Red Hat Linux Security Advisories & Vulnerabilities
15979 advisories tracked · Red Hat Security Data API · direct feeds checked every minute; rate-limited sources checked less often
Get an email when Red Hat publishes the next one.
See Red Hat's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).
iPhone and Android apps · New on the App Store
Monitor Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Security advisories for your Red Hat release
Pick your distribution release to see every advisory issued for it and its severity mix. Fixes ship as errata, so keep the system patched. This is the release's advisory history, not a per-package scan.
Official source
Red Hat Security Data API
Red Hat Enterprise Linux errata (RHSA) via the official Red Hat Security Data API — CVE severity, CVSS and affected packages. A credential-free official source.
Latest Red Hat advisories
Medium [CVE-2026-13484] Unauthorized access and data manipulation via missing API authorization
A vulnerability has been found in MLflow up to 4666cffc7912ea606d592fc38d6a75e2935f65e7. The impacted element is an unknown function of the component Experiment-scoped Label Schema CRUD API. Such manipulation leads to missing authorization. It is possible to launch the attack remotely. A high complexity level is associated with this attack. The exploitability is regarded as difficult. The exploit has been disclosed to the public and may be used. A reply to the GitHub issue explains, that "[t]he labeling schema PR has not been merged yet. The auth handlers will be added before the release." A flaw was found in MLflow. This could lead to unauthorized access or manipulation of data within the affected component. This issue primarily affects specific MLflow components within the OpenShift AI environment. Red Hat severity: Moderate — CVSS 5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L). Weakness: CWE-639. Affected Red Hat products: Red Hat OpenShift AI (RHOAI). Red Hat does not currently list a fixing RHSA for this CVE.
Medium [CVE-2026-58058] Denial of Service via crafted IPv6 response
Nmap through 7.99 does not keep the IPv6 extension-header walk within the captured packet in ipv6_get_data_primitive (libnetutil/netutil.cc), so the pointer advances past the buffer and the remaining-length computation underflows to a large value. A scanned target or on-path attacker returning a crafted IPv6 response with a truncated extension header can trigger out-of-bounds reads and a crash during raw IPv6 scans. A flaw was found in Nmap. This can lead to an integer underflow, causing out-of-bounds reads and a denial of service (DoS) due to a crash during raw IPv6 scans. Red Hat rates this flaw as Moderate rather than the AI-assigned Important severity. The Aegis AI-Bot rated UI:N (no user interaction), but nmap is a command-line scanning tool that an operator must manually invoke — initiating a scan is user interaction per the CVSS definition of UI:R. Correcting UI:N to UI:R reduces the CVSS from 7.5 to 6.5, aligning with the upstream CVEORG assessment. Weakness: CWE-125. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat OpenShift Container Platform 4. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat package: nmap.
Medium [CVE-2026-58051] Denial of service or information disclosure via malformed SSH publickey response
libssh2 through 1.11.1 grows its publickey list with SSH2_REALLOC but does not zero-initialize new entries before parsing populates them, so a parse failure reaching the cleanup path leaves libssh2_publickey_list_free operating on an uninitialized entry. A malicious SSH server offering the publickey subsystem can use a malformed response to make cleanup free an uninitialized, attacker-influenceable attrs pointer in a connecting libssh2 client. A flaw in libssh2 allows a malicious SSH server to send a malformed public key response, triggering an invalid memory cleanup. This can cause the connecting client application to crash or leak information. Moderate: This flaw in libssh2 can lead to a denial of service or information disclosure in client applications when connecting to a malicious SSH server. The vulnerability arises from improper handling of uninitialized memory during public key list processing, which an attacker can trigger with a specially crafted response. Exploitation requires active interaction with a compromised or malicious server, limiting the attack surface to untrusted connections. Note: Red Hat Enterprise Linux (RHEL) 8 and newer are not affected by this flaw, as they do not ship the libssh2 package. Red Hat severity: Moderate — CVSS 6.5 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H). Weakness: CWE-824.
