Red Hat Linux Security Advisories & CVEs
13669 advisories tracked · Red Hat Security Data API · direct feeds checked every minute; rate-limited backstops use a safe source cadence
Android app · Google Play
Monitor Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Security advisories for your Red Hat release
Pick your distribution release to see every advisory issued for it and its severity mix. Fixes ship as errata — keep the system patched. This is the release's advisory history, not a per-package scan.
Official source
Red Hat Security Data API
Red Hat Enterprise Linux errata (RHSA) via the official Red Hat Security Data API — CVE severity, CVSS and affected packages. A credential-free official source.
Latest Red Hat advisories
Low [CVE-2026-18739] Off-by-one in poptStuffArgs
A flaw was found in popt, a command-line option parsing library. An off-by-one error in the poptStuffArgs function, when repeatedly called by a host application or through deep alias nesting, can lead to corruption of internal program data. This corruption could potentially enable a local attacker to execute arbitrary code if the host application then unsafely processes the altered data. Exploitation is only possible if the host application then unsafely processes the corrupted `poptContext` data, such as sinking it into `exec`, `system`, `popen`, or `dlopen`. Red Hat severity: Low — CVSS 2.5 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L). Weakness: CWE-787. Affected Red Hat products: Red Hat Hardened Images; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat OpenShift Container Platform 4. Red Hat fixing advisory: RHSA-2026:56984. Affected products named by the advisory: Red Hat package: popt.
Low [CVE-2026-68744] NSS responder uninitialized heap disclosure in initgroups reply
A flaw was found in SSSD. The sss_nss_protocol_fill_initgr() function in the NSS responder pre-allocates reply space for all group entries but does not shrink the packet when groups are skipped, causing uninitialized heap bytes to be transmitted to the client. A local attacker can exploit this to disclose cached directory data and heap layout information from the sssd_nss process. This issue can only be triggered by a local attacker who can connect to the SSSD NSS responder unix socket. Credentials, hashes, and tickets reside in separate sssd_pam and sssd_be processes and are not exposed by this flaw. Much of the directory data may already be obtainable via legitimate NSS queries depending on the deployment. The primary security concern is disclosure of heap pointers that could assist ASLR bypass if chained with a separate memory-corruption vulnerability. Red Hat severity: Low — CVSS 3.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). Weakness: CWE-908. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat OpenShift Container Platform 4. Red Hat lists Red Hat Enterprise Linux 6 as not affected. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat package: sssd.
Critical [CVE-2026-68579] Arbitrary Code Execution via Heap Overflow in Clipboard Processing
Arbitrary Code Execution via Heap Overflow in Clipboard Processing. Red Hat rates this critical (CVSS 9.6). Weakness: CWE-787.
High [CVE-2026-68580] Remote code execution or denial of service via audio input integer overflow
FreeRDP before 3.29.0 contains integer overflow vulnerabilities in the audio input redirection channel (audin) across ALSA, sndio, WinMM, and OpenSL ES backends that fail to validate the FramesPerPacket parameter from RDP servers. Attackers can supply a malicious FramesPerPacket value causing allocation size wraparound, resulting in heap-based buffer overflow on ALSA or denial of service on all platforms. A flaw was found in FreeRDP, an open-source implementation of the Remote Desktop Protocol (RDP). This can lead to a heap-based buffer overflow, potentially enabling arbitrary code execution on systems using the ALSA backend, or a denial of service across all supported platforms. The vulnerability arises from an integer overflow in the audio input redirection channel (audin) when connecting to a malicious RDP server, which can cause a heap-based buffer overflow, particularly affecting Linux systems using the ALSA backend. Exploitation requires user interaction to connect to a compromised server. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H). Weakness: CWE-190.
Medium [CVE-2026-18573] Client access-type policy condition bypass during client update
A flaw was found in the keycloak-services component of Keycloak, which is used for managing authentication and authorization flows. The issue occurs when a realm administrator configures client policies to enforce specific authentication requirements on confidential clients. Due to improper evaluation of the client state during an update operation, an attacker with client management permissions can bypass these security policies by first creating a public client and then updating it to a confidential client with weaker authentication. This can result in the persistence of clients that do not comply with the intended security hardening of the realm. The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate, given that exploitation requires existing client management privileges or a dynamic registration token. Successful exploitation allows an attacker to bypass realm-specific client policy conditions and persist confidential clients with weaker authentication than required by policy. The vulnerability's root cause is the evaluation of update operations against the previous client state rather than the proposed new state. Weakness: CWE-862. Affected Red Hat products: Red Hat build of Keycloak 26.6; Red Hat build of Keycloak 26.6.7.
