---METADATA---
VENDOR: Red Hat
PRODUCT: Keycloak
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A flaw in the Red Hat Keycloak Policy Enforcer allows for improper access control, potentially bypassing security constraints during authentication processes.

Executive Summary:
A high-severity flaw in the Red Hat Keycloak Policy Enforcer could allow attackers to bypass critical access control mechanisms, leading to unauthorized resource access.

Vulnerability Details

CVE-ID: CVE-2026-9800

Affected Software: Red Hat Keycloak

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability involves a flaw in the Policy Enforcer component, which fails to correctly validate user permissions. The issue typically requires the attacker to be authenticated, potentially allowing them to escalate privileges or access resources outside their authorized scope.

Business Impact

Successful exploitation allows for unauthorized access to sensitive identity and access management (IAM) functions, which may lead to total system compromise and data breach. The CVSS score of 8.1 underscores the critical nature of this vulnerability, as it directly undermines the centralized security posture of the affected organization.

Remediation Plan

Immediate Action: Update the Red Hat build of Keycloak to the latest version provided by the vendor to remediate the policy enforcement logic.

Proactive Monitoring: Audit Keycloak logs for unusual policy evaluation results or unauthorized attempts to access restricted administrative functions.

Compensating Controls: Implement strict Role-Based Access Control (RBAC) and utilize Web Application Firewalls to inspect traffic for patterns indicative of policy bypass attempts.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations relying on Keycloak for authentication and authorization must treat this update with extreme urgency. Failure to patch the Policy Enforcer could result in a catastrophic failure of identity security across the enterprise.

---METADATA---
VENDOR: Red Hat
PRODUCT: KubeVirt
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
A flaw in KubeVirt's virt-handler allows an authenticated user to hijack privileged connections, potentially leading to full cluster compromise.

Executive Summary:
A critical symlink validation vulnerability in KubeVirt allows an authenticated user to gain full control over the node and the entire cluster.

Vulnerability Details

CVE-ID: CVE-2026-7374

Affected Software: Red Hat KubeVirt

Affected Versions: See vendor advisory

Vulnerability: The virt-handler component fails to properly validate symlinks when connecting to virtual machine console sockets. An authenticated user can replace the console socket with a symlink to the host's container runtime socket, hijacking the privileged connection.

Business Impact

With a CVSS score of 9.9, this vulnerability is extremely severe. It allows an authenticated user with limited namespace permissions to break out of their container, access the host's runtime, and potentially gain full administrative control over the entire Kubernetes cluster.

Remediation Plan

Immediate Action: Update virt-handler to the latest version that includes proper symlink validation for console sockets.

Proactive Monitoring: Monitor for unusual symlink creation activities within the cluster and review system logs for unauthorized access attempts to the container runtime socket.

Compensating Controls: Use security policies to limit the capabilities of users and ensure that sensitive host sockets are not accessible to non-privileged containers.

Exploitation Status

Public Exploit Available: True

Analyst Notes: As of May 26, 2026, there is public information indicating that an exploit is available. This increases the urgency for immediate patching across all affected clusters.

Analyst Recommendation

This is a high-stakes vulnerability for Kubernetes environments. Cluster administrators must update virt-handler immediately and review cluster security policies to prevent unauthorized exploitation of this symlink validation flaw.

---METADATA---
VENDOR: Red Hat
PRODUCT: Enterprise Linux
AFFECTED_VERSIONS: Red Hat Enterprise Linux 6, 7, 8, 9, 10, and Hardened Images
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The openvt utility in Red Hat Enterprise Linux contains an improper access control vulnerability when using the -u flag, potentially allowing unauthorized privilege escalation.

Executive Summary:
A high-severity privilege escalation vulnerability exists in the openvt utility across multiple Red Hat Enterprise Linux versions that could allow a local attacker to gain unauthorized access.

Vulnerability Details

CVE-ID: CVE-2026-72693

Affected Software: Red Hat Enterprise Linux

Affected Versions: Red Hat Enterprise Linux 6, 7, 8, 9, 10, and Hardened Images

Vulnerability: This vulnerability involves improper access control within the openvt command, which is intended to execute login as a specific user from a privileged context. An attacker with local access and low privileges can exploit this flaw to execute commands with elevated permissions (PR:L).

Business Impact

Successful exploitation of this flaw allows a local user to escalate privileges to the level of the target user, which often includes root or administrative access. Given the CVSS score of 7.8, this poses a significant risk to system integrity and confidentiality, potentially leading to a full system compromise.

Remediation Plan

Immediate Action: Monitor the Red Hat Security Advisory portal for the release of patched packages for your specific distribution and apply them immediately upon availability.

Proactive Monitoring: Review system authentication and command execution logs for anomalous activity related to the openvt utility or unexpected privilege transitions.

Compensating Controls: Restrict execution permissions for the openvt binary to only necessary administrative users to minimize the attack surface until a patch is applied.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 11, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is inherently exploitable by local users who have the ability to trigger the openvt command.

Analyst Recommendation

This vulnerability represents a serious risk to local system security, particularly in multi-user environments. Organizations should prioritize patching as soon as Red Hat releases the official security updates to prevent potential unauthorized privilege escalation.

---METADATA---
VENDOR: Red Hat
PRODUCT: Red Hat Advanced Cluster Management for Kubernetes
AFFECTED_VERSIONS: Red Hat Advanced Cluster Management for Kubernetes 2
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A flaw in the multicloud-integrations component allows authenticated tenants to perform arbitrary code execution or privilege escalation on managed clusters via improper annotation validation.

Executive Summary:
A critical vulnerability in Red Hat Advanced Cluster Management for Kubernetes 2 allows authenticated tenants to escalate privileges to cluster-admin on connected spoke clusters.

Vulnerability Details

CVE-ID: CVE-2026-72526

Affected Software: Red Hat Advanced Cluster Management for Kubernetes

Affected Versions: Red Hat Advanced Cluster Management for Kubernetes 2

Vulnerability: This vulnerability involves a confused deputy mechanism where improper annotation validation allows an authenticated user with Application creation permissions on the hub cluster to execute arbitrary code or gain elevated privileges on managed spoke clusters.

Business Impact

The vulnerability carries a CVSS score of 9.9, indicating an extreme risk to the integrity and availability of the entire container orchestration environment. Successful exploitation allows a tenant to bypass security boundaries, resulting in full unauthorized control over managed clusters, which could lead to massive data exfiltration, lateral movement, or complete system disruption.

Remediation Plan

Immediate Action: Update Red Hat Advanced Cluster Management for Kubernetes 2 to the latest available version provided by the vendor.

Proactive Monitoring: Monitor hub and spoke cluster access logs for anomalous annotation activity or unauthorized attempts to perform administrative actions on managed clusters.

Compensating Controls: Restrict Application creation permissions to highly trusted users until the patch can be applied, and ensure RBAC policies are strictly enforced across the hub cluster.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 12, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the potential for cross-cluster privilege escalation.

Analyst Recommendation

Given the critical CVSS score of 9.9 and the potential for total compromise of connected infrastructure, this vulnerability requires immediate attention. Security teams should prioritize patching the hub cluster and reviewing existing RBAC configurations to limit the blast radius of any potentially compromised accounts.

---METADATA---
VENDOR: Red Hat
PRODUCT: Red Hat Advanced Cluster Management for Kubernetes 2
AFFECTED_VERSIONS: Red Hat Advanced Cluster Management for Kubernetes 2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An input validation flaw in the acm-search-v2-rhel9 component allows authenticated attackers to perform OS command or SQL injection, potentially leading to arbitrary code execution.

Executive Summary:
This critical vulnerability in Red Hat Advanced Cluster Management for Kubernetes 2 permits authenticated attackers to execute arbitrary commands or SQL queries, risking full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-71472

Affected Software: Red Hat Advanced Cluster Management for Kubernetes 2

Affected Versions: Red Hat Advanced Cluster Management for Kubernetes 2

Vulnerability: The vulnerability exists in the acm-search-v2-rhel9 component, which fails to sanitize the WORK_MEM string within Search Custom Resources. An authenticated attacker can inject malicious shell commands or SQL statements that are executed by the privileged postgres pod.

Business Impact

Assigned a CVSS score of 9.1, this command and SQL injection vulnerability is highly dangerous. By gaining code execution within the privileged postgres pod, an attacker can manipulate sensitive data, escalate privileges further, or disrupt the operation of the entire management cluster.

Remediation Plan

Immediate Action: Update Red Hat Advanced Cluster Management for Kubernetes 2 to the latest version as recommended by the vendor.

Proactive Monitoring: Monitor database query logs and shell execution logs on the postgres pod for unusual syntax or unauthorized command patterns.

Compensating Controls: Restrict access to the Search Custom Resource creation permissions to only the most trusted administrative users until the patch is applied.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Aug 17, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly exploitable by authorized users, making strict access control a necessary temporary measure.

Analyst Recommendation

The severity of this vulnerability necessitates immediate remediation. Security teams must ensure that all instances of Red Hat Advanced Cluster Management for Kubernetes 2 are updated to the current secure version to prevent unauthorized code execution and data compromise.

---METADATA---
VENDOR: Red Hat
PRODUCT: Advanced Cluster Management for Kubernetes
AFFECTED_VERSIONS: See vendor advisory
CONFIDENCE: medium
MISSING: patch
---END_METADATA---

Description Summary:
A flaw in the search-v2-operator allows for privilege escalation due to a ClusterRole granting excessive permissions, including the ability to manage RBAC configurations and approve CSRs.

Executive Summary:
A critical privilege escalation vulnerability exists in the Red Hat Advanced Cluster Management search-v2-operator that could allow an attacker to gain cluster administrator privileges.

Vulnerability Details

CVE-ID: CVE-2026-70496

Affected Software: Red Hat Advanced Cluster Management for Kubernetes

Affected Versions: See vendor advisory

Vulnerability: This vulnerability is an instance of CWE-250, where the operator utilizes a ClusterRole with excessive permissions. An authenticated attacker with low privileges can leverage this misconfiguration to impersonate entities, modify RBAC rules, and manage critical cluster resources.

Business Impact

Successful exploitation of this vulnerability could lead to a complete compromise of the Kubernetes cluster environment. Given the CVSS score of 9.9, the impact on confidentiality, integrity, and availability is total, potentially resulting in unauthorized data access, service disruption, and the loss of entire containerized workloads.

Remediation Plan

Immediate Action: Consult the official Red Hat security advisory to identify and apply the latest security updates or configuration workarounds for the search-v2-operator.

Proactive Monitoring: Monitor Kubernetes audit logs for suspicious activities related to RBAC changes, CSR approvals, and unauthorized use of the search-v2-operator service account.

Compensating Controls: Implement restrictive network policies and limit the scope of service accounts to adhere to the principle of least privilege, reducing the potential impact of a compromised operator.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 19, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the broad scope of the permissions granted to the vulnerable operator.

Analyst Recommendation

This vulnerability represents a severe risk to cluster security. Administrators should prioritize reviewing the security advisory provided by Red Hat and apply all necessary updates or hardening steps to restrict the operator's privileges immediately.

---METADATA---
VENDOR: Red Hat
PRODUCT: Red Hat Advanced Cluster Management for Kubernetes
AFFECTED_VERSIONS: 2
CONFIDENCE: medium
MISSING: versions
---END_METADATA---

Description Summary:
A privilege management flaw in the search-v2-operator of Red Hat Advanced Cluster Management for Kubernetes may lead to unauthorized privilege escalation.

Executive Summary:
An improper privilege management vulnerability in Red Hat Advanced Cluster Management for Kubernetes allows local authenticated users to escalate privileges and impact cluster security.

Vulnerability Details

CVE-ID: CVE-2026-70495

Affected Software: Red Hat Advanced Cluster Management for Kubernetes

Affected Versions: 2

Vulnerability: This is a privilege management issue within the search-v2-operator that allows a local user with low privileges to gain unauthorized control over cluster resources.

Business Impact

Successful exploitation allows an attacker to escalate privileges, potentially leading to full cluster compromise, unauthorized access to sensitive data, and the ability to modify or delete infrastructure resources. The CVSS score of 8.8 reflects the high risk of this vulnerability to the integrity and confidentiality of the entire Kubernetes cluster environment.

Remediation Plan

Immediate Action: Consult the Red Hat security advisory and apply the necessary patches or configuration changes to the search-v2-operator component immediately.

Proactive Monitoring: Monitor Kubernetes audit logs for suspicious activity involving operator service accounts or unexpected privilege changes.

Compensating Controls: Implement strict Role-Based Access Control (RBAC) policies to limit the potential impact if a local account is compromised.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 18, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The complexity of the environment suggests that exploitation requires prior local access to the cluster.

Analyst Recommendation

Given the high CVSS score, this vulnerability should be treated as a priority. Administrators should audit their current cluster configurations and apply vendor-provided security updates to the affected operator components as soon as possible.

---METADATA---
VENDOR: Red Hat
PRODUCT: dracut
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
A command injection vulnerability in dracut's legacy DHCP path allows remote attackers on an adjacent network to execute code as root within the initramfs.

Executive Summary:
A high-severity command injection flaw in dracut allows unauthenticated attackers on an adjacent network to achieve root code execution during the system initialization process.

Vulnerability Details

CVE-ID: CVE-2026-6893

Affected Software: Red Hat Enterprise Linux, OpenShift Container Platform, and Hardened Images (using dracut)

Affected Versions: See vendor advisory

Vulnerability: This is a command injection vulnerability located in the legacy DHCP path of dracut. An attacker on an adjacent network can supply specially crafted DHCP options that are improperly handled, resulting in root-level code execution within the initramfs environment.

Business Impact

The CVSS score of 8.8 reflects the high severity of this flaw, as it grants an attacker root access during the early stages of the boot process. This can lead to total system compromise, including the ability to bypass security controls, persist across reboots, and access encrypted data.

Remediation Plan

Immediate Action: Apply the vendor-provided security patches for dracut as detailed in the official Red Hat security advisory.

Proactive Monitoring: Monitor network traffic for suspicious DHCP activity and review system logs for anomalies occurring during the boot sequence.

Compensating Controls: Restrict physical and network access to the local segment to prevent unauthorized devices from interacting with the DHCP service.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 11, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability is particularly dangerous as it occurs during system startup. Administrators must apply the latest patches provided by Red Hat immediately. Until patching is complete, ensure that only trusted devices are connected to the network segment to mitigate the risk of adjacent network attacks.

---METADATA---
VENDOR: Red Hat
PRODUCT: Multicluster Engine for Kubernetes
AFFECTED_VERSIONS: Red Hat Multicluster Engine for Kubernetes
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Improper validation of Certificate Signing Requests in the managedcluster-import-controller allows privileged service accounts to escalate privileges and obtain administrative hub credentials.

Executive Summary:
This critical vulnerability in Red Hat Multicluster Engine for Kubernetes enables a privileged service account to perform privilege escalation and gain unauthorized administrative access to the hub cluster.

Vulnerability Details

CVE-ID: CVE-2026-66795

Affected Software: Red Hat Multicluster Engine for Kubernetes

Affected Versions: Red Hat Multicluster Engine for Kubernetes

Vulnerability: The managedcluster-import-controller fails to properly validate Certificate Signing Requests (CSRs) by neglecting to inspect signer names or decode PEM-encoded x509 data. This allows an authenticated user with high privileges on a spoke cluster to submit malicious CSRs that the hub cluster incorrectly approves.

Business Impact

With a CVSS score of 9.1, this vulnerability poses a severe risk to the integrity of the hub-and-spoke management architecture. An attacker successfully exploiting this flaw can obtain administrative credentials for the hub cluster, effectively seizing control of the entire multicluster environment and all associated managed workloads.

Remediation Plan

Immediate Action: Update Red Hat Multicluster Engine for Kubernetes to the latest version immediately to ensure CSR validation logic is correctly implemented.

Proactive Monitoring: Audit logs for suspicious Certificate Signing Request approvals and review the integrity of existing cluster service accounts.

Compensating Controls: Restrict the ability of spoke cluster service accounts to submit CSRs until the patch can be deployed across the environment.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Aug 17, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw requires high privileges on a spoke cluster, which slightly limits the attack surface while remaining a significant threat to hub security.

Analyst Recommendation

This vulnerability represents a significant threat to the centralized management plane. Organizations should prioritize the deployment of the vendor-provided update to prevent potential administrative credential theft and subsequent unauthorized access to the global hub.

---METADATA---
VENDOR: Red Hat
PRODUCT: Multicluster Global Hub
AFFECTED_VERSIONS: Red Hat Multicluster Global Hub, Red Hat Advanced Cluster Management for Kubernetes
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A privilege escalation vulnerability in the multicloud-operators-subscription component allows users to deploy resources with elevated permissions via crafted Subscription annotations.

Executive Summary:
This critical vulnerability in Red Hat Multicluster Global Hub and Advanced Cluster Management for Kubernetes allows an authenticated user to escalate privileges and gain unauthorized control over cluster resources.