High [CVE-2026-47220] Denial of Service via missing host header in specific logging configurations
Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.37.0 until 1.37.5 and 1.38.3, when the %REQUESTED_SERVER_NAME(X:Y)% is used in log format and host related options is specified, like HOST_FIRST, SNI_FIRST, it's possible to crash Envoy when the specified host header is missing in the request headers. This vulnerability is fixed in 1.37.5 and 1.38.3. A flaw was found in Envoy. This can lead to a crash of the Envoy proxy, resulting in a Denial of Service (DoS). Red Hat products ship Envoy versions prior to 1.37.0, which do not contain the vulnerable %REQUESTED_SERVER_NAME% host-related logging code introduced in 1.37.0. Red Hat products are therefore not affected by this vulnerability. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-476. Red Hat lists OpenShift Service Mesh 2; OpenShift Service Mesh 3 as not affected.
High [CVE-2026-48743] Request desynchronization allows security policy bypass via HTTP/3 to HTTP/1 translation
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1, Envoy can translate a downstream HTTP/3 request that is complete at the transport layer (HEADERS with FIN / headers-only close) but still carries a nonzero Content-Length into a complete upstream HTTP/1 request with unresolved body debt. In an HTTP/1 upstream deployment where the origin replies before reading the declared body and keeps the connection reusable, the beginning of the next Envoy-generated upstream request can be consumed as the first request's body. The remaining bytes are then parsed by the origin as a new HTTP/1 request. This was reproduced as a route-bypass/desync: direct /pwn was denied by Envoy, but the second downstream H3 stream received the response for backend-parsed GET /pwn HTTP/1.1. This vulnerability is fixed in 1.35.11, 1.36.7, 1.37.3, and 1.38.1. This can lead to a request desynchronization, allowing an attacker to bypass security policies and access unauthorized resources. This is an Important flaw in Envoy, affecting Red Hat OpenShift Service Mesh and cloud.redhat.com deployments. The vulnerability arises from improper handling of HTTP/3 to HTTP/1 request translation, where a complete HTTP/3 request with a non-zero Content-Length can lead to request desynchronization on the upstream HTTP/1 server.
High [CVE-2026-48044] Denial of Service via specially crafted zstd payload
Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.23.0 until 1.35.11, 1.36.7, 1.37.3, and 1.38.1, a vulnerability has been identified in Envoy's zstd decompressor implementation (ZstdDecompressorImpl). When zstd decompression is enabled, processing a specially crafted, highly compressed zstd payload can lead to massive memory allocation. An attacker can exploit this to cause severe memory exhaustion, potentially resulting in an Out-Of-Memory (OOM) kill and Denial of Service (DoS) for the Envoy proxy. This vulnerability is fixed in 1.35.11, 1.36.7, 1.37.3, and 1.38.1. This vulnerability in Envoy's zstd decompressor is rated as Important, as a remote, unauthenticated attacker can induce a denial of service. By sending a specially crafted zstd payload, an attacker can cause excessive memory allocation, leading to an Out-Of-Memory condition and service disruption for Envoy proxy instances deployed in Red Hat environments. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-770. Affected Red Hat products: Red Hat OpenShift Service Mesh 3.0; Red Hat OpenShift Service Mesh 3.1; Red Hat OpenShift Service Mesh 3.2; Red Hat OpenShift Service Mesh 3.3; OpenShift Service Mesh 2. Will not fix / out of support: OpenShift Service Mesh 2.
High [CVE-2026-48042] Denial of Service via deeply nested JSON objects
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1, destructor of JSON Object results in stack overflow when deeply O(100K) nested objects are present. This vulnerability is fixed in 1.35.11, 1.36.7, 1.37.3, and 1.38.1. A remote attacker could exploit this vulnerability by sending deeply nested JSON objects to the affected system. This could lead to a stack overflow during the destruction of JSON objects, resulting in a Denial of Service (DoS) for the Envoy proxy. This vulnerability affects systems where Envoy is deployed and exposed to untrusted input, potentially disrupting critical proxy functionalities. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-776. Affected Red Hat products: Red Hat OpenShift Service Mesh 3.0; Red Hat OpenShift Service Mesh 3.1; Red Hat OpenShift Service Mesh 3.2; Red Hat OpenShift Service Mesh 3.3; OpenShift Service Mesh 2. Will not fix / out of support: OpenShift Service Mesh 2. Red Hat fixing advisory: RHSA-2026:49705, RHSA-2026:49729, RHSA-2026:49744, RHSA-2026:49765.