Medium [CVE-2026-18572] UMA claim token can override authorization time-policy evaluation attributes
Keycloak provides authorization services that allow administrators to restrict access to resources based on time policies (for example, only allowing access during business hours). A flaw was discovered where a user can include a fake time value in their authorization request that overrides the actual server time. This allows the user to bypass these time-based restrictions and access protected resources at unauthorized times. The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate, given that exploitation requires the attacker to be an authenticated user and the target resource must be specifically protected by a time-based authorization policy. Successful exploitation allows an attacker to bypass temporal access controls and obtain permissions outside of allowed time windows. The vulnerability's root cause is the improper merging of user-supplied claims which allows them to overwrite trusted server-side evaluation attributes. Weakness: CWE-863. Affected Red Hat products: Red Hat build of Keycloak 26.6; Red Hat build of Keycloak 26.6.7. Red Hat lists Red Hat Data Grid 8; Red Hat JBoss Enterprise Application Platform Expansion Pack; Red Hat Single Sign-On 7 as not affected. Red Hat fixing advisory: RHSA-2026:68277, RHSA-2026:68278.
Medium [CVE-2026-18571] FGAP V2 group assignment bypass during user creation
A flaw was found in the user creation component of Keycloak when Fine-Grained Admin Permissions V2 (FGAP V2) is enabled. This issue allows a sub-administrator with permission to create users to add those users to any group, even groups the sub-administrator is not authorized to manage. This could lead to unauthorized access to sensitive information or elevated privileges for the newly created users. The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate, given that it requires the non-default Fine-Grained Admin Permissions V2 to be enabled and the attacker must already possess high-level sub-administrator privileges. Successful exploitation allows an attacker to bypass group membership restrictions during user creation, potentially leading to unauthorized privilege escalation for new users. The vulnerability's root cause is a missing authorization check for group assignments within the user creation API payload. Weakness: CWE-862. Affected Red Hat products: Red Hat build of Keycloak 26.6; Red Hat build of Keycloak 26.6.7. Red Hat lists Red Hat Data Grid 8; Red Hat JBoss Enterprise Application Platform Expansion Pack; Red Hat Single Sign-On 7 as not affected. Red Hat fixing advisory: RHSA-2026:68277, RHSA-2026:68278.
Medium [CVE-2026-18570] Full-scope-disabled client policy validation bypass via omitted fullScopeAllowed
A flaw was found in the full-scope-disabled client-policy executor within the keycloak-services component. This component is responsible for enforcing security policies during client registration and configuration in Red Hat Build of Keycloak. The issue occurs because the executor only validates the fullScopeAllowed field when it is explicitly provided in a request. By omitting this field, a delegated user can bypass the policy, resulting in a client created with full scope access. This allows the client to obtain tokens with unauthorized role mappings. The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate, given that exploitation requires the attacker to have delegated client creation privileges and the realm must have a specific policy configuration. Successful exploitation allows an attacker to bypass client scope restrictions and obtain tokens with unauthorized permissions. The vulnerability's root cause is the failure of the policy executor to account for default server behavior when the fullScopeAllowed field is missing from a request. Weakness: CWE-862. Affected Red Hat products: Red Hat build of Keycloak 26.6; Red Hat build of Keycloak 26.6.7. Red Hat lists Red Hat Data Grid 8; Red Hat JBoss Enterprise Application Platform Expansion Pack; Red Hat Single Sign-On 7 as not affected.
High [CVE-2026-67323] Arbitrary code execution via command injection due to unguarded Git options
GitPython before 3.1.51 fails to guard against dangerous Git options passed as keyword arguments in Repo.archive() and git.ls_remote(), allowing command injection via options such as --exec/--upload-pack (leading to arbitrary command execution). Additionally, Repo.iter_commits() and Repo.blame() do not check for leading-dash revision arguments, so a revision like --output= can cause Git to open and truncate an arbitrary file. Exploitation requires an application that passes attacker-controlled arguments to these methods. This vulnerability allows an attacker to inject arbitrary commands when using functions like Repo.archive() and git.ls_remote(), potentially leading to arbitrary code execution. This is an Important vulnerability because it allows for arbitrary code execution or file truncation. This could lead to a compromise of confidentiality, integrity, and availability on affected Red Hat products that utilize GitPython in such a manner. Red Hat severity: Important — CVSS 8.4 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Weakness: CWE-88. Affected products named by the advisory: Red Hat Ansible Automation Platform 2.5 for RHEL 8; Red Hat Ansible Automation Platform 2.5 for RHEL 9; Red Hat Ansible Automation Platform 2.6 for RHEL 9; Red Hat Ansible Automation Platform 2.7; and 11 more.