Vulnerability Details

CVE-ID: CVE-2026-66792

Affected Software: Red Hat Multicluster Global Hub and Red Hat Advanced Cluster Management for Kubernetes

Affected Versions: Red Hat Multicluster Global Hub, Red Hat Advanced Cluster Management for Kubernetes

Vulnerability: The flaw exists in the multicloud-operators-subscription component, which fails to properly sanitize user-provided annotations. An authenticated user on a managed cluster can leverage these annotations to deploy resources into any namespace using the controller's elevated Service Account permissions.

Business Impact

The vulnerability carries a CVSS score of 9.9, reflecting its critical severity. Successful exploitation permits an attacker to bypass security boundaries and achieve full administrative control over managed clusters, leading to potential data exfiltration, service disruption, and total compromise of the containerized environment.

Remediation Plan

Immediate Action: Update Red Hat Multicluster Global Hub and Red Hat Advanced Cluster Management for Kubernetes to the latest available version provided by the vendor.

Proactive Monitoring: Review cluster access logs for anomalous Subscription creation events or unauthorized resource deployments in restricted namespaces.

Compensating Controls: Implement strict Kubernetes Network Policies and Role-Based Access Control (RBAC) to limit the impact of compromised service accounts while the update process is underway.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Aug 17, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its ability to escalate privileges across namespaces without complex prerequisites beyond standard authenticated access.

Analyst Recommendation

Given the critical nature of this privilege escalation flaw, administrators must prioritize patching across all managed clusters immediately. Failure to update leaves the infrastructure vulnerable to full cluster compromise by any user with subscription creation rights.

---METADATA---
VENDOR: Red Hat
PRODUCT: Advanced Cluster Management for Kubernetes
AFFECTED_VERSIONS: 2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A flaw in the submariner-operator component allows a compromised cluster to perform MITM attacks across a cluster mesh by overwriting endpoint information due to excessive permissions.

Executive Summary:
A critical access control vulnerability in Red Hat Advanced Cluster Management for Kubernetes allows an authenticated attacker to compromise inter-cluster traffic security.

Vulnerability Details

CVE-ID: CVE-2026-66780

Affected Software: Red Hat Advanced Cluster Management for Kubernetes 2

Affected Versions: 2

Vulnerability: The vulnerability exists in the submariner-operator component, specifically within the submariner-k8s-broker-cluster Role. This flaw permits an attacker with low-level authenticated access to a joined cluster to manipulate network configurations and redirect inter-cluster tunnel traffic.

Business Impact

The exploitation of this vulnerability carries a high risk to business operations, as it facilitates unauthorized interception of sensitive data transferred between clusters. With a CVSS score of 9.9, the potential for a complete Man-in-the-Middle attack across the entire cluster mesh could lead to total compromise of confidentiality, integrity, and availability within the affected Kubernetes environment.

Remediation Plan

Immediate Action: Update Red Hat Advanced Cluster Management for Kubernetes 2 to the latest version as provided by the vendor.

Proactive Monitoring: Monitor inter-cluster network traffic for unusual redirection patterns and review Kubernetes access logs for unauthorized modifications to endpoint configurations.

Compensating Controls: Implement strict network policies and service mesh security controls to limit the blast radius of a potentially compromised cluster.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of August 18, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's inherent exploitability is significant due to the nature of the excessive permissions granted within the cluster mesh configuration.

Analyst Recommendation

Given the critical nature of this flaw and its potential to disrupt the security of an entire Kubernetes mesh, organizations should prioritize patching immediately. Ensure that the latest updates are applied to the submariner-operator component to remediate the excessive permissioning issue and prevent potential traffic interception.

---METADATA---
VENDOR: GIMP
PRODUCT: GIMP (file-fits plugin)
AFFECTED_VERSIONS: Red Hat Enterprise Linux 6, 7, 8, 9
CONFIDENCE: medium
MISSING: patch
---END_METADATA---

Description Summary:
An integer overflow vulnerability in the GIMP file-fits plugin can be triggered by processing a malicious file, potentially leading to arbitrary code execution.

Executive Summary:
An integer overflow vulnerability in the GIMP file-fits plugin poses a significant risk of arbitrary code execution when processing specially crafted files on Red Hat Enterprise Linux systems.

Vulnerability Details

CVE-ID: CVE-2026-66758

Affected Software: GIMP (file-fits plugin) on Red Hat Enterprise Linux 6, 7, 8, and 9

Affected Versions: All versions currently packaged for the identified Red Hat Enterprise Linux releases.

Vulnerability: The file-fits plugin in GIMP contains an integer overflow flaw (CWE-190) that occurs when handling image data, which can be exploited by an attacker to cause memory corruption.

Business Impact

A successful exploit requires user interaction, such as opening a malicious file. If successful, the vulnerability could allow an attacker to execute arbitrary code with the privileges of the user running GIMP, potentially leading to total system compromise and data loss, consistent with the high CVSS score of 7.8.

Remediation Plan

Immediate Action: Check the Red Hat Security Advisory portal for the latest package updates and apply patches to the GIMP software suite immediately.

Proactive Monitoring: Monitor systems for unexpected GIMP application crashes, which may indicate an exploitation attempt.

Compensating Controls: Instruct users to avoid opening untrusted or unknown FITS format files from unverified sources until the patch is applied.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 28, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Integer overflows in image processing plugins are common but typically require specifically crafted files to trigger.

Analyst Recommendation

Users and administrators should prioritize updating the GIMP package on all Red Hat Enterprise Linux systems. Given the nature of image processing flaws, exercising caution when handling files from untrusted sources is a necessary secondary measure until the software is fully patched.

---METADATA---
VENDOR: Red Hat
PRODUCT: libvirt
AFFECTED_VERSIONS: Red Hat Enterprise Linux 6, 7, 8, 9, 10, and Red Hat Enterprise Linux for NVIDIA 26
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A flaw in libvirt involving improper link resolution during file access could allow a local attacker to manipulate file operations and potentially escalate privileges.

Executive Summary:
A high-severity local security flaw in the libvirt library could permit unauthorized file access or privilege escalation on affected Red Hat Enterprise Linux systems.

Vulnerability Details

CVE-ID: CVE-2026-63622

Affected Software: Red Hat Enterprise Linux (via libvirt)

Affected Versions: Red Hat Enterprise Linux 6, 7, 8, 9, 10, and Red Hat Enterprise Linux for NVIDIA 26

Vulnerability: The vulnerability is categorized as CWE-59, which involves improper link resolution before file access. A local attacker with low privileges (PR:L) can leverage this flaw to perform unauthorized file operations, bypassing standard security constraints.

Business Impact

The ability to manipulate file access via libvirt poses a severe threat to virtualized environments, potentially allowing an attacker to escape container or virtual machine boundaries. With a CVSS score of 7.8, this vulnerability could lead to the exposure of sensitive data stored on the host or the corruption of critical system files.

Remediation Plan

Immediate Action: Apply vendor-supplied security updates for libvirt as soon as they are made available through the Red Hat errata channels.

Proactive Monitoring: Monitor system logs for unusual file access patterns or errors originating from libvirt services, which may indicate attempts to exploit link resolution flaws.

Compensating Controls: Implement strict SELinux or AppArmor profiles to confine the libvirt process and limit the scope of potential file system interactions.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 11, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Link following vulnerabilities are typically exploited by local attackers to gain unauthorized access to restricted files.

Analyst Recommendation

Due to the critical role libvirt plays in virtualization security, this issue must be addressed with high priority. Administrators should ensure that all systems are updated to the latest secure versions as soon as Red Hat provides the necessary patches.

---METADATA---
VENDOR: Red Hat
PRODUCT: Red Hat Enterprise Linux (GIMP plugins)
AFFECTED_VERSIONS: Red Hat Enterprise Linux 6, 7, 8, 9
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A flaw in GIMP file format plugins, specifically for PSD and PAA files, allows for out-of-bounds writes that can be triggered by processing malicious files.

Executive Summary:
Memory corruption vulnerabilities in GIMP file format plugins across multiple versions of Red Hat Enterprise Linux pose a risk of arbitrary code execution through malicious image files.

Vulnerability Details

CVE-ID: CVE-2026-59091

Affected Software: Red Hat Enterprise Linux (GIMP)

Affected Versions: Red Hat Enterprise Linux 6, 7, 8, 9

Vulnerability: The vulnerability is an out-of-bounds write (CWE-787) occurring within GIMP's file format plugins, specifically when handling PSD or PAA files. This requires a local user to open a specially crafted image file, which then triggers the memory corruption.

Business Impact

The CVSS score of 7.3 reflects the high impact of memory corruption, which can lead to system crashes or arbitrary code execution. If an attacker successfully tricks a user into opening a malicious image file, they could gain the same privileges as the user, leading to potential data compromise or further system-level exploitation.

Remediation Plan

Immediate Action: Apply the relevant security updates provided by Red Hat for the GIMP package across all affected RHEL versions.

Proactive Monitoring: Review system logs for application crashes related to GIMP or image processing tasks.

Compensating Controls: Restrict users from opening image files from untrusted sources and ensure that anti-virus or endpoint detection solutions are configured to scan image files for known malicious patterns.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 11, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Per CISA's SSVC assessment, there is no confirmed active exploitation. The flaw is technically complex but poses a clear risk if users are targeted via malicious files.

Analyst Recommendation

Organizations should ensure that the GIMP software is updated across their RHEL fleet to address the out-of-bounds write vulnerability. Users should be cautioned against opening image files from unverified or suspicious sources until the software has been patched.

---METADATA---
VENDOR: Red Hat
PRODUCT: Red Hat Enterprise Linux (GIMP PSD plugin)
AFFECTED_VERSIONS: Red Hat Enterprise Linux 6, 7, 8, 9
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
An integer underflow vulnerability exists in the GIMP PSD file format plugin within Red Hat Enterprise Linux, potentially allowing for arbitrary code execution or system crashes.

Executive Summary:
A high-severity integer underflow vulnerability in the GIMP PSD plugin on Red Hat Enterprise Linux systems may allow attackers to trigger memory corruption or unauthorized system actions.

Vulnerability Details

CVE-ID: CVE-2026-59090

Affected Software: Red Hat Enterprise Linux (GIMP PSD plugin)

Affected Versions: Red Hat Enterprise Linux 6, 7, 8, and 9

Vulnerability: The flaw is an integer underflow, categorized as CWE-191, occurring when the software processes malformed PSD files. An authenticated user or local attacker providing a crafted file can trigger this condition, leading to memory corruption.

Business Impact

With a CVSS score of 8.4, this vulnerability poses a significant risk to system stability and security. If successfully exploited, it could allow an attacker to gain unauthorized control over the application process, potentially leading to privilege escalation or system-wide compromise depending on the execution context of the GIMP process.

Remediation Plan

Immediate Action: Monitor official Red Hat security advisories for the release of updated packages and apply them to all affected RHEL systems as soon as they become available.

Proactive Monitoring: Scan for anomalous execution patterns in image processing applications and restrict the ability of unauthorized users to execute GIMP with elevated privileges.

Compensating Controls: Implement file integrity monitoring and restrict the processing of untrusted PSD files in high-security environments until patches are applied.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 11, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is inherent to the parsing logic of the GIMP PSD plugin when handling complex or malformed image structures.

Analyst Recommendation

The severity of this issue necessitates a proactive approach to patch management. Security teams should identify all RHEL systems where GIMP is installed and ensure that automated update mechanisms are prepared to deploy the vendor-supplied fix immediately upon release.

---METADATA---
VENDOR: GIMP
PRODUCT: Image Manipulation Program
AFFECTED_VERSIONS: Red Hat Enterprise Linux 6, 7, 8, 9
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
An out-of-bounds write vulnerability in the GIMP image manipulation program, specifically within the Seattle Filmworks file loader, may allow arbitrary code execution.

Executive Summary:
A high-severity out-of-bounds write vulnerability in GIMP could allow an attacker to execute arbitrary code if a user is tricked into opening a malicious image file.

Vulnerability Details

CVE-ID: CVE-2026-59087

Affected Software: GIMP (Image Manipulation Program)

Affected Versions: Red Hat Enterprise Linux 6, 7, 8, 9

Vulnerability: The vulnerability is an out-of-bounds write (CWE-787) occurring during the parsing of Seattle Filmworks image files. Successful exploitation requires user interaction (UI:R) to open a specially crafted file, but the impact can result in code execution with the permissions of the user running the application.

Business Impact

This vulnerability presents a significant risk to workstations where GIMP is used to process untrusted image files. An attacker could gain control over the user session, leading to potential data theft, malware installation, or further lateral movement within the network. The CVSS score of 7.8 reflects the potential for serious impact despite the requirement for user interaction.

Remediation Plan

Immediate Action: Update the GIMP application to the latest version provided by the vendor repository as soon as the security patch is released.

Proactive Monitoring: Monitor for suspicious application crashes or unusual behavior when users open image files from external or untrusted sources.

Compensating Controls: Advise users to exercise caution when opening image files from unknown sources and use sandboxing tools to isolate image processing tasks.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 11, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is typical of memory corruption issues found in image parsers, which are common vectors for code execution.

Analyst Recommendation

Users and administrators should prioritize updating GIMP on all systems. Until updates are applied, users should avoid opening files from untrusted sources to mitigate the risk of triggering this memory corruption flaw.

---METADATA---
VENDOR: GIMP (via Red Hat)
PRODUCT: GIMP
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: medium
MISSING: patch
---END_METADATA---

Description Summary:
An integer overflow vulnerability exists in the GIMP PSD parser, which may lead to memory corruption when processing malformed image files.

Executive Summary:
A memory corruption vulnerability in the GIMP PSD parser could allow an attacker to execute arbitrary code or crash the application if a user is tricked into opening a malicious file.

Vulnerability Details

CVE-ID: CVE-2026-58384

Affected Software: GIMP (distributed via Red Hat Enterprise Linux)

Affected Versions: Red Hat Enterprise Linux 6, 7, 8, 9

Vulnerability: This vulnerability is caused by an integer overflow (CWE-190) within the GIMP PSD parser, requiring a local, authenticated user to interact with a specially crafted PSD file for successful exploitation.

Business Impact

A successful exploit could result in full application compromise, potentially leading to unauthorized data access or the execution of malicious code with the privileges of the user running the application. With a CVSS score of 7.3, this flaw poses a significant risk to workstations where users frequently handle untrusted image files, potentially impacting the integrity and availability of local system resources.

Remediation Plan

Immediate Action: Apply the latest security updates provided by your Linux distribution vendor to ensure the GIMP package is patched.

Proactive Monitoring: Review system logs for signs of application crashes or unusual process behavior associated with GIMP or image processing tasks.

Compensating Controls: Advise users to avoid opening untrusted or unknown PSD files and ensure that GIMP is run with the minimum necessary privileges to reduce the impact of a potential compromise.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Users should prioritize updating their systems to the latest available package versions provided by Red Hat. Given the potential for arbitrary code execution, this update should be applied as part of standard routine maintenance for all affected enterprise workstations.

---METADATA---
VENDOR: GIMP (via Red Hat)
PRODUCT: GIMP
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: medium
MISSING: patch
---END_METADATA---

Description Summary:
An off-by-one error in GIMP's PNM file format parser may cause memory corruption when processing malformed files.

Executive Summary:
An off-by-one error in GIMP’s PNM parser presents a high-severity risk, potentially allowing for application crashes or unauthorized code execution upon opening malicious image files.

Vulnerability Details

CVE-ID: CVE-2026-58380

Affected Software: GIMP (distributed via Red Hat Enterprise Linux)

Affected Versions: Red Hat Enterprise Linux 6, 7, 8, 9

Vulnerability: This vulnerability (CWE-193) stems from an off-by-one error during the parsing of PNM images, which can be triggered when a user opens a malicious file, leading to memory corruption.

Business Impact

The vulnerability carries a CVSS score of 7.3, indicating a high risk of system instability or unauthorized code execution. In a corporate environment, this could lead to the compromise of user accounts and the potential loss of sensitive data if the application process is manipulated to execute attacker-supplied payloads.

Remediation Plan

Immediate Action: Update the GIMP application to the latest version via your repository manager or vendor-supplied security patches.

Proactive Monitoring: Monitor for application instability or recurring crashes of image-processing utilities within the organization.

Compensating Controls: Restrict user access to untrusted file sources and ensure that GIMP is configured to run with limited user permissions to minimize the blast radius of potential exploitation.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Security teams should ensure that all systems running GIMP are updated immediately to remediate this off-by-one error. Patching is the most effective way to mitigate this risk, and users should be reminded to exercise caution when handling files from unknown or unverified sources.

---METADATA---
VENDOR: GIMP
PRODUCT: GIMP
AFFECTED_VERSIONS: Red Hat Enterprise Linux 6, 7, 8, 9
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A heap-based buffer overflow vulnerability in GIMP's Paint Shop Pro (PSP) file parser may allow for arbitrary code execution.

