Red Hat Linux Security Advisories & CVEs
2955 advisories tracked · Red Hat Security Data API · direct feeds checked every minute; rate-limited backstops use a safe source cadence
Android app · Google Play
Monitor Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Security advisories for your Red Hat release
Pick your distribution release to see every advisory issued for it and its severity mix. Fixes ship as errata — keep the system patched. This is the release's advisory history, not a per-package scan.
Official source
Red Hat Security Data API
Red Hat Enterprise Linux errata (RHSA) via the official Red Hat Security Data API — CVE severity, CVSS and affected packages. A credential-free official source.
Latest Red Hat advisories
High [CVE-2026-76139] Bundle build execs unpinned stolostron/release@master with full build credentials
A flaw was found in acm-operator-bundle. The build process for this component downloads and runs a script from a remote source without verifying its authenticity or integrity. This script gains access to sensitive credentials, such as GitHub access tokens and registry passwords, used in the build environment. A remote attacker could exploit this vulnerability to inject malicious code, leading to unauthorized access to build resources and potential compromise of the resulting operator bundle. It allows for the execution of unverified external scripts with elevated privileges, including access to sensitive credentials and write access to the bundle PR, which could compromise the integrity of shipped bundles. Red Hat severity: Important — CVSS 8 (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H). Weakness: CWE-829. Affected Red Hat products: Red Hat Advanced Cluster Management for Kubernetes 2. Red Hat does not currently list a fixing RHSA for this CVE.
High [CVE-2026-75569] Bundle-generation business logic fetched from mutable stolostron/release@master
A flaw was found in mce-operator-bundle. The build process fetches and executes scripts from a remote repository without performing integrity checks, such as commit pinning or signature verification. This allows a malicious actor with write access to the remote repository to inject and execute arbitrary code during the build. The consequence is a compromised build process, potentially leading to the distribution of malicious software. The build logic is fetched from a mutable master branch without integrity checks or commit pinning, allowing for the execution of untrusted code if the source repository is compromised. This could impact the integrity of delivered Red Hat products. Red Hat severity: Important — CVSS 7.7 (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N). Weakness: CWE-829. Affected Red Hat products: Multicluster Engine for Kubernetes. Red Hat does not currently list a fixing RHSA for this CVE.
High [CVE-2026-50152] MON subscription handler exposes config-key store to low-privilege CephX users
A flaw was found in the MON subscription handler of Ceph, a distributed storage system. The handler does not properly authorize access to the config-key store when processing MMonSubscribe messages. Any CephX user holding mon allow r capabilities can read the entire config-key store, which contains sensitive operational secrets including OSD LUKS disk encryption passphrases and, on clusters managed by cephadm, the SSH private key used to administer every host. Exposure of these secrets can lead to full host-level root access and compromise of encrypted data at rest. The Red Hat Product Security team has assessed the severity of this vulnerability as Important, given that it can be exploited from the adjacent cluster network with low-privilege CephX credentials and no user interaction. Successful exploitation allows an attacker to read the full MON config-key store, exposing OSD LUKS passphrases and cephadm SSH private keys, potentially yielding root access on all cluster hosts. The vulnerability's root cause is missing authorization checks in the MON subscription handler when serving config-key store contents. Weakness: CWE-862. Affected Red Hat products: Red Hat Ceph Storage 4; Red Hat Ceph Storage 5; Red Hat Ceph Storage 6; Red Hat Ceph Storage 7; Red Hat Ceph Storage 8; Red Hat Ceph Storage 9. Red Hat does not currently list a fixing RHSA for this CVE.