High [CVE-2026-56876] Arbitrary file write and information disclosure via symlink validation bypass
extract-zip does not validate symlink targets when extracting zip archives. When processing a malicious zip file containing a symlink with a relative path like '../../../../etc/passwd', extract-zip will extract the symlink without validation, allowing it to point outside the extraction directory. Depending on how extract-zip is used, an attacker could read or write to arbitrary files. This vulnerability allows a remote attacker to craft a malicious zip file containing symbolic links that point to locations outside the intended extraction directory. This could enable an attacker to read or write to sensitive files, potentially leading to information disclosure or system compromise. A flaw was found in the extract-zip npm package. Exploitation requires a user or automated process to extract a crafted ZIP archive. Red Hat severity: Important — CVSS 8.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N). Weakness: CWE-22. Affected Red Hat products: Red Hat Enterprise Linux 10; Node HealthCheck Operator. Affected products named by the advisory: Red Hat package: rh-podman-desktop.
High [CVE-2026-57231] Information disclosure via malicious container image environment variables
Podman is a tool for managing OCI containers and pods. From 1.8.1 until 5.8.4, a container image that contains a environment variable with just a key and no value can trick podman into passing that variable from the host into the container. This is made worse by the fact that using an asterisk (*) will cause podman to pass all host variables into the container. So essentially a malicious image can exfiltrate all podman environment variables that are set in the session from where the container is launched. This vulnerability is fixed in 5.8.4 and 6.0.0. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Weakness: CWE-914. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat OpenShift Container Platform 4.22; Red Hat Hardened Images; Red Hat Quay 3.10; Red Hat Quay 3.12; Red Hat Quay 3.14; Red Hat Quay 3.15; Red Hat Quay 3.16; Red Hat Quay 3.17; Red Hat Quay 3.9; Red Hat OpenShift Container Platform 4; Red Hat OpenStack Platform 18.0; Red Hat Quay 3. Red Hat lists Red Hat Ansible Automation Platform 2; Red Hat Developer Hub; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat OpenShift Container Platform 4; Red Hat OpenShift Dev Spaces; Red Hat OpenShift Virtualization 4; Red Hat Trusted Profile Analyzer as not affected.
High [CVE-2026-47214] Unsafe URI and Path Handling in HTML Backend
Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. Prior to 2.94.0, the HTML backend has unsafe URI and path handling. This vulnerability is fixed in 2.94.0. Its HTML backend contained vulnerabilities related to unsafe handling of Uniform Resource Identifiers (URIs) and file paths. This could allow an attacker to access local files, navigate outside of intended directories (path traversal), and potentially access internal network resources (Server-Side Request Forgery or SSRF). The primary impact of this flaw is information disclosure, potentially exposing sensitive data. This is an Important vulnerability in the Docling HTML backend, which is used for document processing within Red Hat OpenShift AI. This risk is elevated in environments where Docling handles untrusted or user-provided documents. Red Hat severity: Important — CVSS 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L). Weakness: CWE-22. Affected Red Hat products: Red Hat OpenShift AI 3.4. Red Hat fixing advisory: RHSA-2026:60520.
High [CVE-2026-5757] Information disclosure vulnerability in model quantization engine
Unauthenticated remote information disclosure vulnerability in Ollama's model quantization engine allows an attacker to read and exfiltrate the server's heap memory, potentially leading to sensitive data exposure, further compromise, and stealthy persistence. This vulnerability is rated Important due to the potential for remote exploitation without authentication. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Weakness: CWE-825. Red Hat lists Migration Toolkit for Applications 8; Red Hat Ansible Automation Platform 2; Red Hat build of Debezium 3; Red Hat OpenShift AI (RHOAI); Red Hat Trusted Profile Analyzer as not affected.
High [CVE-2026-57915] Kerberos pre-authentication bypass via unrecognized PA-DATA
It is possible to bypass the Kerberos pre-authentication check in Apache Kerby by sending a PA-DATA with an unrecognized or unsupported type. Users are recommended to upgrade to version 2.1.2, which fixes this issue. This vulnerability allows an attacker to circumvent the initial authentication step, potentially leading to unauthorized access or impersonation within a Kerberos-protected environment. This is an Important flaw in Apache Kerby, affecting Red Hat products that utilize Kerberos for authentication, including Red Hat AMQ, JBoss Data Grid, Enterprise Application Platform, and Red Hat JBoss Fuse. Red Hat severity: Important — CVSS 7.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). Weakness: CWE-358. Affected Red Hat products: AMQ Clients 2026.Q3; streams for Apache Kafka 2. Red Hat lists Red Hat Data Grid 8; Red Hat Fuse 7; Red Hat JBoss Enterprise Application Platform Expansion Pack; streams for Apache Kafka 3 as not affected. Red Hat fixing advisory: RHSA-2026:69459.