Executive Summary:
A heap-based buffer overflow in the GIMP PSP file parser on Red Hat Enterprise Linux systems could allow an attacker to execute arbitrary code.

Vulnerability Details

CVE-ID: CVE-2026-58379

Affected Software: GIMP (running on Red Hat Enterprise Linux)

Affected Versions: Red Hat Enterprise Linux 6, 7, 8, 9

Vulnerability: This is a heap-based buffer overflow (CWE-122) within the Paint Shop Pro (PSP) file format parser. An attacker would likely need to trick an authenticated or local user into opening a specially crafted file to trigger the condition.

Business Impact

Successful exploitation could result in full system compromise, including unauthorized code execution with the privileges of the user running GIMP. The CVSS score of 7.3 reflects the high risk of impact, particularly in multi-user or workstation-heavy environments where malicious files may be introduced.

Remediation Plan

Immediate Action: Update the GIMP package via the Red Hat package manager (yum/dnf) as soon as security advisories are released for your specific distribution.

Proactive Monitoring: Audit system logs for application crashes occurring during image processing tasks, which may indicate exploitation attempts.

Compensating Controls: Restrict the opening of untrusted PSP files and utilize standard OS-level security features like SELinux to limit the impact of potential process exploitation.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 5, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Users should treat this vulnerability with high urgency, particularly on systems where external image files are processed. Ensure that security updates are applied immediately upon release by Red Hat to mitigate the risk of memory corruption attacks.

---METADATA---
VENDOR: Red Hat
PRODUCT: Red Hat Enterprise Linux
AFFECTED_VERSIONS: Red Hat Enterprise Linux 6, 7, 8, 9, 10
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A security flaw in the Samba Active Directory Domain Controller within Red Hat Enterprise Linux allows authenticated users to perform LDAP filter injection and bypass authorization checks.

Executive Summary:
A critical LDAP injection vulnerability in the Samba Active Directory Domain Controller on Red Hat Enterprise Linux permits authenticated users to escalate privileges and compromise domain data.

Vulnerability Details

CVE-ID: CVE-2026-58222

Affected Software: Red Hat Red Hat Enterprise Linux

Affected Versions: Red Hat Enterprise Linux 6, 7, 8, 9, 10

Vulnerability: The vulnerability involves improper neutralization of special elements used in LDAP queries, which, when combined with flawed authorization logic, allows an authenticated user to manipulate backend directory queries.

Business Impact

Successful exploitation allows an authenticated attacker to gain unauthorized access to sensitive directory information or potentially escalate privileges within the domain. With a CVSS score of 8.8, this vulnerability represents a significant risk to the confidentiality and integrity of the entire identity infrastructure.

Remediation Plan

Immediate Action: Consult the official Red Hat security advisory and apply the relevant patches for the Samba AD DC component across all affected RHEL versions.

Proactive Monitoring: Monitor directory service logs for abnormal LDAP queries or unauthorized attempts to access restricted attributes within the Active Directory environment.

Compensating Controls: Restrict access to administrative domain functions and implement granular permission sets to limit the damage an authenticated user can inflict.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of July 31, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Per CISA's SSVC assessment, exploitation is currently considered to have no active status.

Analyst Recommendation

This vulnerability targets the core identity infrastructure of an organization. Security teams must treat this as a high-priority item and coordinate with Red Hat support to apply the necessary patches as soon as they are released for their specific environment.

---METADATA---
VENDOR: Red Hat
PRODUCT: Podman
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A vulnerability exists in Podman, a tool for managing OCI containers and pods, which may allow for unauthorized system interaction.

Executive Summary:
A high-severity vulnerability in Red Hat Podman poses a significant risk to containerized environments and requires immediate attention.

Vulnerability Details

CVE-ID: CVE-2026-57231

Affected Software: Red Hat Podman

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability involves a flaw in the container management operations of Podman, potentially allowing an authenticated user to perform unauthorized actions within the container runtime environment.

Business Impact

The exploitation of this vulnerability could lead to container escape or unauthorized access to sensitive host-level resources, resulting in a breach of isolation boundaries. With a CVSS score of 7.5, this high-severity flaw threatens the integrity of production workloads and could facilitate lateral movement across the infrastructure.

Remediation Plan

Immediate Action: Apply the latest security updates provided by the vendor to the Podman runtime environment immediately.

Proactive Monitoring: Review container logs for unauthorized execution patterns and audit access logs for anomalous API calls to the Podman service.

Compensating Controls: Utilize SELinux or AppArmor profiles to strictly restrict the capabilities of container processes, providing a layer of defense-in-depth.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 28, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the critical role Podman plays in container security, the potential for exploitation remains high.

Analyst Recommendation

Given the severity of this vulnerability, organizations should prioritize patching their container hosts. Security teams must ensure that all Podman instances are updated to the latest version to prevent potential unauthorized access to host resources.

---METADATA---
VENDOR: Red Hat
PRODUCT: PipeWire
AFFECTED_VERSIONS: Red Hat Enterprise Linux 7, 8, and 10
CONFIDENCE: medium
MISSING: patch
---END_METADATA---

Description Summary:
A flaw in the PipeWire multimedia server on Red Hat Enterprise Linux allows a local user to leverage an uncontrolled search path element to escalate privileges or impact system integrity.

Executive Summary:
A high-severity local privilege escalation vulnerability exists in the PipeWire multimedia server, which could allow a standard user to gain elevated access to the host system.

Vulnerability Details

CVE-ID: CVE-2026-5674

Affected Software: Red Hat PipeWire

Affected Versions: Red Hat Enterprise Linux 7, 8, and 10

Vulnerability: This is an uncontrolled search path element vulnerability (CWE-427) within the PipeWire service. It requires local access and low privileges to exploit, but allows for significant impact on the confidentiality, integrity, and availability of the system.

Business Impact

With a CVSS score of 8.8, this vulnerability represents a significant risk to the security of Linux-based server environments. A successful exploit could lead to full system compromise by a local user, resulting in unauthorized data access or complete system takeover, which is especially critical in multi-tenant or shared-hosting environments.

Remediation Plan

Immediate Action: Monitor the Red Hat Security Advisory portal and apply the relevant package updates for PipeWire as soon as they are made available by the vendor.

Proactive Monitoring: Review system audit logs for suspicious execution of binaries or unexpected library loading patterns by non-privileged users.

Compensating Controls: Restrict local user access to the system and ensure that only trusted applications are installed, minimizing the attack surface available to local users.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of July 17, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly exploitable for local users, though it does not appear to be automatable by remote attackers.

Analyst Recommendation

Security teams should track this CVE closely via Red Hat's official channels. Once the security patch is released, it should be deployed across all affected RHEL environments to mitigate the risk of local privilege escalation.

---METADATA---
VENDOR: Red Hat
PRODUCT: Red Hat Satellite
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security vulnerability has been identified in the Foreman component of Red Hat Satellite 6.16 for RHEL 8, which could lead to unauthorized system access.

Executive Summary:
A high-severity flaw within the Foreman component of Red Hat Satellite 6.16 presents a risk of unauthorized access to critical infrastructure management systems.

Vulnerability Details

CVE-ID: CVE-2026-5136

Affected Software: Red Hat Satellite

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability resides in the Foreman component integrated into Red Hat Satellite 6.16 for RHEL 8. It involves a flaw that may permit unauthorized operations, necessitating a prompt investigation into the current patch status of the Satellite server.

Business Impact

With a CVSS score of 8.8, this vulnerability poses a severe threat to the integrity of the enterprise patch management environment. Exploitation could allow an attacker to gain control over managed systems, facilitate supply chain attacks, or manipulate system configurations, leading to widespread service degradation.

Remediation Plan

Immediate Action: Review the Red Hat Security Advisory (RHSA) and apply the latest errata updates for Satellite 6.16 to patch the Foreman component.

Proactive Monitoring: Audit logs within the Satellite/Foreman interface for unauthorized task executions or unexpected configuration changes.

Compensating Controls: Restrict administrative access to the Satellite management console to a limited set of trusted internal IP addresses and enforce multi-factor authentication.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 2, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Red Hat Satellite is a central component of infrastructure management; therefore, this vulnerability must be remediated immediately. Administrators should apply the relevant security patches to ensure the continued security and integrity of the managed RHEL ecosystem.

---METADATA---
VENDOR: Red Hat
PRODUCT: OpenShift Container Platform 4
AFFECTED_VERSIONS: Red Hat OpenShift Container Platform 4
CONFIDENCE: medium
MISSING: patch
---END_METADATA---

Description Summary:
A flaw in the Red Hat OpenShift oauth-proxy component allows for interpretation conflicts, potentially impacting security controls.

Executive Summary:
A high-severity interpretation conflict vulnerability in Red Hat OpenShift Container Platform 4 could allow an authenticated attacker to bypass or manipulate security controls.

Vulnerability Details

CVE-ID: CVE-2026-49332

Affected Software: Red Hat OpenShift Container Platform 4

Affected Versions: Red Hat OpenShift Container Platform 4

Vulnerability: The vulnerability is categorized as CWE-436: Interpretation Conflict. An authenticated attacker with low privileges can exploit this flaw to cause the oauth-proxy to interpret requests in an unintended manner, leading to unauthorized access or security policy bypass.

Business Impact

The vulnerability carries a CVSS score of 8.5, indicating a high risk to the integrity and confidentiality of the container environment. Successful exploitation could lead to unauthorized access to sensitive application data or the escalation of privileges within the OpenShift cluster, resulting in potential data exfiltration or service disruption.

Remediation Plan

Immediate Action: Monitor official Red Hat security advisories for the release of a patched version of the oauth-proxy component and apply it to all affected clusters immediately.

Proactive Monitoring: Review audit logs for unusual authentication patterns or unexpected API request behaviors that deviate from established baselines.

Compensating Controls: Implement strict network policies and ensure that ingress traffic is inspected by a robust Web Application Firewall to mitigate potential exploitation attempts.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 29, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's complexity is low, which may increase the likelihood of exploitation if functional exploit code is developed.

Analyst Recommendation

Given the high CVSS score and the critical nature of identity management in container platforms, administrators should treat this vulnerability with high priority. Organizations must ensure that their OpenShift environments are monitored closely and that security updates are applied as soon as they are made available by Red Hat.

---METADATA---
VENDOR: Red Hat
PRODUCT: Ansible Automation Platform 2
AFFECTED_VERSIONS: Visual Studio Code Ansible Lightspeed extension
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The Visual Studio Code Ansible Lightspeed extension is vulnerable to OS command injection via improper neutralization of special elements in configuration settings.

Executive Summary:
A command injection vulnerability in the VS Code Ansible Lightspeed extension allows arbitrary command execution with the privileges of the local user.

Vulnerability Details

CVE-ID: CVE-2026-44191

Affected Software: Red Hat Ansible Automation Platform 2 (Visual Studio Code Ansible Lightspeed extension)

Affected Versions: Visual Studio Code Ansible Lightspeed extension.

Vulnerability: This is an OS command injection flaw (CWE-78) occurring in the handling of extension configuration settings. Attackers can inject shell commands via specific extension parameters, which may execute automatically during initialization or when running playbooks.

Business Impact

The vulnerability carries a CVSS 3.1 score of 7.8, representing a high-severity risk. Successful exploitation allows an attacker to execute arbitrary commands with the privileges of the user running Visual Studio Code. This can lead to local system compromise, data theft, or the execution of malicious automation routines within the development environment.

Remediation Plan

Immediate Action: Immediately uninstall or disable the Visual Studio Code Ansible Lightspeed extension. Exercise extreme caution by avoiding the opening of untrusted workspaces or executing playbooks from unverified sources.

Proactive Monitoring: Review workstation logs for unexpected shell executions or child processes spawned by the Visual Studio Code application.

Compensating Controls: Audit and sanitize configuration values for ansible.executionEnvironment.containerOptions and ansible.executionEnvironment.volumeMounts if the extension must be utilized in a restricted capacity.

Exploitation Status

Public Exploit Available: No (no confirmed public exploit available in current data).

Analyst Notes: As of July 24, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the potential for automated execution during the initialization of the Language Server.

Analyst Recommendation

Users should prioritize the removal or disabling of the vulnerable extension until a verified fix is provided by the vendor. Maintain strict operational security regarding the source of all Ansible playbooks and workspace configurations to prevent potential injection attempts.

---METADATA---
VENDOR: Red Hat
PRODUCT: Ansible Automation Platform
AFFECTED_VERSIONS: See vendor advisory
CONFIDENCE: medium
MISSING: patch
---END_METADATA---

Description Summary:
A flaw in the Ansible Lightspeed Visual Studio Code extension allows for OS command injection.

Executive Summary:
A vulnerability in the Red Hat Ansible Lightspeed extension for Visual Studio Code could enable an attacker to execute arbitrary OS commands on the host system.

Vulnerability Details

CVE-ID: CVE-2026-44190

Affected Software: Red Hat Ansible Automation Platform

Affected Versions: See vendor advisory

Vulnerability: This is an OS command injection vulnerability (CWE-78) found in the Ansible Lightspeed extension. The vulnerability requires user interaction to exploit and executes with the privileges of the local user.

Business Impact

The ability to inject OS commands presents a high risk to organizational security, as it facilitates unauthorized code execution on developer machines. With a CVSS score of 7.8, this vulnerability poses a severe threat to the integrity and confidentiality of the development environment, potentially allowing attackers to escalate their presence within the network or exfiltrate proprietary data.

Remediation Plan

Immediate Action: Promptly apply all security updates provided by Red Hat for the Ansible Lightspeed extension.

Proactive Monitoring: Audit logs for suspicious or unauthorized process creation and unexpected command-line arguments originating from the Visual Studio Code host process.

Compensating Controls: Implement endpoint protection solutions that can detect and block unauthorized shell commands or suspicious script execution on developer endpoints.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 24, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The risk is mitigated by the necessity for user interaction to trigger the injection.

Analyst Recommendation

Security teams must ensure that all developer environments are updated to the latest version of the Ansible Lightspeed extension to address this command injection flaw. Given the high-severity classification, this update should be treated as a priority to prevent potential compromise of developer infrastructure.

---METADATA---
VENDOR: Red Hat
PRODUCT: Ansible Automation Platform
AFFECTED_VERSIONS: See vendor advisory
CONFIDENCE: medium
MISSING: patch
---END_METADATA---

Description Summary:
A flaw in the Visual Studio Code Ansible Lightspeed extension allows for argument injection via the AnsiblePlaybookRunProvider.

Executive Summary:
A vulnerability in the Red Hat Ansible Automation Platform extension for Visual Studio Code may allow an attacker to perform argument injection, leading to potential system compromise.

Vulnerability Details

CVE-ID: CVE-2026-44189

Affected Software: Red Hat Ansible Automation Platform

Affected Versions: See vendor advisory

Vulnerability: This is an argument injection vulnerability (CWE-88) occurring within the AnsiblePlaybookRunProvider. The vulnerability requires user interaction to trigger, and the attacker operates with the privileges of the local user running the extension.

Business Impact

Successful exploitation of this vulnerability could lead to arbitrary command execution on the developer's workstation. Given the CVSS score of 7.8, this represents a high-risk scenario where an attacker could gain unauthorized access to sensitive development environments, credentials, or source code, potentially resulting in significant data loss or lateral movement within the corporate network.

Remediation Plan

Immediate Action: Review the official Red Hat security advisory and apply all provided updates for the Ansible Lightspeed extension immediately.

Proactive Monitoring: Monitor developer workstations for anomalous process execution patterns or unexpected shell commands initiated by the Visual Studio Code environment.

Compensating Controls: Ensure that developers follow the principle of least privilege by running development tools with the minimum necessary permissions to limit the impact of potential command injection.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 24, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's exploitability is constrained by the requirement for user interaction.

Analyst Recommendation

Organizations utilizing the Ansible Lightspeed extension should prioritize the identification of affected instances and apply vendor patches as soon as they become available. Given the potential for total impact on the affected system, immediate attention is required to mitigate this high-severity risk.

---METADATA---
VENDOR: Red Hat
PRODUCT: Red Hat Enterprise Linux
AFFECTED_VERSIONS: Red Hat Enterprise Linux 6, 7, 8, 9
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A heap-based buffer overflow vulnerability exists in the GIMP DirectDraw Surface file parser, which could allow for code execution when processing malicious files.

Executive Summary:
A heap-based buffer overflow in the GIMP DDS file parser on Red Hat Enterprise Linux may allow an attacker to execute arbitrary code via a specially crafted image file.

Vulnerability Details

CVE-ID: CVE-2026-42170

Affected Software: Red Hat Enterprise Linux

Affected Versions: Red Hat Enterprise Linux 6, 7, 8, 9

Vulnerability: This is a heap-based buffer overflow (CWE-131) occurring within the DirectDraw Surface (DDS) parser. The vulnerability requires user interaction, as a victim must open a maliciously crafted image file for the overflow to be triggered.