High [CVE-2026-54330] RGW SigV4 verifier allows attachment of arbitrary unsigned x-amz-* headers leading to privilege escalation
A flaw was found in Ceph RGW's SigV4 signature verification handler. When processing S3 requests, RGW verifies only the headers explicitly listed in the X-Amz-SignedHeaders field but does not reject requests that carry additional unsigned x-amz-* headers. This diverges from the AWS S3 specification, which requires all x-amz-* headers to be signed. As a result, anyone holding a presigned PUT URL can attach arbitrary unsigned x-amz-* headers that RGW will honor, effectively escalating their privileges beyond what the original URL signer authorized. This can lead to unauthorized access to and modification of S3 objects. The Red Hat Product Security team has assessed the severity of this vulnerability as Important, given that exploitation requires only a presigned PUT URL and knowledge of the SigV4 protocol gap. Successful exploitation allows an attacker to escalate privileges beyond the scope intended by the presigned URL signer, gaining unauthorized read and write access to S3 objects. Weakness: CWE-347. Affected Red Hat products: Red Hat Ceph Storage 4; Red Hat Ceph Storage 5; Red Hat Ceph Storage 6; Red Hat Ceph Storage 7; Red Hat Ceph Storage 8; Red Hat Ceph Storage 9. Red Hat does not currently list a fixing RHSA for this CVE.
High [CVE-2026-39944] RGW STS session tokens vulnerable to CBC bit-flip attack enabling admin privilege escalation
A flaw was found in Ceph RGW's STS (Security Token Service) session token implementation. The STS tokens use the same unauthenticated AES-128-CBC encryption as CephX, which lacks message authentication and uses a hardcoded initialization vector. Because there is no integrity protection on the tokens, an attacker who holds any valid unprivileged STS token can perform a CBC bit-flip attack to modify the token contents and escalate to full RGW admin privileges. This requires only that STS is enabled (rgw_s3_auth_use_sts = true) and that the attacker has a single valid STS token. Successful exploitation grants complete control over the RGW service, including reading, writing, and deleting all objects and buckets. The Red Hat Product Security team has assessed the severity of this vulnerability as Important, given that it can be exploited over the network by any holder of a valid STS token without user interaction. Successful exploitation allows an attacker to escalate from any unprivileged STS session to full RGW admin, gaining complete read, write, and delete access to all S3 objects and buckets. The vulnerability's root cause is the use of unauthenticated AES-128-CBC encryption in STS session tokens, sharing the same cryptographic weakness as CVE-2025-30156. Weakness: CWE-327.
High [CVE-2020-37267] Information disclosure via unredacted logging of authorization tokens
A flaw was found in Renovate. When used with Azure DevOps, the bot's authorization token may be exposed in server or pipeline logs. This occurs because the `git http.extraheader=AUTHORIZATION` parameter is logged without redaction. An attacker with access to these logs could obtain the bot's credentials, leading to unauthorized access. This flaw has an IMPORTANT impact on Renovate, which logged authorization tokens without redaction, potentially disclosing them to anyone with access to the log output. The version of Renovate shipped by Red Hat is well beyond the upstream fix (23.25.1); the unredacted-logging code is not present in the shipped version, so Red Hat's product is not affected. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Weakness: CWE-538.
High [CVE-2026-43961] Vimscript injection via unescaped filename in netrw s:NetrwMarkFile filter expression allows arbitrary code execution
A flaw was found in Vim's netrw plugin. A crafted filename containing quote characters and expression fragments can break out of the quoted context during mark/unmark operations, allowing arbitrary Vimscript execution. This can be leveraged to run shell commands with the privileges of the user running Vim. Important: This Vimscript injection flaw in netrw allows arbitrary code execution with user privileges. Exploitation requires a local attacker to place a specially crafted filename in a directory and a victim to browse that directory with netrw and interact with the malicious entry. This directly impacts the confidentiality, integrity, and availability of the user's data and environment. Red Hat severity: Important — CVSS 7.8 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Weakness: CWE-94. Under investigation: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat OpenShift Container Platform 4.
