. Because this allowlist retains letters, digits, underscore, parentheses, and dot (intended to support expressions like COUNT(id) and table.column), a payload such as passes through completely unmodified. A flaw was found in Cacti. An authenticated user, regardless of their privilege level, can exploit a vulnerability where user-supplied input for sorting database columns is not properly sanitized. This allows for the injection of malicious SQL commands, leading to time-based blind SQL injection. The primary consequence is the potential for unauthorized access to sensitive information stored in the Cacti database. This flaw is rated Important because any authenticated Cacti user, regardless of privilege level, can inject arbitrary SQL into the ORDER BY clause via the sort_column parameter (e.g. SLEEP(5)), since sanitize_sql_column()'s allowlist regex fails to strip parentheses. This allows blind, time-based extraction of the entire Cacti database (C:H) and can degrade availability through sustained query delays (A:H), with no user interaction and low attack complexity required. This component is shipped only in EPEL. Red Hat does not ship this component in any core Red Hat products.
High [CVE-2026-71281] Arbitrary Code Execution via Unsafe Deserialization in LoRA-GA and CorDA Modules
Arbitrary Code Execution via Unsafe Deserialization in LoRA-GA and CorDA Modules. Red Hat rates this important (CVSS 8.8). Weakness: CWE-502. Affected products named by the advisory: Lightspeed Core; Red Hat AI Inference Server; Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat OpenShift AI (RHOAI).
High [CVE-2026-71267] Stack buffer overflow via overly long filenames
Stack buffer overflow via overly long filenames. Red Hat rates this important (CVSS 8.8). Weakness: CWE-120.
High [CVE-2026-71235] Arbitrary Code Execution via Unrestricted Script Execution
Arbitrary Code Execution via Unrestricted Script Execution. Red Hat rates this important (CVSS 8.8). Weakness: CWE-94. Red Hat lists fixing advisory RHSA-2026:59467 with package oadp/oadp-velero-rhel9:1786944540. Affected products named by the advisory: Assisted Installer for Red Hat OpenShift Container Platform 2; Builds for Red Hat OpenShift; cert-manager Operator for Red Hat OpenShift; Compliance Operator; and 35 more. Affected products named by the advisory: Confidential Compute Attestation; Cryostat 4; Deployment Validation Operator; External Secrets Operator for Red Hat OpenShift; and 31 more.
High [CVE-2026-59679] Font Server Client encoding Out-Of-Bounds Read/Write
Font Server Client encoding[] Out-Of-Bounds Read/Write. Red Hat rates this important (CVSS 7.5). Weakness: CWE-125. Red Hat lists fixing advisory RHSA-2026:55447 with package libXfont2-0:2.0.3-12.el9_8.3, libXfont2-0:2.0.3-12.el9_4.3, libXfont2-0:2.0.6-5.el10_2.3, libXfont2-0:2.0.3-12.el9_2.3. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8.
High [CVE-2026-44950] Privilege Escalation via Heap Buffer Overflow in Font Server Client
Privilege Escalation via Heap Buffer Overflow in Font Server Client. Red Hat rates this important (CVSS 7.5). Weakness: CWE-120. Red Hat lists fixing advisory RHSA-2026:55447 with package libXfont2-0:2.0.3-12.el9_8.3, libXfont2-0:2.0.3-12.el9_4.3, libXfont2-0:2.0.6-5.el10_2.3, libXfont2-0:2.0.3-12.el9_2.3. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8.
High [CVE-2026-71202] Denial of Service via integer underflow in image cropping function
Denial of Service via integer underflow in image cropping function. Red Hat rates this important (CVSS 7.5). Weakness: CWE-191. Affected product named by the advisory: Red Hat OpenShift Container Platform 4.
High [CVE-2026-66274] Denial of Service via unbounded type nesting
Denial of Service via unbounded type nesting. Red Hat rates this important (CVSS 7.5). Weakness: CWE-770. Affected products named by the advisory: Red Hat AMQ Broker 7; Red Hat AMQ Clients; Red Hat build of Apache Camel 4 for Quarkus 3; Red Hat build of Apache Camel for Spring Boot 4; and 2 more. Affected products named by the advisory: Red Hat build of Quarkus; Red Hat JBoss Enterprise Application Platform Expansion Pack.
High [CVE-2026-67589] Denial of Service via excessive memory allocation
Denial of Service via excessive memory allocation. Red Hat rates this important (CVSS 7.5). Weakness: CWE-770. Affected product named by the advisory: Red Hat AMQ Clients.