Business Impact

Successful exploitation of this buffer overflow could result in arbitrary code execution, potentially leading to total system compromise or data exfiltration. Given the CVSS score of 7.8, this flaw represents a significant risk to workstations or servers that process image files from untrusted sources.

Remediation Plan

Immediate Action: Monitor the Red Hat security advisory page for the release of updated packages and apply them immediately upon availability.

Proactive Monitoring: Review application logs for crashes associated with image processing software and restrict the opening of files from unknown or untrusted external sources.

Compensating Controls: Utilize sandboxing technologies for image viewers or file conversion utilities to limit the impact of potential memory corruption vulnerabilities.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 9, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Heap-based overflows of this nature are inherently complex to weaponize reliably.

Analyst Recommendation

Users should exercise caution when handling DDS files from untrusted origins until official security patches are applied. Organizations should ensure that all systems running Red Hat Enterprise Linux are patched as soon as the vendor updates are released.

---METADATA---
VENDOR: Red Hat
PRODUCT: Keycloak
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
A security flaw has been identified in Keycloak, an open-source identity and access management solution, which could compromise authentication processes.

Executive Summary:
A vulnerability in Keycloak poses a risk to identity and access management, potentially allowing attackers to compromise user sessions or bypass security policies.

Vulnerability Details

CVE-ID: CVE-2026-3872

Affected Software: Keycloak

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: A flaw was discovered in Keycloak's core identity management components. While the specific vulnerability type is not detailed in the summary, such flaws in Keycloak often involve session management, token validation, or improper handling of authentication requests.

Business Impact

As Keycloak is responsible for securing numerous applications and services, a vulnerability in this component can have widespread consequences. An attacker could potentially gain unauthorized access to multiple integrated systems, leading to data breaches and loss of trust. The CVSS score of 7.3 reflects the High severity and the critical nature of the affected service.

Remediation Plan

Immediate Action: Apply the latest security patches provided by the Keycloak project or Red Hat immediately.

Proactive Monitoring: Monitor Keycloak server logs for suspicious authentication attempts, token refresh anomalies, or unauthorized administrative actions.

Compensating Controls: Utilize a Web Application Firewall (WAF) to filter malicious requests and ensure that Keycloak is deployed behind a secure reverse proxy with updated security headers.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 4, 2026, there is no public information indicating active exploitation of this vulnerability. Keycloak vulnerabilities are frequently targeted due to their role as a central authentication hub.

Analyst Recommendation

Identity management is the cornerstone of modern security architecture. It is imperative that administrators identify the specific affected versions and apply the recommended vendor updates immediately to prevent unauthorized access to the entire application ecosystem.

---METADATA---
VENDOR: Red Hat
PRODUCT: Red Hat Enterprise Linux
AFFECTED_VERSIONS: 6, 7, 8, 9, 10
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A code injection vulnerability exists within the DBI component of Red Hat Enterprise Linux, potentially allowing authenticated users to inject and execute arbitrary code.

Executive Summary:
A high-severity code injection vulnerability in the DBI component of Red Hat Enterprise Linux requires immediate attention to prevent unauthorized command execution.

Vulnerability Details

CVE-ID: CVE-2026-19546

Affected Software: Red Hat Enterprise Linux

Affected Versions: 6, 7, 8, 9, 10

Vulnerability: The flaw is an improper control of code generation (CWE-94) residing in the DBI (Database Interface) component. An attacker with low-level authenticated access can leverage this vulnerability to perform code injection, leading to high impacts on confidentiality, integrity, and availability.

Business Impact

The CVSS score of 8.8 reflects the potential for severe system compromise. Because this vulnerability affects the core database interface, a successful exploit could allow an attacker to execute arbitrary code with the privileges of the database service, leading to total data exfiltration or system takeover.

Remediation Plan

Immediate Action: Check the Red Hat Security Advisory (RHSA) portal for the latest security errata and apply the necessary patches for the DBI component.

Proactive Monitoring: Monitor database query logs for anomalous behavior or unexpected system calls originating from the database interface.

Compensating Controls: Apply principle of least privilege to database service accounts and ensure that database interfaces are not exposed to untrusted users or network segments.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 12, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is inherently dangerous due to its position in the database interaction layer.

Analyst Recommendation

Organizations running Red Hat Enterprise Linux should immediately monitor Red Hat security bulletins for the specific patch release. Given the broad range of affected versions, patching should be treated as a high-priority maintenance task to secure the database layer against potential code injection attacks.

---METADATA---
VENDOR: Red Hat
PRODUCT: Red Hat Enterprise Linux
AFFECTED_VERSIONS: Red Hat Enterprise Linux 7, 8, 9, and 10
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Multiple integer overflow and underflow vulnerabilities in the GStreamer gst-plugins-ugly ASF demuxer allow for potential denial of service via specially crafted media files.

Executive Summary:
A critical vulnerability in the GStreamer ASF demuxer affects multiple versions of Red Hat Enterprise Linux and may lead to application crashes or denial of service.

Vulnerability Details

CVE-ID: CVE-2026-19389

Affected Software: Red Hat Enterprise Linux

Affected Versions: Red Hat Enterprise Linux 7, 8, 9, and 10

Vulnerability: This vulnerability involves integer overflow and underflow flaws within the ASF demuxer component of GStreamer. An unauthenticated, remote attacker can trigger these conditions by providing a malformed ASF, WMV, or WMA file, requiring user interaction to process the malicious media.

Business Impact

The exploitation of this flaw can result in significant service instability or complete application failure, categorized as a high severity risk with a CVSS score of 7.1. While information disclosure is limited, the impact on availability poses a direct threat to business continuity for systems that rely on media processing pipelines.

Remediation Plan

Immediate Action: Update the GStreamer packages to the versions specified in the official Red Hat security advisory to address the demuxer flaws.

Proactive Monitoring: Monitor system logs for unexpected crashes or error messages associated with the GStreamer media framework.

Compensating Controls: Restrict the processing of untrusted media files from external sources until patches are successfully deployed across the environment.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of August 10, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. These integer-based flaws are historically difficult to weaponize for code execution, though they remain reliable vectors for denial of service.

Analyst Recommendation

Given the prevalence of media processing within enterprise environments, administrators should prioritize the deployment of the vendor-supplied patches. Failure to remediate could leave systems vulnerable to targeted crashes if users are induced to open malicious media files.

---METADATA---
VENDOR: Red Hat
PRODUCT: Red Hat Enterprise Linux
AFFECTED_VERSIONS: Red Hat Enterprise Linux 7, 8, 9, 10
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A heap out-of-bounds write vulnerability in the GStreamer gst-plugins-bad adpcmdec element allows attackers to trigger crashes or potentially execute code via maliciously crafted audio files.

Executive Summary:
A heap out-of-bounds write vulnerability in GStreamer, affecting multiple versions of Red Hat Enterprise Linux, poses a risk of application crashes or arbitrary code execution.

Vulnerability Details

CVE-ID: CVE-2026-19387

Affected Software: Red Hat Enterprise Linux (RHEL) 7, 8, 9, and 10

Affected Versions: Red Hat Enterprise Linux 7, 8, 9, 10

Vulnerability: The flaw exists in the adpcmdec element of gst-plugins-bad, which fails to properly validate input during the decoding of IMA/DVI ADPCM audio data (CWE-787). This is an unauthenticated, remotely exploitable vulnerability that requires user interaction to process the malicious media file.

Business Impact

The vulnerability carries a CVSS score of 7.6, reflecting the potential for remote code execution or denial of service through application crashes. This poses a significant threat to any system that processes external media, potentially leading to unauthorized access or widespread system instability.

Remediation Plan

Immediate Action: Update the GStreamer packages to the latest version provided by Red Hat as soon as security advisories are published. Refer to the Red Hat Bugzilla entry 2513015 for specific package versioning.

Proactive Monitoring: Monitor systems for unusual crashes in media-processing applications or services that utilize GStreamer libraries.

Compensating Controls: Use endpoint protection software to scan incoming media files and restrict the execution of untrusted media applications.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of August 10, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is fundamentally exploitable if a user is convinced to process a malicious file, making user awareness a key component of the defense.

Analyst Recommendation

Organizations should prioritize patching their RHEL environments. Until updates are applied, advise users to exercise extreme caution when opening unknown audio or video files from untrusted sources.

---METADATA---
VENDOR: Red Hat
PRODUCT: OpenShift AI
AFFECTED_VERSIONS: Red Hat OpenShift AI 3.3
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A vulnerability in the Red Hat OpenShift AI training-operator allows for execution with unnecessary privileges.

Executive Summary:
The Red Hat OpenShift AI training-operator is vulnerable to an elevation of privilege flaw, posing a high risk of unauthorized system control.

Vulnerability Details

CVE-ID: CVE-2026-18982

Affected Software: Red Hat OpenShift AI

Affected Versions: Red Hat OpenShift AI 3.3

Vulnerability: This vulnerability involves improper privilege management (CWE-250) within the training-operator component. The CVSS vector indicates that a low-privileged authenticated attacker can exploit this over the network to achieve full confidentiality, integrity, and availability impact.

Business Impact

The ability for an authenticated user to gain excessive privileges within the OpenShift AI environment represents a significant threat to data integrity and system security. Given the CVSS score of 8.8, this flaw could allow an attacker to disrupt machine learning workflows, compromise sensitive training datasets, or gain unauthorized control over underlying infrastructure components.

Remediation Plan

Immediate Action: Update Red Hat OpenShift AI 3.3 to the patched release, specifically ensuring the training-operator is updated to version 1785188461 or later as detailed in RHSA-2026:53263.

Proactive Monitoring: Review audit logs for unusual container execution patterns or unauthorized attempts to access training-operator resources.

Compensating Controls: Implement strict Role-Based Access Control (RBAC) policies within OpenShift to minimize the impact of potentially compromised low-privileged accounts.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 11, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently exploitable by authenticated users due to the improper privilege assignment within the operator logic.

Analyst Recommendation

This vulnerability presents a high risk to the stability and security of OpenShift AI deployments. Administrators must prioritize the application of the vendor-provided patch immediately to prevent potential escalation of privileges and system compromise.

---METADATA---
VENDOR: Red Hat
PRODUCT: OpenShift AI
AFFECTED_VERSIONS: Red Hat OpenShift AI 3.3
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A flaw in the Red Hat OpenShift AI overlay for the training operator allows authenticated attackers to perform unauthorized actions.

Executive Summary:
A high-severity security vulnerability in the Red Hat OpenShift AI training operator overlay allows authenticated users to compromise system integrity and availability.

Vulnerability Details

CVE-ID: CVE-2026-18951

Affected Software: Red Hat OpenShift AI

Affected Versions: Red Hat OpenShift AI 3.3

Vulnerability: This vulnerability resides in the RHOAI training operator overlay. An authenticated attacker with low-level privileges can leverage this flaw to influence system operations over the network, as indicated by the CVSS base score.

Business Impact

With a CVSS score of 8.8, this vulnerability represents a significant risk to the stability and security of AI training workloads. Exploitation could result in the destruction of training data, unauthorized model access, or the degradation of critical computing resources.

Remediation Plan

Immediate Action: Update the Red Hat OpenShift AI environment to the fixed version associated with build 1785188461 or later, as detailed in RHSA-2026:53263.

Proactive Monitoring: Monitor the training operator logs for unexpected configuration changes or unauthorized job submissions.

Compensating Controls: Apply strict network isolation for training nodes and enforce granular access control for users interacting with the training operator.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 11, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is considered high-risk due to the potential for impact on training operations.

Analyst Recommendation

Administrators should prioritize the deployment of the security update identified in the vendor advisory. Immediate patching is required to mitigate the risk of unauthorized exploitation within the training operator component.

---METADATA---
VENDOR: Red Hat
PRODUCT: OpenShift AI
AFFECTED_VERSIONS: Red Hat OpenShift AI 3.3
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A security flaw exists in the odh-dashboard component of Red Hat OpenShift AI that may allow authenticated users to perform unauthorized operations.

Executive Summary:
An authenticated privilege vulnerability in Red Hat OpenShift AI 3.3 could allow unauthorized users to perform sensitive actions, posing a high risk to environment security.

Vulnerability Details

CVE-ID: CVE-2026-18950

Affected Software: Red Hat OpenShift AI

Affected Versions: Red Hat OpenShift AI 3.3

Vulnerability: This vulnerability affects the odh-dashboard and is reachable by authenticated users. Based on the CVSS vector, the attacker requires low privileges to exploit this flaw over the network, which may result in a total compromise of confidentiality, integrity, and availability.

Business Impact

The CVSS score of 8.8 reflects the high impact of this vulnerability on business operations. Successful exploitation could allow attackers to bypass security controls within the AI dashboard, leading to the compromise of proprietary machine learning data or the unauthorized manipulation of system configurations.

Remediation Plan

Immediate Action: Apply the vendor-supplied security update provided in RHSA-2026:53263, specifically ensuring the environment is updated to build 1786109683 or later.

Proactive Monitoring: Review application logs for unauthorized dashboard activity and correlate suspicious events with user authentication logs.

Compensating Controls: Utilize Web Application Firewalls or API security gateways to filter and inspect traffic directed at the odh-dashboard.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 11, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly exploitable for authenticated actors, necessitating prompt attention.

Analyst Recommendation

Security teams must treat this vulnerability with high urgency. Applying the vendor patch is the most effective way to remediate the flaw and prevent potential unauthorized access to the OpenShift AI platform.

---METADATA---
VENDOR: Red Hat
PRODUCT: OpenShift AI
AFFECTED_VERSIONS: Red Hat OpenShift AI 3.3
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A vulnerability in the odh-dashboard component of Red Hat OpenShift AI allows authenticated attackers to perform operations with excessive privileges.

Executive Summary:
A critical privilege escalation vulnerability in Red Hat OpenShift AI 3.3 allows authenticated users to execute actions with unnecessary permissions, potentially leading to full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-18949

Affected Software: Red Hat OpenShift AI

Affected Versions: Red Hat OpenShift AI 3.3

Vulnerability: The vulnerability is identified as CWE-250, which involves execution with unnecessary privileges. The CVSS vector indicates the attack requires low privileges (PR:L) and can be executed over the network (AV:N), allowing an authenticated attacker to perform unauthorized actions.

Business Impact

This vulnerability poses a significant risk to the integrity and confidentiality of the OpenShift AI environment. With a CVSS score of 8.8, the ability for a low-privileged user to gain unauthorized elevated access can result in data exfiltration, unauthorized modification of machine learning models, or complete disruption of AI services.

Remediation Plan

Immediate Action: Update Red Hat OpenShift AI 3.3 to the patched version identified by build number 1786109683 or later as specified in RHSA-2026:53263.

Proactive Monitoring: Audit user access logs and monitor for unusual API calls or administrative actions originating from standard user accounts.

Compensating Controls: Implement strict Role Based Access Control (RBAC) policies and use network segmentation to limit the reach of the odh-dashboard component.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 11, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's inherent exploitability is high due to the potential for privilege escalation within the management dashboard.

Analyst Recommendation

Given the high severity of this vulnerability, administrators should prioritize the application of the provided vendor security updates. Ensuring the software is updated to the specified build version is essential to eliminate the risk of privilege escalation.

---METADATA---
VENDOR: Red Hat
PRODUCT: Red Hat OpenShift AI
AFFECTED_VERSIONS: Red Hat OpenShift AI 3.3
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A deserialization flaw in the Feast component of Red Hat OpenShift AI allows remote attackers to execute arbitrary code via malicious user-defined functions.

Executive Summary:
A critical arbitrary code execution vulnerability exists in Red Hat OpenShift AI due to improper deserialization of user-defined functions, posing a severe threat to feature server security.

Vulnerability Details

CVE-ID: CVE-2026-18948

Affected Software: Red Hat OpenShift AI

Affected Versions: Red Hat OpenShift AI 3.3

Vulnerability: The vulnerability arises from the improper deserialization of UDFs using the dill library, which can be exploited by an attacker to run arbitrary code on the feature or registry servers. While the attack vector is network-based, the impact is severe, allowing for cross-tenant data access and lateral movement within the OpenShift environment.

Business Impact

Successful exploitation allows an attacker to gain full control over the feature server, leading to the potential theft of sensitive training data or the corruption of machine learning pipelines. The CVSS score of 9.9 underscores the critical nature of this flaw, as it undermines the security foundation of the platform and could lead to complete system compromise.

Remediation Plan

Immediate Action: Update Red Hat OpenShift AI 3.3 to the fixed release, which is available from version 1786110033 and later.

Proactive Monitoring: Monitor server logs for suspicious process execution or unexpected file system modifications initiated by the Feast registry or feature server services.

Compensating Controls: Implement strict input validation for all user-defined code and restrict access to the registry server to only authorized administrative personnel.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Aug 10, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The reliance on unsafe deserialization methods makes this a high-value target for attackers looking to achieve remote code execution.