High [CVE-2026-76235] unauthenticated remote memory leak via CockpitLang cookie in send_login_html
A memory leak flaw was found in cockpit-ws. The login page handler leaks a heap allocation on every unauthenticated request that carries a CockpitLang cookie, allowing a remote unauthenticated attacker to exhaust memory on the host and cause a denial of service. Red Hat rates this issue as Moderate impact. Although cockpit-ws is reachable by an unauthenticated remote client and the resulting memory exhaustion can be sustained indefinitely, cockpit-ws is a stateless web console component: its crash or restart does not itself compromise the confidentiality or integrity of the host or of other running services, and the process is automatically restarted by systemd. Red Hat severity: Moderate — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-401. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9. Red Hat lists Red Hat OpenShift Dev Spaces as not affected. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat package: cockpit.
High [CVE-2026-76038] Remote code execution via type confusion in crafted HTML.
Remote code execution via type confusion in crafted HTML. Red Hat rates this important (CVSS 8.8). Weakness: CWE-843.
High [CVE-2026-76041] Information leak allows web origin policy bypass
Information leak allows web origin policy bypass. Red Hat rates this important (CVSS 7.4). Weakness: CWE-346.
High [CVE-2026-76047] Arbitrary code execution via type confusion in V8
Arbitrary code execution via type confusion in V8. Red Hat rates this important (CVSS 8.3). Weakness: CWE-843.
High [CVE-2026-76045] Arbitrary code execution via use-after-free
Use after free in WebGL in Google Chrome prior to 151.0.7922.169 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) This can be achieved by enticing a user to visit a specially crafted HTML page, leading to a high-severity security risk. This vulnerability is rated Important as it allows a remote attacker to execute arbitrary code within the browser's sandbox by enticing a user to visit a specially crafted HTML page. The use-after-free flaw in WebGL affects the Chromium browser, which is available in Red Hat Community Projects. Successful exploitation could lead to significant impact on confidentiality, integrity, and availability. Red Hat severity: Important — CVSS 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Weakness: CWE-825.
High [CVE-2026-76043] Arbitrary code execution via incorrect calculation in HTML processing
Arbitrary code execution via incorrect calculation in HTML processing. Red Hat rates this important (CVSS 8.8). Weakness: CWE-190.
High [CVE-2026-76039] Information disclosure via incorrect reference resolution
Information disclosure via incorrect reference resolution. Red Hat rates this important (CVSS 7.1). Weakness: CWE-386.
High [CVE-2026-76040] Arbitrary code execution via use-after-free vulnerability
Arbitrary code execution via use-after-free vulnerability. Red Hat rates this important (CVSS 8.3). Weakness: CWE-825.
High [CVE-2026-76037] Arbitrary Code Execution via Link Following
Arbitrary Code Execution via Link Following. Red Hat rates this important (CVSS 8.2). Weakness: CWE-59.
High [CVE-2026-76033] Site isolation bypass due to inappropriate CORS implementation
Site isolation bypass due to inappropriate CORS implementation. Red Hat rates this important (CVSS 8.7). Weakness: CWE-653.
High [CVE-2026-76036] Dawn in Google Chrome: Arbitrary code execution via crafted HTML page
Dawn in Google Chrome: Arbitrary code execution via crafted HTML page. Red Hat rates this important (CVSS 8.3). Weakness: CWE-120.
High [CVE-2026-15571] Predictable account-linking hash enables account takeover via malicious OIDC client
Predictable account-linking hash enables account takeover via malicious OIDC client. Red Hat rates this important (CVSS 7.3). Weakness: CWE-341. Red Hat lists fixing advisory RHSA-2026:56524 with package rhbk/keycloak-rhel9:26.6-12, rhbk/keycloak-rhel9, keycloak-services, rhbk-openshift-rhel9/rhbk-openshift-rhel9. Affected product named by the advisory: Red Hat build of Keycloak 26.6.6.
High [CVE-2026-66783] arbitrary image override enables privileged code execution on every node
arbitrary image override enables privileged code execution on every node. Red Hat rates this important (CVSS 8.2). Weakness: CWE-20. Affected product named by the advisory: Red Hat Advanced Cluster Management for Kubernetes 2.