High [CVE-2026-67326] Remote Code Execution via Newline Injection in config_writer
GitPython before 3.1.50 fails to validate newline characters in the section parameter of config_writer(), allowing attackers to inject arbitrary section headers into.git/config. Attackers can inject newlines to create a forged [core] section with hooksPath pointing to attacker-controlled directories, achieving remote code execution when git hooks are triggered. A flaw was found in GitPython. Red Hat severity: Moderate — CVSS 7 (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H). Weakness: CWE-93. Affected Red Hat products: Red Hat Hardened Images. Red Hat fixing advisory: RHSA-2026:44416, RHSA-2026:45785, RHSA-2026:45940.
High [CVE-2026-67312] Denial of Service via uncontrolled recursion in form data processing
axios versions from 0.28.0 before 0.33.0 and from 1.0.0 before 1.18.0 contain uncontrolled recursion in formDataToJSON (exposed as axios.formToJSON() and used internally when serializing FormData with Content-Type: application/json). When an application passes attacker-controlled FormData field names, a field name with thousands of nested bracket-delimited segments causes unbounded recursion in buildPath(), exhausting the JavaScript call stack (RangeError: Maximum call stack size exceeded) and causing denial of service for that request, or process termination in applications without appropriate error handling. A flaw was found in axios, a popular JavaScript library. An attacker can exploit this vulnerability by providing malicious form data containing deeply nested field names. This input triggers uncontrolled recursion within the formDataToJSON function, which is responsible for processing form data. This vulnerability affects applications that pass attacker-controlled FormData field names to axios' FormData-to-JSON conversion. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-674. Affected products named by the advisory: Red Hat Developer Hub 1.10; Red Hat Developer Hub 1.9; Red Hat Hardened Images; Red Hat OpenShift Dev Spaces 3.30; and 4 more.
High [CVE-2026-67321] Denial of Service via object serialization bypass
axios versions 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 contain an incomplete depth-limit bypass in toFormData.js when serializing objects with top-level keys ending in '{}'. Attackers who control object keys and nested values passed to axios form or parameter serialization can trigger a RangeError from JSON.stringify, causing denial of service in the affected request path. A flaw was found in axios. A remote attacker could exploit an incomplete depth-limit bypass when the component serializes objects with specific top-level keys. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-770. Affected products named by the advisory: Red Hat Advanced Cluster Management for Kubernetes 2.13; Red Hat Advanced Cluster Management for Kubernetes 2.14; Red Hat Advanced Cluster Security for Kubernetes 4.10; Red Hat Advanced Cluster Security for Kubernetes 4.11; and 20 more.
High [CVE-2026-67324] Arbitrary Code Execution via Joined Short Options Bypass
GitPython 3.1.50 fails to recognize joined short-option forms such as -u (the short form of --upload-pack=) when enforcing its default unsafe-option gate. When an application passes attacker-influenced clone options into Repo.clone_from(..., multi_options=..., allow_unsafe_options=False), an attacker can supply -u to bypass the gate that blocks --upload-pack/-u, causing Git to execute the specified helper command during clone. Fixed in 3.1.51. A flaw was found in GitPython. This allows the attacker to bypass security checks and execute arbitrary commands during a Git clone operation. This can lead to a complete compromise of the affected system. This vulnerability is rated as Important because exploitation requires an application to invoke `Repo.clone_from()` with attacker-controlled `multi_options` while `allow_unsafe_options=False` is set. This precondition means an attacker must already have some influence over a Git-related workflow within the consuming application, rather than exploiting it through mere network access. This affects GitPython version 3.1.50. Red Hat severity: Important — CVSS 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Weakness: CWE-78.
High [CVE-2026-67298] Denial of Service via integer underflow in RAIL channel handling
Denial of Service via integer underflow in RAIL channel handling. Red Hat rates this important (CVSS 7.1). Weakness: CWE-191.
High [CVE-2026-67320] Information disclosure via Prototype Pollution in Node HTTP adapter
axios in a Node.js deployment using the HTTP adapter can route requests through an attacker-controlled proxy. axios hardens merged request configuration by creating a null-prototype object, but request interceptors run after the merge; a common immutable interceptor pattern such as {...config} or Object.assign({}, config) converts the hardened config back into a regular object. axios then dispatches that object without re-hardening it, and the Node HTTP adapter reads config.proxy through the prototype chain. For plaintext HTTP requests, the proxy can observe Authorization headers, Basic auth from config.auth, method, absolute URL, Host, and request body, and can return its own response. This does not establish browser impact or HTTPS header/body disclosure under normal TLS validation. Affected versions are >=0.31.1 (fixed in 0.33.0) and >=1.15.2 (fixed in 1.18.0). This vulnerability, known as Prototype Pollution, occurs because request interceptors can revert hardened request configurations, allowing an attacker to manipulate the Object.prototype.proxy property. If successfully exploited, an attacker can route affected plaintext HTTP requests through a malicious proxy, potentially observing sensitive data such as authentication headers and request bodies, and even returning their own responses.