Analyst Recommendation

This vulnerability represents a significant risk to the integrity of the data science lifecycle. Administrators should treat this as a high-priority update and verify that all affected nodes in the OpenShift AI environment are running the corrected version immediately.

---METADATA---
VENDOR: Red Hat
PRODUCT: OpenShift AI
AFFECTED_VERSIONS: Red Hat OpenShift AI 3.3
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A vulnerability in the Feast component within Red Hat OpenShift AI allows for execution with unnecessary privileges.

Executive Summary:
A privilege-related vulnerability in the Feast component of Red Hat OpenShift AI poses a significant risk to data integrity and system availability.

Vulnerability Details

CVE-ID: CVE-2026-18947

Affected Software: Red Hat OpenShift AI

Affected Versions: Red Hat OpenShift AI 3.3

Vulnerability: This issue is classified as execution with unnecessary privileges (CWE-250) within the Feast feature store component. An authenticated user with low privileges can exploit this over the network, resulting in a scope change that allows for unauthorized data modification or availability disruption.

Business Impact

The CVSS score of 8.5 highlights the critical nature of this vulnerability. Because Feast is used for feature management in machine learning pipelines, unauthorized modification of data could lead to poisoned models or incorrect analytical outputs, causing severe downstream business consequences and reputational damage.

Remediation Plan

Immediate Action: Update Red Hat OpenShift AI 3.3 by installing the update for Feast, specifically version 1786110033 or later as identified in RHSA-2026:53263.

Proactive Monitoring: Review data integrity logs and monitor for unexpected modifications to feature store definitions or ingested data.

Compensating Controls: Utilize network policies to restrict access to the Feast API to only trusted services and authenticated internal users.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 11, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is primarily concerning due to the potential for scope-crossing malicious actions within the machine learning environment.

Analyst Recommendation

Maintaining the integrity of machine learning pipelines is essential for reliable AI operations. Security teams must ensure the Feast component is updated to the specified patched version to mitigate the risk of unauthorized data modification and ensure long-term model reliability.

---METADATA---
VENDOR: Red Hat
PRODUCT: OpenShift AI
AFFECTED_VERSIONS: Red Hat OpenShift AI 3.3
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A vulnerability in the Feast and feast-operator components of Red Hat OpenShift AI 3.3 allows for unauthorized access due to missing authentication.

Executive Summary:
A high-severity authentication bypass in the Feast operator of Red Hat OpenShift AI 3.3 could allow attackers to access sensitive data across the platform.

Vulnerability Details

CVE-ID: CVE-2026-18941

Affected Software: Red Hat OpenShift AI

Affected Versions: Red Hat OpenShift AI 3.3

Vulnerability: This issue involves missing authentication for critical functions (CWE-306) within Feast and the feast-operator. The CVSS vector (PR:L/S:C) confirms that a low-privileged user can exploit this to achieve a scope change, potentially leading to unauthorized information disclosure.

Business Impact

The ability to bypass authentication in the Feast component allows for the unauthorized extraction of potentially sensitive feature data. With a CVSS score of 7.7, the risk of data exfiltration is substantial, which could lead to severe privacy violations and regulatory non-compliance depending on the nature of the data stored in the feature store.

Remediation Plan

Immediate Action: Update the affected software to the version fixed in build/release 1786110033 or later, as referenced in RHSA-2026:53263.

Proactive Monitoring: Audit access logs for the Feast service to identify any unauthorized queries or access patterns that deviate from standard operational behavior.

Compensating Controls: Implement network-level restrictions or service mesh policies to enforce authentication and authorization at the ingress points for the Feast services.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 11, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The scope change aspect of this vulnerability increases the potential impact of a successful exploit.

Analyst Recommendation

Addressing this vulnerability is essential to maintain the security boundary of the feature store. Administrators should verify their current versions against the fixed release and apply the necessary patches without delay to prevent unauthorized data access.

---METADATA---
VENDOR: Red Hat
PRODUCT: OpenShift AI
AFFECTED_VERSIONS: Red Hat OpenShift AI 3.3
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A flaw in Red Hat OpenShift AI Data Science Pipelines (DSP) allows authenticated users to gain elevated privileges due to incorrect privilege assignment.

Executive Summary:
A high-severity privilege assignment vulnerability in Red Hat OpenShift AI 3.3 could allow authenticated users to perform unauthorized actions.

Vulnerability Details

CVE-ID: CVE-2026-18621

Affected Software: Red Hat OpenShift AI

Affected Versions: Red Hat OpenShift AI 3.3

Vulnerability: This vulnerability is categorized as CWE-266, involving incorrect privilege assignment within the Data Science Pipelines component. It requires the attacker to have low-level authenticated access to the system to exploit the flaw.

Business Impact

Successful exploitation of this flaw could allow an authenticated user to gain access or permissions beyond their intended scope, potentially leading to unauthorized data modification or system impact. Given the CVSS score of 7.6, this represents a significant risk to the integrity and confidentiality of the AI pipeline environment.

Remediation Plan

Immediate Action: Update Red Hat OpenShift AI 3.3 to the version containing the fix, identified as build 1785187920 or later.

Proactive Monitoring: Monitor system logs for unusual permission changes or unauthorized attempts to access pipeline configurations.

Compensating Controls: Restrict access to the Data Science Pipelines interface to only necessary personnel to minimize the attack surface.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 11, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is primarily an authorization logic error that requires an existing user session to exploit.

Analyst Recommendation

The vulnerability presents a clear risk of privilege escalation within the OpenShift AI environment. Administrators should prioritize the deployment of the provided update to ensure that role-based access controls remain enforced and to prevent potential unauthorized escalation of privileges.

---METADATA---
VENDOR: Red Hat
PRODUCT: OpenShift AI
AFFECTED_VERSIONS: Red Hat OpenShift AI 3.3
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A resource allocation flaw in the ml-metadata component of Red Hat OpenShift AI 3.3 may allow an unauthenticated attacker to cause a denial-of-service condition.

Executive Summary:
A high-severity denial-of-service vulnerability in Red Hat OpenShift AI 3.3 could allow remote attackers to exhaust system resources.

Vulnerability Details

CVE-ID: CVE-2026-18618

Affected Software: Red Hat OpenShift AI

Affected Versions: Red Hat OpenShift AI 3.3

Vulnerability: This vulnerability is identified as CWE-770, which involves the allocation of resources without proper limits or throttling. The flaw is remotely exploitable without requiring authentication.

Business Impact

An attacker can exploit this vulnerability to trigger a denial-of-service, potentially rendering the ml-metadata service unavailable and disrupting critical machine learning workflows. With a CVSS score of 7.5, this poses a substantial risk to service availability and business continuity for teams relying on OpenShift AI.

Remediation Plan

Immediate Action: Update Red Hat OpenShift AI 3.3 to the version containing the fix, identified as build 1785262015 or later.

Proactive Monitoring: Monitor system resource usage, such as CPU and memory consumption, for sudden spikes or exhaustion patterns indicative of a denial-of-service attempt.

Compensating Controls: Implement rate limiting at the network or API gateway level to prevent excessive requests from reaching the vulnerable component.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 11, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The lack of resource throttling makes this component susceptible to basic resource exhaustion attacks.

Analyst Recommendation

To maintain the availability of machine learning services, administrators must apply the security update provided by Red Hat. Implementing strict rate limiting and resource monitoring in the interim will help mitigate the risk of service disruption until the patch can be fully deployed.

---METADATA---
VENDOR: Red Hat
PRODUCT: OpenShift AI
AFFECTED_VERSIONS: Red Hat OpenShift AI 3.3
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A security flaw in the Data Science Pipelines Operator for Red Hat OpenShift AI 3.3 allows for improper control of object attributes.

Executive Summary:
Red Hat OpenShift AI 3.3 is vulnerable to a high-severity flaw in the Data Science Pipelines Operator that could lead to unauthorized attribute modification.

Vulnerability Details

CVE-ID: CVE-2026-18617

Affected Software: Red Hat OpenShift AI 3.3

Affected Versions: Red Hat OpenShift AI 3.3

Vulnerability: The vulnerability relates to the improper control of dynamically determined object attributes (CWE-915) within the Data Science Pipelines Operator. It requires an authenticated user with low privileges to trigger the flaw.

Business Impact

An authenticated attacker could leverage this flaw to modify system attributes, potentially leading to unauthorized control over pipeline execution or data access. With a CVSS score of 8.8, this represents a significant risk to the integrity and reliability of the data science workflows running on the OpenShift platform.

Remediation Plan

Immediate Action: Update to the fixed version of Red Hat OpenShift AI, which includes the necessary security fixes for the Data Science Pipelines Operator.

Proactive Monitoring: Review pipeline configuration changes and audit logs for the Data Science Pipelines Operator to detect any unauthorized modifications to object attributes.

Compensating Controls: Restrict access to pipeline management interfaces to only necessary personnel and implement strict validation for any dynamic configuration inputs.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 11, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The technical nature of the flaw requires specific knowledge of how the operator manages object attributes.

Analyst Recommendation

Given the high CVSS score, it is imperative to apply the provided vendor updates for Red Hat OpenShift AI 3.3 immediately. Failure to patch may expose pipeline operations to unauthorized manipulation and system-level risks.

---METADATA---
VENDOR: Red Hat
PRODUCT: OpenShift AI
AFFECTED_VERSIONS: Red Hat OpenShift AI 3.3
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The Data Science Pipelines Operator in Red Hat OpenShift AI 3.3 contains a flaw where a cryptographically weak pseudo-random number generator is utilized.

Executive Summary:
A high-severity cryptographic flaw in the Red Hat OpenShift AI Data Science Pipelines Operator could allow unauthenticated attackers to compromise system security.

Vulnerability Details

CVE-ID: CVE-2026-18611

Affected Software: Red Hat OpenShift AI

Affected Versions: Red Hat OpenShift AI 3.3

Vulnerability: This vulnerability is categorized as CWE-338, which involves the use of a cryptographically weak pseudo-random number generator. The attack vector is network-based and does not require prior authentication.

Business Impact

The use of weak randomness in security-sensitive operations can lead to the predictability of tokens or keys, potentially allowing an attacker to bypass authentication or decrypt sensitive communications. With a CVSS score of 7.5, this vulnerability poses a serious threat to the overall security posture of the platform.

Remediation Plan

Immediate Action: Update Red Hat OpenShift AI 3.3 to the version containing the fix, identified as build 1785187936 or later.

Proactive Monitoring: Review security logs for anomalous authentication patterns or unexpected cryptographic errors.

Compensating Controls: Utilize a Web Application Firewall to block suspicious traffic patterns and ensure that all network communication is handled via secure, encrypted channels.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 11, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The nature of this flaw makes it inherently dangerous, as it may facilitate further attacks that rely on predictable security values.

Analyst Recommendation

Due to the unauthenticated nature of this vulnerability and its potential to weaken critical security controls, immediate patching is required. Organizations should apply the vendor-provided update to replace the weak PRNG and restore the integrity of the cryptographic operations within the Data Science Pipelines Operator.

---METADATA---
VENDOR: Red Hat
PRODUCT: OpenShift AI
AFFECTED_VERSIONS: Red Hat OpenShift AI 3.3
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A vulnerability in the Data Science Pipelines Operator for Red Hat OpenShift AI allows for execution with unnecessary privileges.

Executive Summary:
The Data Science Pipelines Operator in Red Hat OpenShift AI is susceptible to a privilege escalation flaw that could lead to unauthorized system-wide impact.

Vulnerability Details

CVE-ID: CVE-2026-18608

Affected Software: Red Hat OpenShift AI

Affected Versions: Red Hat OpenShift AI 3.3

Vulnerability: This flaw stems from execution with unnecessary privileges (CWE-250) within the Data Science Pipelines Operator (DSPO). The CVSS vector confirms that an authenticated attacker with high privileges can exploit this via network access to cause a scope change and compromise system integrity and confidentiality.

Business Impact

With a CVSS score of 8.7, this vulnerability poses a severe risk to the entire OpenShift cluster environment. Successful exploitation could allow an attacker to bypass security boundaries, potentially leading to cross-namespace data access or unauthorized modification of critical pipeline configurations.

Remediation Plan

Immediate Action: Apply the vendor security update to Red Hat OpenShift AI 3.3, ensuring the Data Science Pipelines Operator is updated to version 1785187936 or later per RHSA-2026:53263.

Proactive Monitoring: Monitor for anomalous pipeline activity or unexpected changes to cluster-wide settings and operator configurations.

Compensating Controls: Enforce tight security context constraints and limit access to the Data Science Pipelines Operator to only authorized administrative personnel.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 11, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The necessity of high privileges to trigger this flaw suggests that insider threats or compromised administrative accounts are the primary vectors of concern.

Analyst Recommendation

Given the potential for a scope-changing impact on the OpenShift cluster, this issue must be addressed with high urgency. Administrators should verify their current version of the Data Science Pipelines Operator and apply the necessary patches provided by Red Hat without delay.

---METADATA---
VENDOR: Red Hat
PRODUCT: Cost Management Metrics Operator
AFFECTED_VERSIONS: All versions
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A Server-Side Request Forgery vulnerability in the Red Hat Cost Management Metrics Operator allows authenticated users to steal Kubernetes service-account bearer tokens.

Executive Summary:
A critical Server-Side Request Forgery vulnerability in the Red Hat Cost Management Metrics Operator permits authenticated attackers to compromise Kubernetes service-account tokens.

Vulnerability Details

CVE-ID: CVE-2026-18381

Affected Software: Red Hat Cost Management Metrics Operator

Affected Versions: All versions

Vulnerability: The CostManagementMetricsConfig custom resource allows a user with edit permissions to specify an arbitrary upload URL. The operator insecurely attaches its Kubernetes service-account bearer token to queries sent to this user-controlled URL, enabling token theft.

Business Impact

Exploitation of this flaw allows an attacker to gain the permissions associated with the operator's service account, potentially leading to unauthorized control over cluster resources. Given the CVSS score of 7.6, this is a high-severity issue that could facilitate lateral movement within the OpenShift environment.

Remediation Plan

Immediate Action: Limit edit permissions on the CostManagementMetricsConfig custom resource to trusted users immediately. Monitor vendor security channels for the release of an official patch.

Proactive Monitoring: Monitor API server logs for modifications to the CostManagementMetricsConfig resource. Inspect outbound network requests originating from the operator pod for anomalous traffic patterns.

Compensating Controls: Implement egress filtering to prevent the operator from communicating with unauthorized or external endpoints.

Exploitation Status

Public Exploit Available: No (unknown)

Analyst Notes: As of August 1, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly accessible to any user with the requisite edit permissions.

Analyst Recommendation

The risk of privilege escalation via token theft necessitates immediate administrative intervention. Organizations should audit their current RBAC policies to ensure that only authorized personnel can modify configuration objects related to the Cost Management Metrics Operator.

---METADATA---
VENDOR: Red Hat
PRODUCT: Cost Management Metrics Operator
AFFECTED_VERSIONS: See vendor advisory for affected versions
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A Server-Side Request Forgery vulnerability in the Cost Management Metrics Operator allows authenticated users to exfiltrate sensitive cluster-global bearer tokens.

Executive Summary:
A critical Server-Side Request Forgery vulnerability in the Red Hat Cost Management Metrics Operator permits authenticated users to steal sensitive cluster credentials.

Vulnerability Details

CVE-ID: CVE-2026-18378

Affected Software: Red Hat Cost Management Metrics Operator

Affected Versions: See vendor advisory for affected versions

Vulnerability: The CostManagementMetricsConfig custom resource allows a user with edit permissions to specify an arbitrary upload URL. When the authentication type is set to token, the operator attaches the cluster-global Red Hat Cloud pull-secret bearer token to HTTP requests sent to the user-controlled URL.

Business Impact

Successful exploitation allows an authenticated attacker to obtain sensitive cluster-global credentials, potentially leading to unauthorized access to cloud resources and infrastructure. With a CVSS score of 7.6, this vulnerability poses a significant risk to the integrity and confidentiality of the environment.

Remediation Plan

Immediate Action: Apply vendor security updates as soon as they become available. Until a patch is released, restrict edit permissions on the CostManagementMetricsConfig custom resource to highly trusted administrators only.

Proactive Monitoring: Review audit logs for suspicious or unauthorized modifications to CostManagementMetricsConfig resources. Monitor egress traffic from the operator for connections to unknown or unauthorized external URLs.

Compensating Controls: Utilize network policies to restrict the operator from making arbitrary outbound connections to untrusted external domains.

Exploitation Status

Public Exploit Available: No (unknown)

Analyst Notes: As of August 1, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently exploitable by users with existing edit privileges within the cluster.

Analyst Recommendation

This vulnerability represents a high risk to cluster security by exposing sensitive bearer tokens. Administrators should prioritize identifying instances where edit permissions are granted for the affected custom resource and restrict access to minimize the attack surface until an official patch is deployed.