High [CVE-2026-13325] DisableTLS migration setting removes authentication, exposing unauthenticated virtqemud proxy on all interfaces
A flaw was found in KubeVirt's migration proxy. When spec.configuration.migrations.disableTLS is set to true on the KubeVirt custom resource, the target virt-handler binds a plain TCP listener on all interfaces (0.0.0.0/::) on a random port with no authentication, peer allow-list, or handshake token. This listener proxies directly into the target virt-launcher's virtqemud control socket. An attacker with a running pod on the cluster network can connect to this listener and issue unfiltered libvirt RPC commands against another tenant's virtual machine, including reading VM memory and configuration, modifying VM state via QMP, or destroying the VM. The bind address is unconditionally 0.0.0.0 — configuring a dedicated migration network via migrations.network only changes the advertised migration IP, not the listener bind address, so the port remains reachable on the pod network even when a dedicated migration network is configured. The API documentation describes disableTLS as removing "the additional layer of live migration encryption" without disclosing that it also removes all mutual authentication. This CVE has been marked as Rejected by the assigning CNA. Red Hat severity: Moderate — CVSS 8.5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H). Weakness: CWE-306. Red Hat lists Red Hat OpenShift Virtualization 4 as not affected.
High [CVE-2026-48933] Denial of Service via large input to subtle.encrypt
A flaw in Node.js WebCrypto implementation can crash the process if the input of `subtle.encrypt()` is a multiple of 2GiB. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**. A remote attacker could exploit this vulnerability by providing an input to the `subtle.encrypt()` function that is a multiple of 2 gigabytes (GiB). This could lead to a denial of service (DoS) by crashing the Node.js process. This could lead to service unavailability in Red Hat environments where Node.js applications process untrusted data with WebCrypto. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-770. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 9.6 Extended Update Support; Red Hat Hardened Images. Red Hat fixing advisory: RHSA-2026:35841, RHSA-2026:35842, RHSA-2026:39246, RHSA-2026:39868, RHSA-2026:41947, RHSA-2026:35891, RHSA-2026:35892, RHSA-2026:52399, RHSA-2026:28727, RHSA-2026:29012, RHSA-2026:30172, RHSA-2026:7378, RHSA-2026:9455. Affected products named by the advisory: Red Hat package: nodejs24; Red Hat package: nodejs22; Red Hat package: nodejs26.
High [CVE-2026-48618] Authentication bypass due to TLS hostname handling and unicode dot separator mismatch
A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismat. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**. A flaw was found in Node.js. This flaw involves a mismatch in how Node.js handles TLS (Transport Layer Security) hostnames and unicode dot separators during authentication. An attacker could exploit this to bypass intended security boundaries, potentially leading to unauthorized access and confidentiality impact. The issue affects Node.js versions 22, 24, and 26 as shipped in Red Hat products. Red Hat severity: Important — CVSS 7.7 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N). Weakness: CWE-289. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 9.6 Extended Update Support; Red Hat Hardened Images. Affected products named by the advisory: Red Hat package: nodejs24; Red Hat package: nodejs22; Red Hat package: nodejs26.
High [CVE-2026-53322] Clean up DMABUFs before disabling function
In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Clean up DMABUFs before disabling function On device shutdown, make vfio_pci_core_close_device() call vfio_pci_dma_buf_cleanup() before the function is disabled via vfio_pci_core_disable(). This ensures that all access via DMABUFs is revoked before the function's BARs become inaccessible. This fixes an issue where, if the function is disabled first, a tiny window exists in which the function's MSE is cleared and yet BARs could still be accessed via the DMABUF. The resources would also be freed and up for grabs by a different driver. During device shutdown, an improper order of operations in cleaning up Direct Memory Access Buffers (DMABUFs) before disabling the function creates a brief window. In this window, a device's Base Address Registers (BARs) could still be accessed via DMABUFs even after memory space enable (MSE) is cleared. This could potentially allow a different driver to access freed resources, leading to information disclosure or unauthorized resource access. Red Hat severity: Moderate — CVSS 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Weakness: CWE-826. Affected Red Hat products: Red Hat Enterprise Linux 10. Red Hat fixing advisory: RHSA-2026:65334. Affected products named by the advisory: Red Hat package: kernel.