High [CVE-2026-67322] Environment variable exfiltration via attacker-controlled clone URL
GitPython before 3.1.52 is vulnerable to environment-variable exfiltration in Repo.clone_from(). The caller-supplied remote URL is passed through Git.polish_url(), which on non-Cygwin platforms calls os.path.expandvars() on the URL before invoking git clone. An attacker who controls the clone URL can embed $NAME or ${NAME} tokens that are expanded to the values of the hosting process's environment variables (e.g., AWS_SECRET_ACCESS_KEY or GITHUB_TOKEN). The resulting URL, now containing the secret, is transmitted over the network to an attacker-controlled host during the clone attempt, disclosing the secret. A flaw was found in GitPython. A remote attacker can exploit a vulnerability in the Repo.clone_from() method by providing a specially crafted Git repository URL. This allows the attacker to exfiltrate sensitive environment variables, such as access keys or tokens, to an attacker-controlled server during the cloning process, leading to information disclosure. This Important vulnerability in GitPython allows for sensitive environment variable exfiltration. This poses a risk of information disclosure, particularly for credentials or tokens, in Red Hat products that process untrusted clone URLs. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Weakness: CWE-214.
High [CVE-2026-67325] Command Injection via Git option prefix abbreviation
GitPython before 3.1.51 contains an incomplete command injection blocklist that fails to account for git's long-option prefix abbreviation feature. Attackers can bypass the unsafe options guard by using abbreviated option names like upload_p instead of upload_pack, which git resolves to dangerous options and executes arbitrary commands. A flaw was found in GitPython. This allows for the execution of arbitrary commands, leading to potential arbitrary code execution. This vulnerability is rated as Important as it allows for arbitrary command execution. It arises from an incomplete command injection blocklist in GitPython, which can be bypassed by supplying abbreviated Git options. This could lead to a complete compromise of confidentiality, integrity, and availability in Red Hat products that process untrusted input as keyword arguments to GitPython's Git commands. Red Hat severity: Important — CVSS 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Weakness: CWE-78. Affected products named by the advisory: Red Hat Ansible Automation Platform 2.5 for RHEL 8; Red Hat Ansible Automation Platform 2.5 for RHEL 9; Red Hat Ansible Automation Platform 2.6 for RHEL 9; Red Hat Ansible Automation Platform 2.7; and 10 more.
High [CVE-2026-67313] Denial of Service via uncontrolled recursion in formDataToJSON
axios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON when processing FormData field names with deeply nested bracket segments. Attackers can supply FormData with field names containing thousands of nested brackets to exhaust the JavaScript call stack and trigger RangeError, causing request failure or process termination in applications that do not handle the exception. A flaw was found in axios. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-674. Affected products named by the advisory: Red Hat Advanced Cluster Management for Kubernetes 2.13; Red Hat Advanced Cluster Management for Kubernetes 2.14; Red Hat Ansible Automation Platform 2.1; Red Hat Hardened Images; and 22 more.
High [CVE-2026-67314] Outbound Request Tampering via Prototype Pollution in Basic Auth
axios versions >=1.15.2 and <1.18.0 contain prototype-pollution read-side gadgets in Basic auth subfield handling (lib/adapters/http.js and lib/helpers/resolveConfig.js). When an application is already affected by a separate prototype-pollution primitive and makes an axios request with an own auth object that omits the username and/or password properties, axios reads the inherited Object.prototype.username and Object.prototype.password values and uses them to construct an outbound 'Authorization: Basic...' header. axios itself does not pollute prototypes. The practical impact is outbound request tampering: an attacker who controls the polluted prototype values can inject attacker-chosen Basic auth credentials or replace an existing Authorization header. Credential disclosure is only possible under additional application-specific conditions. A flaw was found in axios. Red Hat severity: Important — CVSS 7.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N). Weakness: CWE-915. Affected products named by the advisory: Red Hat Advanced Cluster Management for Kubernetes 2.13; Red Hat Advanced Cluster Management for Kubernetes 2.14; Red Hat Ansible Automation Platform 2.1; Red Hat Hardened Images; and 19 more.
High [CVE-2026-67305] Remote Code Execution via Heap Buffer Overflow in Clipboard Processing
Remote Code Execution via Heap Buffer Overflow in Clipboard Processing. Red Hat rates this important (CVSS 7.5). Weakness: CWE-122.