---METADATA---
VENDOR: GNOME
PRODUCT: gnome-remote-desktop
AFFECTED_VERSIONS: See vendor advisory
CONFIDENCE: medium
MISSING: versions
---END_METADATA---

Description Summary:
A vulnerability in gnome-remote-desktop allows for uncontrolled resource consumption, potentially leading to a denial of service condition.

Executive Summary:
A resource consumption vulnerability in gnome-remote-desktop on Red Hat Enterprise Linux may allow unauthenticated remote attackers to cause a denial of service.

Vulnerability Details

CVE-ID: CVE-2026-18358

Affected Software: GNOME gnome-remote-desktop (as shipped in Red Hat Enterprise Linux)

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This is an uncontrolled resource consumption vulnerability (CWE-400) that can be triggered by an unauthenticated attacker over the network. The flaw allows an attacker to exhaust system resources, resulting in a denial of service.

Business Impact

A successful exploit could cause the gnome-remote-desktop service to become unavailable, disrupting remote management capabilities and workflow productivity. Given the CVSS score of 7.5, the potential for a denial of service against critical infrastructure components represents a high risk to system availability.

Remediation Plan

Immediate Action: Consult the Red Hat security advisory to identify the specific updated packages and apply them to affected RHEL 8, 9, and 10 systems.

Proactive Monitoring: Monitor system resource usage, specifically memory and CPU, for the gnome-remote-desktop process to detect potential exhaustion attempts.

Compensating Controls: Restrict network access to remote desktop ports to trusted IP addresses only, reducing the ability of unauthenticated attackers to reach the service.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 1, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The high availability impact is inherent to the nature of resource exhaustion flaws.

Analyst Recommendation

The risk of denial of service is significant for systems relying on remote desktop functionality. Administrators should verify their versions against the Red Hat advisory and apply the necessary patches immediately to restore system stability and prevent service disruption.

---METADATA---
VENDOR: RedHatInsights
PRODUCT: yggdrasil-worker-package-manager
AFFECTED_VERSIONS: RedHatInsights yggdrasil-worker-package-manager: 0 up to (excluding) 0.1.4, 0.2.0 up to (excluding) 0.2.4; Red Hat Red Hat Enterprise Linux 10
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An argument injection vulnerability in the yggdrasil-worker-package-manager allows local authenticated users to execute arbitrary commands.

Executive Summary:
An argument injection flaw in the RedHatInsights yggdrasil-worker-package-manager allows local authenticated users to achieve full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-18157

Affected Software: RedHatInsights yggdrasil-worker-package-manager

Affected Versions: 0 up to (excluding) 0.1.4 and 0.2.0 up to (excluding) 0.2.4

Vulnerability: The software suffers from improper neutralization of argument delimiters (CWE-88), which can be exploited by an authenticated local user to inject arbitrary command-line arguments. This results in the execution of unauthorized commands with the privileges of the worker process.

Business Impact

An attacker with local access can leverage this flaw to elevate privileges or execute malicious payloads on the host system. This represents a significant security risk to Red Hat Enterprise Linux 10 environments, as it allows for total technical impact, including unauthorized data access and potential system-wide disruption. The CVSS score of 7.8 reflects the high severity of allowing command injection in a privileged worker context.

Remediation Plan

Immediate Action: Update the yggdrasil-worker-package-manager to version 0.1.4 or 0.2.4 immediately.

Proactive Monitoring: Review system audit logs for unexpected process execution or abnormal command-line arguments initiated by the yggdrasil-worker user.

Compensating Controls: Restrict local user access to the specific systems running the vulnerable worker package manager until updates can be deployed.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 1, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is highly exploitable for any user already possessing local credentials on the affected system.

Analyst Recommendation

System administrators must prioritize this update, especially in multi-user environments where local privilege escalation is a concern. Applying the patch is the only reliable way to neutralize the argument injection risk.

---METADATA---
VENDOR: Red Hat
PRODUCT: Ansible Automation Platform 2
AFFECTED_VERSIONS: Red Hat Ansible Automation Platform 2 (all versions)
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A flaw in the aap-gateway component of Red Hat Ansible Automation Platform 2 allows unauthenticated attackers to bypass mTLS authentication for event streams.

Executive Summary:
An authentication bypass vulnerability in Red Hat Ansible Automation Platform 2 allows unauthenticated remote attackers to forge credentials and manipulate event streams.

Vulnerability Details

CVE-ID: CVE-2026-18141

Affected Software: Red Hat Ansible Automation Platform 2

Affected Versions: Red Hat Ansible Automation Platform 2 (all versions)

Vulnerability: This is an improper certificate validation issue (CWE-295) in the aap-gateway. An unauthenticated attacker can bypass mutual TLS authentication by manipulating the event stream URL and forging the HTTP Subject header, which is further simplified by the system disclosing expected subject names in error messages.

Business Impact

With a CVSS score of 8.2, this vulnerability represents a high risk to the integrity of automated workflows. Exploitation could allow attackers to inject malicious events into the automation platform, leading to unauthorized configuration changes or the execution of arbitrary tasks across the managed environment.

Remediation Plan

Immediate Action: Apply security updates provided by Red Hat immediately as they become available on the official security advisory page.

Proactive Monitoring: Review logs for anomalous event stream activity or unauthorized attempts to access the aap-gateway.

Compensating Controls: Restrict network access to the aap-gateway component to only trusted sources and ensure that mTLS configurations are audited for signs of tampering.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 1, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the ease of bypassing authentication once the certificate subject is disclosed.

Analyst Recommendation

The ability for an unauthenticated attacker to bypass critical security controls makes this a high-priority remediation task. Organizations should immediately review their Ansible Automation Platform deployments and apply the vendor-recommended patches to prevent unauthorized control over automation event streams.

---METADATA---
VENDOR: Red Hat
PRODUCT: OpenShift Container Platform
AFFECTED_VERSIONS: OpenShift Container Platform 4
---END_METADATA---

Description Summary:
A vulnerability in the OpenShift Route resource allows low-privileged users to inject malicious HAProxy configurations, potentially leading to cross-tenant traffic hijacking.

Executive Summary:
A high-severity flaw in OpenShift Container Platform 4 exposes multi-tenant environments to potential traffic interception and session hijacking.

Vulnerability Details

CVE-ID: CVE-2026-1784

Affected Software: Red Hat OpenShift Container Platform

Affected Versions: OpenShift Container Platform 4

Vulnerability: The vulnerability involves insufficient validation of the Route spec.path field. This allows an authenticated low-privileged user to inject arbitrary configurations into the shared router's HAProxy instance, effectively manipulating traffic routing for other tenants.

Business Impact

The exploitation of this vulnerability poses a significant risk to data confidentiality and integrity within shared cluster environments. By hijacking traffic between tenants, an attacker could intercept sensitive communications or perform unauthorized actions on behalf of other users, leading to potential data breaches and service disruption. With a CVSS score of 8.8, this flaw represents a severe risk to the security posture of the container orchestration layer.

Remediation Plan

Immediate Action: Review the official Red Hat security advisory for available patches and update all OpenShift Container Platform 4 clusters to the secure version immediately.

Proactive Monitoring: Audit existing Route configurations for unusual path definitions and monitor cluster ingress logs for anomalous routing behavior.

Compensating Controls: Implement strict Role-Based Access Control (RBAC) to limit the ability of low-privileged users to create or modify Route resources until the patch is applied.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the potential for cross-tenant traffic hijacking, this vulnerability should be treated as a priority. Administrators must audit current Route configurations and apply the necessary patches provided by Red Hat as soon as they become available to prevent unauthorized access and potential data compromise.

---METADATA---
VENDOR: Red Hat
PRODUCT: OpenShift Virtualization 4
AFFECTED_VERSIONS: See vendor advisory
CONFIDENCE: medium
MISSING: versions
---END_METADATA---

Description Summary:
An authorization bypass vulnerability exists in the Containerized Data Importer (CDI) component of Red Hat OpenShift Virtualization 4.

Executive Summary:
A vulnerability in the Red Hat OpenShift Virtualization 4 Containerized Data Importer allows an authenticated user to bypass authorization checks and potentially access sensitive data.

Vulnerability Details

CVE-ID: CVE-2026-17527

Affected Software: Red Hat OpenShift Virtualization 4

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability is a CWE-639, an authorization bypass through user-controlled keys within the CDI. It requires an authenticated user to successfully exploit the flaw to gain unauthorized access to data within the cluster.

Business Impact

The CVSS score of 7.7 highlights a significant risk, particularly regarding data confidentiality within containerized environments. Unauthorized access to data handled by the CDI could lead to severe security breaches, impacting sensitive information stored within virtual machine disks or persistent volumes.

Remediation Plan

Immediate Action: Consult the official Red Hat security advisory to identify the specific patched versions for OpenShift Virtualization 4 and apply the necessary updates immediately.

Proactive Monitoring: Audit access logs for the Containerized Data Importer to identify suspicious attempts to access resources outside of the user's intended scope.

Compensating Controls: Implement strict Role Based Access Control (RBAC) policies within the OpenShift cluster to limit the blast radius of potentially compromised user accounts.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 28, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The requirement for authentication limits the initial attack surface, but the potential for lateral movement within the cluster remains a concern.

Analyst Recommendation

While this vulnerability requires authentication, the potential for unauthorized data access makes it a high priority for security teams. Administrators should monitor the Red Hat security portal for specific version guidance and prioritize the deployment of the relevant security errata to secure the OpenShift environment.

---METADATA---
VENDOR: Red Hat
PRODUCT: Red Hat Enterprise Linux
AFFECTED_VERSIONS: RHEL 6, 7, 8, and 10
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
An expired pointer dereference flaw exists in the Linux kernel across multiple versions of Red Hat Enterprise Linux, potentially allowing local privilege escalation.

Executive Summary:
A critical kernel-level expired pointer dereference vulnerability in Red Hat Enterprise Linux may allow local attackers to compromise system integrity and availability.

Vulnerability Details

CVE-ID: CVE-2026-17523

Affected Software: Red Hat Enterprise Linux (RHEL)

Affected Versions: RHEL 6, RHEL 7, RHEL 8, and RHEL 10

Vulnerability: The vulnerability is categorized as an expired pointer dereference (CWE-825). It requires a local attacker with low privileges to interact with the kernel in a way that triggers memory instability, potentially leading to unauthorized operations.

Business Impact

Kernel-level vulnerabilities are highly severe as they reside at the core of the operating system. With a CVSS score of 7.8, this flaw could allow an attacker to crash the system or escalate privileges, resulting in significant operational downtime or unauthorized access to sensitive kernel-level data.

Remediation Plan

Immediate Action: Apply the latest kernel security patches released by Red Hat as soon as they become available for your specific distribution.

Proactive Monitoring: Review system logs for kernel panics, segmentation faults, or unexpected system reboots that may indicate exploitation attempts.

Compensating Controls: Implement strict access control lists to limit local user access to the server, reducing the likelihood of an attacker reaching the vulnerable kernel interface.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of July 28, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Kernel vulnerabilities of this nature are complex to weaponize, but they remain a high-priority risk due to the potential for total system impact.

Analyst Recommendation

System administrators must monitor Red Hat security advisories closely for the release of fixed kernel versions. Given the broad range of affected RHEL distributions, immediate patching is necessary to maintain the security posture of the infrastructure.

---METADATA---
VENDOR: Red Hat
PRODUCT: Red Hat OpenShift AI (RHOAI)
AFFECTED_VERSIONS: See vendor advisory
CONFIDENCE: medium
MISSING: patch
---END_METADATA---

Description Summary:
A flaw in the odh-dashboard component of Red Hat OpenShift AI allows for an origin validation error, which may be exploited by an authenticated user to compromise system integrity.

Executive Summary:
A critical vulnerability in the Red Hat OpenShift AI dashboard component permits authenticated users to perform unauthorized actions due to improper origin validation.

Vulnerability Details

CVE-ID: CVE-2026-16745

Affected Software: Red Hat Red Hat OpenShift AI (RHOAI)

Affected Versions: See vendor advisory

Vulnerability: This issue is classified as an origin validation error (CWE-346), occurring within the odh-dashboard web console, allowing an authenticated attacker to potentially perform unauthorized operations.

Business Impact

With a CVSS score of 8.8, this vulnerability represents a severe threat to the security posture of AI environments. Exploitation could lead to full compromise of the dashboard component, potentially allowing an attacker to manipulate AI models, access sensitive data, or disrupt machine learning workflows.

Remediation Plan

Immediate Action: Consult the Red Hat security advisory at https://access.redhat.com/security/cve/CVE-2026-16745 and apply the latest security updates provided by the vendor.

Proactive Monitoring: Monitor access logs for the odh-dashboard for suspicious activity or anomalous requests originating from authenticated user accounts.

Compensating Controls: Implement strict network segmentation and restrict access to the dashboard web console to trusted administrative networks only.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 24, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The nature of the flaw suggests that attackers must have authenticated access to the platform to initiate an exploit.

Analyst Recommendation

Given the high CVSS score and the sensitive nature of AI infrastructure, it is imperative to apply official patches as soon as they are made available by Red Hat. Administrators should review all active sessions and user permissions to limit exposure until the patch is deployed.

---METADATA---
VENDOR: Red Hat
PRODUCT: Red Hat Enterprise Linux
AFFECTED_VERSIONS: Red Hat Enterprise Linux 6, 7, 8, 9, 10; Red Hat OpenShift Container Platform 4
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A file descriptor leak in the PCP linux_sockets module for Red Hat Enterprise Linux exposes unsecured internal connections to unauthorized parties.

Executive Summary:
A file descriptor leak vulnerability in the Red Hat Performance Co-Pilot (PCP) linux_sockets module creates an unauthorized communication path, risking system security.

Vulnerability Details

CVE-ID: CVE-2026-16526

Affected Software: Red Hat Enterprise Linux (RHEL) and OpenShift Container Platform

Affected Versions: RHEL 6, 7, 8, 9, 10, and OpenShift Container Platform 4

Vulnerability: This flaw (CWE-403) involves the exposure of a file descriptor to an unintended control sphere. An authenticated attacker (PR:L) can exploit this to interact with unsecured internal connections, potentially leading to unauthorized data access or service disruption.

Business Impact

Exploitation of this vulnerability could lead to the exposure of sensitive internal data or unauthorized interaction with background services. Given the CVSS score of 8.8, this represents a significant risk to the integrity and confidentiality of RHEL and OpenShift environments, particularly in multi-tenant or containerized deployments.

Remediation Plan

Immediate Action: Monitor the Red Hat security advisory page for this specific CVE and apply the relevant package updates for PCP as soon as they are released for your specific RHEL version.

Proactive Monitoring: Review security logs for anomalous socket connections or unexpected interactions with the Performance Co-Pilot service.

Compensating Controls: If immediate patching is not possible, disable the PCP linux_sockets module or restrict access to the Performance Co-Pilot service to authorized users only.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of July 30, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is primarily an implementation error in how file descriptors are handled, which could be leveraged by local or network-authenticated users to escalate their access within the system.

Analyst Recommendation

Administrators should treat this as a high-priority update due to the broad impact across multiple RHEL versions. Ensure that your patch management cycle includes the latest updates from Red Hat to remediate the file descriptor leak in the PCP module.

---METADATA---
VENDOR: Red Hat
PRODUCT: Logging Subsystem for Red Hat OpenShift
AFFECTED_VERSIONS: See vendor advisory
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A flaw in the Konnectivity proxy-server configuration for hosted control planes allows unauthenticated remote attackers to connect as an agent and manipulate control-plane-to-node traffic.

Executive Summary:
A critical authentication bypass in the Red Hat Logging Subsystem for OpenShift allows unauthenticated remote attackers to intercept or modify internal cluster traffic.

Vulnerability Details

CVE-ID: CVE-2026-16242

Affected Software: Red Hat Logging Subsystem for Red Hat OpenShift

Affected Versions: See vendor advisory

Vulnerability: This vulnerability involves a missing authentication check (CWE-306) within the Konnectivity proxy-server agent-facing listener. Because the listener fails to validate client certificates or require tokens, remote attackers can join the routing pool as unauthenticated agents.

Business Impact

The CVSS score of 9.4 classifies this as a critical risk, as it allows full network-level control over communication between the control plane and nodes. Successful exploitation could lead to unauthorized data inspection, modification of sensitive control traffic, or a complete compromise of the cluster integrity, resulting in significant operational downtime and potential data exfiltration.

Remediation Plan

Immediate Action: Review Red Hat security bulletins and apply all available updates for the Logging Subsystem and associated Multicluster Engine components.

Proactive Monitoring: Monitor network traffic and access logs for unauthorized connections to the Konnectivity cluster endpoint, specifically looking for unexpected agent joining events.

Compensating Controls: Implement strict network segmentation and firewall rules to restrict access to the Konnectivity proxy-server endpoint to known, trusted infrastructure components only.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 20, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's high CVSS score is driven by the lack of required authentication for a critical infrastructure component, making it a high-priority target for automated scanning.