High [CVE-2026-53290] Fix drm_dev_put called before stream disable in close
In the Linux kernel, the following vulnerability has been resolved: drm/xe/eustall: Fix drm_dev_put called before stream disable in close In xe_eu_stall_stream_close(), drm_dev_put() is called before the stream is disabled and its resources are freed. If this drops the last reference, the device structures could be freed while the subsequent cleanup code still accesses them, leading to a use-after-free. Fix this by moving drm_dev_put() after all device accesses are complete. This matches the ordering in xe_oa_release(). (cherry picked from commit 35aff528f7297e949e5e19c9cd7fd748cf1cf21c) This timing issue can lead to a use-after-free condition, where device structures might be accessed after they have been deallocated. A local attacker could potentially exploit this to cause system instability or a denial of service (DoS). Red Hat severity: Moderate — CVSS 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Weakness: CWE-825. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9. Red Hat fixing advisory: RHSA-2026:71602, RHSA-2026:71700. Affected products named by the advisory: Red Hat package: kernel-rt.
High [CVE-2026-53309] fix off-by-one in dlm_match_regions region comparison
In the Linux kernel, the following vulnerability has been resolved: ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison The local-vs-remote region comparison loop uses '<=' instead of '<', causing it to read one entry past the valid range of qr_regions. The other loops in the same function correctly use '<'. Fix the loop condition to use '<' for consistency and correctness. A flaw was found in the Linux kernel's OCFS2 Distributed Lock Manager (DLM) component. This out-of-bounds read could lead to system instability or crashes. The vulnerable code path is reached only on systems using the OCFS2 clustered filesystem, when a node compares its configured resource regions with those reported by a remote node during DLM domain setup. All Red Hat Enterprise Linux kernel and kernel-rt streams (RHEL 6 ELS through RHEL 10) and Red Hat In-Vehicle OS 2.x kernels are not affected because the vulnerable code is not present in Red Hat's shipped kernels. The severity assigned by the upstream CVE record (CVSS 9.8, Critical) is higher than Red Hat's assessment (CVSS 7.1, Important); this difference reflects the conservative generic scoring of the upstream record compared with Red Hat's analysis of the specific OCFS2 DLM code path involved. Weakness: CWE-125.
Medium [CVE-2026-48758] @sigstore/core: Signature bypass due to incorrect encoding in preAuthEncoding
sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 3.2.1, the preAuthEncoding function in @sigstore/core uses Node.js ascii encoding when converting the PAE string to bytes, allowing payloadType to be mutated after signing without invalidating the signature and breaking the type-binding guarantee that DSSE is designed to provide. This issue is fixed in version 3.2.1. This encoding truncates Unicode characters to their low byte, allowing an attacker to substitute characters in the payloadType with Unicode variants that produce identical PAE bytes. As a result, the payloadType can be mutated after a digital signature has been applied without invalidating the signature, thereby bypassing the intended type-binding guarantee of the Digital Signature Standard for Entity Authentication (DSSE). Red Hat severity: Moderate — CVSS 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L). Weakness: CWE-347. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat OpenShift Dev Spaces; Red Hat Satellite 6; Self-service automation portal 2. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat package: sigstore.
Medium [CVE-2026-54753] `nx graph` dev server permissive CORS policy
Nx is a monorepo solution for TypeScript and polyglot codebases. From 17.0.4 until 22.7.2 and 23.0.0-beta.2, the local HTTP server started by nx graph sent Access-Control-Allow-Origin: * on every response, letting any website a developer visited read the server's responses cross-origin — including the full project graph and the output of the /help endpoint, which runs a target's configured help command. The practical impact is typically cross-origin information disclosure, but can be arbitrary command injection in rare cases. A flaw was found in Nx, a monorepo solution for managing multiple projects. This misconfiguration allows a remote attacker to read sensitive project information, such as the full project graph, from a developer's system when they visit a malicious website. Red Hat severity: Moderate — CVSS 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N). Weakness: CWE-346. Affected Red Hat products: Red Hat Ansible Automation Platform 2; Red Hat Enterprise Linux 10. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat package: grafana.
Free weekly CVE digest
Every Monday: the week's critical and high advisories for Red Hat or every vendor, new CISA KEV entries and upcoming end-of-life dates.