Analyst Recommendation

Given the critical nature of this flaw, security teams must prioritize patching affected OpenShift environments. If an immediate patch is not available, restricting network access to the affected endpoint is essential to mitigate the risk of unauthorized cluster manipulation.

---METADATA---
VENDOR: Red Hat
PRODUCT: Red Hat Enterprise Linux
AFFECTED_VERSIONS: 7, 8, 9, 10
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A heap-based buffer overflow vulnerability in the xdgmime library within Red Hat Enterprise Linux may allow for arbitrary code execution or service disruption via malicious file processing.

Executive Summary:
A heap-based buffer overflow flaw in the xdgmime library affects multiple versions of Red Hat Enterprise Linux, posing a risk of system instability or unauthorized code execution.

Vulnerability Details

CVE-ID: CVE-2026-16118

Affected Software: Red Hat Enterprise Linux

Affected Versions: 7, 8, 9, 10

Vulnerability: This is a heap-based buffer overflow (CWE-122) within the xdgmime library. The vulnerability is triggered when the library processes malformed data, requiring user interaction to open a malicious file to achieve an impact.

Business Impact

With a CVSS score of 7.1, this vulnerability presents a serious risk to system stability and security. Successful exploitation could lead to application crashes or the execution of arbitrary code with the privileges of the user interacting with the malicious file, potentially resulting in unauthorized privilege escalation or system compromise.

Remediation Plan

Immediate Action: Apply the latest security updates provided by Red Hat as they become available for your specific release of Enterprise Linux.

Proactive Monitoring: Monitor system logs for unexpected application crashes or segmentation faults that may indicate an exploitation attempt.

Compensating Controls: Exercise caution when opening untrusted files or documents from unknown sources and ensure that system-level security policies are enforced to limit the impact of code execution.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of July 19, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw requires user interaction, which serves as a partial barrier to widespread exploitation.

Analyst Recommendation

Users should prioritize the application of Red Hat security errata as they are published. Given the nature of heap overflows, keeping the underlying libraries updated is essential to maintaining the security posture of the operating system.

---METADATA---
VENDOR: Red Hat
PRODUCT: Enterprise Linux
AFFECTED_VERSIONS: Red Hat Enterprise Linux 6, 7, 8, 9, 10; Red Hat Hardened Images
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A command injection vulnerability exists within the dracut component of Red Hat Enterprise Linux, potentially allowing arbitrary command execution.

Executive Summary:
A critical OS command injection vulnerability in the Red Hat Enterprise Linux dracut component poses a significant risk of total system compromise.

Vulnerability Details

CVE-ID: CVE-2026-15816

Affected Software: Red Hat Enterprise Linux

Affected Versions: Red Hat Enterprise Linux 6, 7, 8, 9, 10; Red Hat Hardened Images

Vulnerability: This vulnerability is classified as an OS Command Injection (CWE-78). It occurs due to the improper neutralization of special elements within the dracut network module, allowing an unauthenticated attacker with adjacent network access to execute arbitrary commands.

Business Impact

The exploitation of this flaw could lead to a full compromise of the affected system, including unauthorized data access, modification, or complete service disruption. Given the CVSS score of 7.5, this high-severity vulnerability represents a substantial risk to operational integrity and data confidentiality for any organization utilizing the affected Red Hat distributions.

Remediation Plan

Immediate Action: Monitor the official Red Hat security advisory portal for the release of patched dracut packages and apply them to all affected systems immediately upon availability.

Proactive Monitoring: Review system logs for unusual command execution patterns or unauthorized modifications to boot-time scripts and network configurations.

Compensating Controls: Restrict network access to the dracut management interface and ensure that only authorized personnel have access to the underlying infrastructure environments.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of August 9, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the vulnerability requires adjacent network access, the potential for total impact necessitates prompt attention once the vendor provides a patch.

Analyst Recommendation

Organizations should prioritize the identification of all instances of Red Hat Enterprise Linux within their environments. Given the nature of the dracut component, which is critical to the boot process, administrators must prepare for systematic patching across all affected versions to mitigate this high-risk command injection flaw.

---METADATA---
VENDOR: Red Hat
PRODUCT: Directory Server
AFFECTED_VERSIONS: Red Hat Directory Server 11, 12, 13; Red Hat Enterprise Linux 6, 7, 10
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A stack-based buffer overflow vulnerability exists in the 389 Directory Server (389-ds-base) component, which may allow for a denial of service.

Executive Summary:
A high-severity stack-based buffer overflow flaw in Red Hat Directory Server could lead to a service disruption, as it is exploitable by an unauthenticated remote attacker.

Vulnerability Details

CVE-ID: CVE-2026-15722

Affected Software: Red Hat Directory Server

Affected Versions: Red Hat Directory Server 11, 12, 13; Red Hat Enterprise Linux 6, 7, 10

Vulnerability: This is a stack-based buffer overflow (CWE-121) occurring within the 389 Directory Server codebase. The vulnerability is network-accessible and requires no authentication from the attacker to trigger the buffer corruption.

Business Impact

Successful exploitation of this flaw can result in a denial of service, rendering directory services unavailable to the organization. Given the critical role of directory services in identity management and authentication, such an outage poses a significant risk to operational continuity. With a CVSS score of 7.5, the vulnerability is classified as high severity, primarily due to the ease of remote exploitation.

Remediation Plan

Immediate Action: Consult the official Red Hat security advisory at the provided references to identify and apply the necessary patches or security errata for your specific deployment.

Proactive Monitoring: Monitor server logs for unexpected process crashes, segmentation faults, or irregular traffic patterns targeting directory server ports.

Compensating Controls: Ensure that directory server instances are protected by network-level access controls, such as firewalls, to restrict access to trusted internal segments only.

Exploitation Status

Public Exploit Available: No (unknown).

Analyst Notes: As of August 1, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its potential for unauthenticated remote impact on a foundational infrastructure component.

Analyst Recommendation

Organizations running Red Hat Directory Server should prioritize the identification of vulnerable instances within their environment. While active exploitation is not currently reported, the potential for remote service disruption necessitates the prompt application of security updates once provided by the vendor.

---METADATA---
VENDOR: Red Hat
PRODUCT: OpenShift
AFFECTED_VERSIONS: Red Hat Pen Drive Powered by Red Hat Lightspeed
CONFIDENCE: medium
MISSING: patch, technical_details
---END_METADATA---

Description Summary:
The OpenShift incluster-checks tool contains a privilege escalation flaw allowing authenticated users to gain root access on cluster nodes via privileged debug pods.

Executive Summary:
A high-severity privilege escalation vulnerability in the OpenShift incluster-checks tool allows authenticated users to obtain root access on underlying cluster nodes.

Vulnerability Details

CVE-ID: CVE-2026-15584

Affected Software: Red Hat OpenShift

Affected Versions: Red Hat Pen Drive Powered by Red Hat Lightspeed

Vulnerability: This vulnerability involves execution with unnecessary privileges (CWE-250). The incluster-checks tool creates privileged debug pods that mount the host filesystem in a shared namespace, which allows an authenticated user with the standard edit role to interact with these pods and escalate their privileges to root on the node.

Business Impact

A successful exploit allows an authenticated user to break out of the container environment and gain full root control over the cluster nodes. This level of access grants the attacker total control over the node, including the ability to steal data, deploy persistent backdoors, or disrupt all workloads running on that node. The CVSS score of 7.5 highlights the substantial risk to the entire cluster infrastructure.

Remediation Plan

Immediate Action: Review the vendor advisory for specific patch availability and apply all recommended updates to the OpenShift environment.

Proactive Monitoring: Monitor for the creation of unauthorized debug pods or unexpected container execution within the default namespace.

Compensating Controls: Restrict access to the edit role and implement strict Kubernetes admission controllers to prevent the creation of privileged pods by unauthorized users.

Exploitation Status

Public Exploit Available: No (unknown)

Analyst Notes: As of July 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is dangerous due to the ease with which an authenticated user can leverage standard permissions to gain administrative control.

Analyst Recommendation

This vulnerability represents a significant risk to cluster security. Administrators must treat this as a high-priority issue, restricting permissions for the edit role and monitoring for suspicious activity until a formal patch can be deployed to the incluster-checks tool.

---METADATA---
VENDOR: Red Hat
PRODUCT: OpenShift AI
AFFECTED_VERSIONS: Red Hat OpenShift AI 3.3
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A flaw in the TrustyAI Service (TAS) deployment of Red Hat OpenShift AI 3.3 results in missing authentication for critical functions.

Executive Summary:
A critical authentication bypass vulnerability in Red Hat OpenShift AI 3.3 could allow adjacent attackers to compromise the TrustyAI Service.

Vulnerability Details

CVE-ID: CVE-2026-15581

Affected Software: Red Hat OpenShift AI

Affected Versions: Red Hat OpenShift AI 3.3

Vulnerability: This vulnerability is caused by missing authentication for critical functions (CWE-306) in the TrustyAI Service. The CVSS vector (AV:A/PR:L) indicates that an authenticated user on the adjacent network can impact the confidentiality, integrity, and availability of the service.

Business Impact

The lack of authentication for sensitive functions exposes the TrustyAI Service to full compromise by authorized users on the same network. Given the CVSS score of 8.0, this vulnerability poses a high risk to the availability and data integrity of AI-driven workflows, which could result in significant operational disruption.

Remediation Plan

Immediate Action: Upgrade to Red Hat OpenShift AI 3.3, specifically utilizing the build/release 1785187521 or later, as detailed in the official Red Hat security advisory RHSA-2026:53263.

Proactive Monitoring: Monitor network traffic and authentication logs for anomalous access attempts targeting the TrustyAI Service endpoints.

Compensating Controls: Ensure that network segmentation is enforced to limit access to the TAS deployment to authorized personnel only, reducing the risk of adjacent network exploitation.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 11, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The requirement for adjacent network access moderately constrains the exploitability of this flaw.

Analyst Recommendation

Given the potential for total service compromise, it is imperative that organizations apply the provided updates immediately. Verify that all instances of the TrustyAI Service are patched to the required version to eliminate this authentication gap.

---METADATA---
VENDOR: Red Hat
PRODUCT: OpenShift AI (RHOAI)
AFFECTED_VERSIONS: Red Hat OpenShift AI (RHOAI) component rhoai/odh-trustyai-vllm-orchestrator-gateway-rhel9. All previous versions of packages in any minor update stream are assumed vulnerable.
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A flaw in the vllm-orchestrator-gateway component of Red Hat OpenShift AI causes sensitive information exposure by logging bearer tokens and chat payloads at DEBUG level.

Executive Summary:
A hard-coded DEBUG logging configuration in Red Hat OpenShift AI leads to the exposure of sensitive authentication headers and conversation data to unauthorized users with log access.

Vulnerability Details

CVE-ID: CVE-2026-15574

Affected Software: Red Hat OpenShift AI (RHOAI)

Affected Versions: Red Hat OpenShift AI (RHOAI) component rhoai/odh-trustyai-vllm-orchestrator-gateway-rhel9. All previous versions of packages in any minor update stream are assumed vulnerable.

Vulnerability: This is an insertion of sensitive information into an externally accessible file or directory (CWE-538). The gateway component logs full authorization headers and chat payloads before filtering occurs, allowing any user with access to cluster logs to intercept sensitive information.

Business Impact

The vulnerability carries a CVSS base score of 7.5, indicating a high risk of sensitive data compromise. Because the logs capture bearer tokens, attackers who gain read access to cluster logs can perform account impersonation or access protected AI model resources, leading to potential data breaches and unauthorized manipulation of AI services.

Remediation Plan

Immediate Action: Configure the RUST_LOG environment variable for the vllm-orchestrator-gateway component to a level higher than DEBUG, such as INFO, to prevent sensitive data from being written to logs.

Proactive Monitoring: Audit existing cluster logs for any instances of authorization headers or chat payloads that may have been captured while the system was in the vulnerable configuration.

Compensating Controls: Restrict access to cluster logs and observability tools to the minimum necessary personnel to reduce the exposure window while the logging configuration is being remediated.

Exploitation Status

Public Exploit Available: No (false)

Analyst Notes: As of July 13, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the vulnerability is easily triggered, it requires an attacker to already possess the capability to read cluster-level logs.

Analyst Recommendation

Given the ease of potential credential theft, administrators should prioritize updating the RUST_LOG environment variable immediately. Ensure that logging policies are reviewed to prevent the accidental exposure of sensitive payloads in future deployment cycles.

---METADATA---
VENDOR: Red Hat
PRODUCT: Red Hat build of Keycloak
AFFECTED_VERSIONS: 26.4.0 through 26.4.13, 26.6.0 through 26.6.4
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A type confusion flaw in the Dynamic Client Registration security policy management of the Red Hat build of Keycloak allows authenticated users to impact system security.

Executive Summary:
A type confusion vulnerability in Keycloak allows authenticated attackers to potentially bypass security policies and compromise system integrity.

Vulnerability Details

CVE-ID: CVE-2026-15572

Affected Software: Red Hat build of Keycloak

Affected Versions: 26.4.0 through 26.4.13, 26.6.0 through 26.6.4

Vulnerability: This is a type confusion vulnerability (CWE-843) within the Dynamic Client Registration (DCR) policy management. It requires the attacker to have low-level privileges to successfully trigger the flaw and manipulate resource access.

Business Impact

With a CVSS score of 8.8, this flaw poses a significant risk to identity management infrastructure. An attacker with minimal privileges could escalate their impact by manipulating client registration policies, potentially leading to unauthorized access to applications relying on Keycloak for authentication.

Remediation Plan

Immediate Action: Update the Red Hat build of Keycloak to the fixed versions (26.4.14-1, 26.4-22, 26.6.5-1, or 26.6-11) as detailed in the Red Hat errata.

Proactive Monitoring: Audit logs for unusual Dynamic Client Registration activities and review changes to client security policies that were not initiated by authorized administrators.

Compensating Controls: Enforce strict access control policies for DCR and limit the number of users with permissions to modify registration settings.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While this requires authentication, the impact is severe enough to warrant immediate patching in production identity environments.

Analyst Recommendation

Identity providers are high-value targets. Organizations should treat this vulnerability as critical and ensure that all instances of the Red Hat build of Keycloak are updated to the latest secure versions to prevent potential privilege escalation and unauthorized client registration.

---METADATA---
VENDOR: Red Hat
PRODUCT: JBoss Enterprise Application Platform
AFFECTED_VERSIONS: 7.4 ELS on RHEL 7
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A deserialization vulnerability in Red Hat JBoss Enterprise Application Platform allows unauthorized remote code execution via untrusted data.

Executive Summary:
A critical deserialization flaw in Red Hat JBoss Enterprise Application Platform (7.4 ELS) permits unauthenticated attackers to execute arbitrary code with the privileges of the application process.

Vulnerability Details

CVE-ID: CVE-2026-15555

Affected Software: Red Hat JBoss Enterprise Application Platform

Affected Versions: 7.4 ELS on RHEL 7

Vulnerability: The vulnerability is identified as a deserialization of untrusted data (CWE-502) within the JBoss marshalling component. An attacker can leverage this flaw to achieve remote code execution, as the system fails to properly validate incoming data streams before processing them.

Business Impact

The vulnerability carries a CVSS score of 8.8, reflecting a high risk of total system compromise. Successful exploitation allows an attacker to gain full control over the application server, potentially resulting in unauthorized data access, modification, or complete service disruption. This poses a severe threat to the integrity and availability of business-critical workflows managed by the JBoss platform.

Remediation Plan

Immediate Action: Update the JBoss Enterprise Application Platform components to the versions specified in the vendor advisory (RHSA-2026:53644), specifically ensuring the JBoss marshalling packages are upgraded to the versions provided in the enrichment data.

Proactive Monitoring: Review application and system access logs for suspicious serialized objects or unexpected network traffic patterns originating from unauthorized sources.

Compensating Controls: Implement strict network segmentation and egress filtering to limit the reach of the application server, and utilize a Web Application Firewall (WAF) to inspect traffic for common deserialization attack signatures.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of August 12, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the flaw is theoretically dangerous due to the nature of deserialization attacks, it is not currently flagged as an active threat.

Analyst Recommendation

Given the high impact of remote code execution, administrators must prioritize patching the affected JBoss components immediately. Adherence to the vendor-provided errata (RHSA-2026:53644) is the only definitive method to eliminate this vulnerability from the environment.

---METADATA---
VENDOR: Red Hat
PRODUCT: OpenShift AI
AFFECTED_VERSIONS: Red Hat OpenShift AI 3.3
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A vulnerability exists in the trustyai-service-operator LMEvalJob controller of Red Hat OpenShift AI 3.3, allowing for incorrect privilege assignment.

Executive Summary:
A high-severity privilege assignment flaw in the Red Hat OpenShift AI 3.3 LMEvalJob controller could allow authenticated attackers to gain unauthorized elevated access.

Vulnerability Details

CVE-ID: CVE-2026-15467

Affected Software: Red Hat OpenShift AI

Affected Versions: Red Hat OpenShift AI 3.3

Vulnerability: The vulnerability is an incorrect privilege assignment (CWE-266) within the LMEvalJob controller. The CVSS vector (PR:L) indicates that a low-privileged authenticated user can exploit this flaw to impact confidentiality and integrity.

Business Impact

Successful exploitation allows an authenticated user to perform unauthorized actions or access sensitive data, potentially leading to a compromise of the AI service infrastructure. With a CVSS score of 8.1, this represents a significant risk to organizational data security and system integrity, necessitating prompt remediation to prevent internal abuse.

Remediation Plan

Immediate Action: Update to Red Hat OpenShift AI 3.3, specifically utilizing the build/release 1785187521 or later, as documented in RHSA-2026:53263.

Proactive Monitoring: Review audit logs for unusual LMEvalJob controller activity or unauthorized privilege escalation patterns within the OpenShift cluster.

Compensating Controls: Implement strict Role-Based Access Control (RBAC) policies within OpenShift to limit the permissions of users capable of interacting with the LMEvalJob controller.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 11, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw requires prior authentication, which limits the attack surface to existing platform users.

Analyst Recommendation

The 8.1 CVSS score underscores the high risk posed by this privilege assignment flaw. Administrators should prioritize the application of the vendor-provided security updates to ensure the integrity of the OpenShift AI environment.

---METADATA---
VENDOR: Argoproj
PRODUCT: argo-helm / Argo CD
AFFECTED_VERSIONS: < 10.0.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A vulnerability in the Argo CD repo-server allows an unauthenticated attacker with network access to achieve remote code execution.

Executive Summary:
Argo CD contains a critical remote code execution vulnerability that allows an unauthenticated attacker with network access to the repo-server to take full control of the affected component.

Vulnerability Details

CVE-ID: CVE-2026-15416

Affected Software: Argoproj argo-helm, Red Hat OpenShift GitOps

Affected Versions: All versions prior to 10.0.0

Vulnerability: This is a CWE-306 Missing Authentication for Critical Function vulnerability, which permits an unauthenticated attacker to interact with the repo-server and execute arbitrary code.

Business Impact

With a CVSS score of 8.9, this vulnerability represents a critical risk to GitOps infrastructure. Successful exploitation could lead to full system compromise, unauthorized access to sensitive deployment configurations, and potential lateral movement within the OpenShift or Kubernetes environment.

Remediation Plan

Immediate Action: Apply available security patches provided by your vendor immediately, and restrict network access to the Argo CD repo-server to trusted internal networks only.

Proactive Monitoring: Monitor access logs for the repo-server for unauthorized connection attempts or unusual process execution patterns.

Compensating Controls: Implement strict network segmentation or firewall rules to ensure the repo-server is not accessible from untrusted or public network segments.

Exploitation Status

Public Exploit Available: No confirmed public exploit (per curated sources)

Analyst Notes: As of July 15, 2026, there is no public information indicating active exploitation in the wild, though security publications have highlighted the risk. Given the severity, the absence of a confirmed public exploit should not be taken as a signal of low risk.

Analyst Recommendation

This vulnerability is highly severe and requires immediate attention. Organizations should prioritize patching their Argo CD instances and enforcing network-level access controls to mitigate the potential for remote code execution.

---METADATA---
VENDOR: Red Hat
PRODUCT: OpenShift AI (RHOAI)
AFFECTED_VERSIONS: See vendor advisory
CONFIDENCE: medium
MISSING: versions
---END_METADATA---

Description Summary:
A blind SSRF vulnerability in the Red Hat OpenShift AI guardrails-detectors component allows remote attackers to access sensitive internal metadata and local files.

Executive Summary:
A critical Server-Side Request Forgery (SSRF) flaw in Red Hat OpenShift AI permits unauthenticated attackers to exfiltrate internal credentials and sensitive system data.

Vulnerability Details

CVE-ID: CVE-2026-15378

Affected Software: Red Hat OpenShift AI (RHOAI)

Affected Versions: See vendor advisory

Vulnerability: The guardrails-detectors component improperly processes XML Schema Definition (XSD) strings, enabling a blind SSRF attack. This allows an unauthenticated remote attacker to force the server to perform requests to internal endpoints, including cloud metadata services, Kubernetes APIs, and internal services, as well as read local files.

Business Impact

This vulnerability carries a CVSS score of 9.3, reflecting the severe potential for unauthorized access to highly sensitive information. An attacker could exfiltrate cloud provider credentials, service account tokens, and pod secrets, effectively bypassing the security perimeter of the container orchestration environment. This level of access could lead to a full cluster compromise and significant data breach.

Remediation Plan

Immediate Action: Update Red Hat OpenShift AI (RHOAI) to the latest version as specified by the vendor’s security advisory.

Proactive Monitoring: Monitor egress traffic from the OpenShift AI environment for anomalous connections to internal metadata or administrative endpoints.

Compensating Controls: Utilize Network Policies to restrict the ability of the guardrails-detectors component to initiate outbound connections to sensitive internal network segments.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 10, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the high severity and the nature of the flaw, the potential for exploitation is significant.

Analyst Recommendation

Organizations must prioritize applying the latest security updates provided by Red Hat to remediate this SSRF vulnerability. Given the risk of credential theft and cluster-wide compromise, immediate patching is necessary to maintain the integrity of the AI infrastructure.

---METADATA---
VENDOR: Red Hat
PRODUCT: OpenShift AI
AFFECTED_VERSIONS: All versions
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
Red Hat OpenShift AI contains a privilege assignment flaw in its maas-api and maas-controller ServiceAccounts that grants excessive cluster-wide permissions.

Executive Summary:
A critical privilege assignment vulnerability in Red Hat OpenShift AI allows authenticated attackers with ServiceAccount access to potentially obtain full cluster administrator privileges.

Vulnerability Details

CVE-ID: CVE-2026-15218

Affected Software: Red Hat OpenShift AI

Affected Versions: All versions

Vulnerability: This vulnerability involves an Incorrect Privilege Assignment (CWE-266) within the maas-api and maas-controller ServiceAccounts. The flaw requires high privileges to exploit, as it leverages existing service accounts to perform unauthorized actions across the cluster.

Business Impact

The vulnerability carries a CVSS score of 7.9, reflecting its high severity regarding potential impact on confidentiality and integrity. Successful exploitation could lead to full cluster administrator access, resulting in the unauthorized disclosure of sensitive information, such as secrets stored across the cluster, and total compromise of the container orchestration environment.

Remediation Plan

Immediate Action: Monitor vendor security bulletins for the release of a patch and apply it immediately upon availability.

Proactive Monitoring: Review cluster access logs for anomalous behavior originating from the maas-api and maas-controller service accounts, specifically looking for unauthorized secret access or unexpected API calls.

Compensating Controls: Implement strict network policies and RBAC hardening to limit the blast radius of compromised service accounts until a formal patch is applied.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 18, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the excessive permissions granted to internal service components.

Analyst Recommendation

Given the potential for complete cluster compromise, administrators should treat this vulnerability with high urgency. While no patch is currently identified, maintaining robust audit logging and applying the principle of least privilege to all cluster service accounts is essential to mitigate the risk of exploitation.

---METADATA---
VENDOR: Red Hat
PRODUCT: OpenShift AI (RHOAI)
AFFECTED_VERSIONS: See vendor advisory
CONFIDENCE: medium
MISSING: versions
---END_METADATA---

Description Summary:
A Server-Side Request Forgery vulnerability in the Red Hat OpenShift AI guardrails-detectors component permits unauthorized internal network requests and local file reading.

Executive Summary:
An unauthenticated SSRF vulnerability in Red Hat OpenShift AI allows remote attackers to access internal services and sensitive files, posing a severe risk to the deployment.

Vulnerability Details

CVE-ID: CVE-2026-15143

Affected Software: Red Hat OpenShift AI (RHOAI)

Affected Versions: See vendor advisory

Vulnerability: The file_type content detector within the guardrails-detectors component fails to restrict the processing of arbitrary XML Schema Definition (XSD) strings. This oversight allows an unauthenticated remote attacker to conduct SSRF attacks, resulting in unauthorized requests to arbitrary URLs or the reading of local files.

Business Impact

With a CVSS score of 9.3, this vulnerability represents a critical security risk to the integrity and confidentiality of the OpenShift AI deployment. By enabling attackers to read local files and query internal network services, the flaw could facilitate the theft of cloud provider credentials and other sensitive system secrets. This could lead to broader unauthorized access within the cloud environment.

Remediation Plan

Immediate Action: Update the Red Hat OpenShift AI (RHOAI) software to the most current version provided by the vendor.

Proactive Monitoring: Review system and access logs for suspicious requests involving XSD processing or unexpected outbound connection attempts from the application.

Compensating Controls: Implement strict network segmentation and egress filtering to prevent unauthorized outbound communication from the vulnerable component to internal or external endpoints.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 10, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The severity of this vulnerability necessitates immediate action to patch the affected OpenShift AI components. Security teams should ensure the latest updates are applied across all affected environments to mitigate the risk of SSRF-based information disclosure and credential theft.

---METADATA---
VENDOR: Red Hat
PRODUCT: Red Hat Enterprise Linux (SSSD)
AFFECTED_VERSIONS: Red Hat Enterprise Linux 6, 7, 8, 9, 10; Red Hat OpenShift Container Platform 4
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A path traversal vulnerability in the SSSD AD GPO provider of Red Hat Enterprise Linux allows for potential unauthorized file access.

Executive Summary:
A path traversal flaw in the SSSD AD GPO provider across multiple versions of Red Hat Enterprise Linux and OpenShift creates a high-risk security exposure.

Vulnerability Details

CVE-ID: CVE-2026-14476

Affected Software: Red Hat Enterprise Linux (SSSD AD GPO provider)

Affected Versions: Red Hat Enterprise Linux 6, 7, 8, 9, 10; Red Hat OpenShift Container Platform 4

Vulnerability: This vulnerability (CWE-23) is a relative path traversal flaw within the SSSD AD GPO provider. It requires high-privileged access (PR:H) to exploit, but allows for a container-escaped scope (S:C) to perform unauthorized file system operations.

Business Impact

With a CVSS score of 8.0, this vulnerability poses a significant risk to the integrity and confidentiality of Linux environments. Although it requires high privileges, the ability to perform path traversal in the context of SSSD/AD integration could allow an attacker to read or manipulate sensitive system files, potentially leading to total system compromise.

Remediation Plan

Immediate Action: Consult the Red Hat security advisory and apply the relevant SSSD patches for your specific RHEL or OpenShift version.

Proactive Monitoring: Review system audit logs for unauthorized file access attempts or anomalous behavior originating from the SSSD service.

Compensating Controls: Enforce strict file system permissions and ensure that high-privileged accounts are monitored through robust Identity and Access Management (IAM) practices.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

While the requirement for high privileges mitigates the immediate risk from external actors, this vulnerability remains a critical threat to internal security. System administrators should prioritize applying the vendor-provided patches during the next maintenance window to prevent potential privilege escalation or lateral movement.

---METADATA---
VENDOR: Red Hat
PRODUCT: Red Hat Enterprise Linux (RHEL) / OpenShift
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A flaw in the SSSD LDAP sudo provider within Red Hat Enterprise Linux and OpenShift allows potential security misconfiguration risks.

Executive Summary:
A high-severity security flaw in the SSSD LDAP sudo provider across multiple Red Hat products may result in insecure resource initialization.

Vulnerability Details

CVE-ID: CVE-2026-14474

Affected Software: Red Hat Enterprise Linux (6, 7, 8, 9, 10) and OpenShift Container Platform 4

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability exists within the SSSD (System Security Services Daemon) LDAP sudo provider and is classified as an insecure default resource initialization. This typically requires an authenticated user with existing access to the system environment to leverage the flawed provider logic.

Business Impact

Exploitation of this flaw could lead to unauthorized privilege escalation or the bypass of intended sudo security policies. With a CVSS score of 8.8, this vulnerability represents a significant threat to internal access control mechanisms, potentially granting attackers administrative control over affected RHEL or OpenShift nodes.

Remediation Plan

Immediate Action: Review the Red Hat Security Advisory (RHSA) portal for the specific package updates corresponding to your distribution and apply the security patches immediately.

Proactive Monitoring: Audit sudo logs and SSSD configuration files for unexpected changes or anomalies in user privilege delegation patterns.

Compensating Controls: Restrict access to systems utilizing SSSD for LDAP authentication and ensure that sudoers files are managed via secure, centralized configuration management tools.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the broad footprint of Red Hat Enterprise Linux and OpenShift in enterprise environments, this vulnerability necessitates an immediate audit of SSSD configurations. Administrators must apply vendor-supplied patches as soon as they become available to maintain the integrity of system-level access controls.

---METADATA---
VENDOR: Red Hat
PRODUCT: Red Hat Enterprise Linux 10
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A double-free memory corruption vulnerability exists in the libarchive RAR5 reader component within Red Hat Enterprise Linux 10.

Executive Summary:
Red Hat Enterprise Linux 10 contains a double-free vulnerability in the libarchive RAR5 reader that could lead to memory corruption or arbitrary code execution.

Vulnerability Details

CVE-ID: CVE-2026-14164

Affected Software: Red Hat Red Hat Enterprise Linux 10

Affected Versions: See vendor advisory for affected versions

Vulnerability: The vulnerability resides in the libarchive library's handling of RAR5 archives, specifically triggering a double-free condition when processing malformed files. This typically requires an attacker to provide a specially crafted file to a user or service for processing.

Business Impact

The CVSS score of 7.5 reflects the potential for memory corruption which, in certain contexts, may be leveraged to achieve remote code execution. This poses a significant threat to system stability and security, as successful exploitation could lead to unauthorized system access or complete service failure.

Remediation Plan

Immediate Action: Update the libarchive package to the latest version released by Red Hat to patch the memory management flaw.

Proactive Monitoring: Monitor system logs for crash reports or unusual process behavior related to archive processing utilities.

Compensating Controls: Utilize endpoint protection software to scan incoming archive files for malicious patterns and restrict the execution of untrusted archive processing tools.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 30, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Memory corruption vulnerabilities in core libraries are high-priority items due to their potential impact on system-wide security. Administrators should update all affected Red Hat Enterprise Linux instances as soon as the vendor-provided patch is available to ensure system integrity.

---METADATA---
VENDOR: Red Hat
PRODUCT: OpenShift AI (RHOAI)
AFFECTED_VERSIONS: See vendor advisory
CONFIDENCE: medium
MISSING: patch
---END_METADATA---

Description Summary:
A flaw in the Red Hat OpenShift AI MaaS Gateway involves improper access control, which could allow an authenticated user to perform unauthorized actions.

Executive Summary:
A high-severity access control vulnerability in the Red Hat OpenShift AI MaaS Gateway could allow authenticated users to gain unauthorized privileges or access restricted data.

Vulnerability Details

CVE-ID: CVE-2026-13717

Affected Software: Red Hat OpenShift AI (RHOAI)

Affected Versions: See vendor advisory

Vulnerability: This vulnerability involves improper access control (CWE-284) within the MaaS Gateway. It requires an attacker to have authenticated access (low privileges) to the platform to exploit the flaw.

Business Impact

Exploitation of this flaw allows a malicious actor with low-level access to escalate privileges or interact with backend gateway services inappropriately. Given the CVSS score of 8.8, this poses a severe threat to the security posture of the OpenShift environment, potentially leading to full system compromise or unauthorized manipulation of AI models.

Remediation Plan

Immediate Action: Review the official Red Hat security advisory for the specific patch version and apply the update to all affected RHOAI clusters immediately.

Proactive Monitoring: Audit access logs for the MaaS Gateway to identify suspicious user activity or unusual API call patterns that deviate from standard operational behavior.

Compensating Controls: Apply restrictive Role-Based Access Control (RBAC) policies within the OpenShift cluster to minimize the blast radius of any potentially compromised user accounts.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 11, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The requirement for low-level authentication means that securing user identities is a critical component of defense.

Analyst Recommendation

The severity of this issue necessitates an immediate review of the vendor security bulletins. Administrators should apply the relevant security patches for OpenShift AI to prevent potential unauthorized access or privilege escalation.

---METADATA---
VENDOR: Red Hat
PRODUCT: OpenShift Virtualization
AFFECTED_VERSIONS: Red Hat OpenShift Virtualization 4 (KubeVirt)
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A symlink following vulnerability in KubeVirt's virt-handler migration proxy allows an attacker with specific permissions to achieve full node compromise.

Executive Summary:
A critical privilege escalation vulnerability in Red Hat OpenShift Virtualization 4 allows local attackers to achieve full node compromise via symbolic link manipulation.

Vulnerability Details

CVE-ID: CVE-2026-13622

Affected Software: Red Hat OpenShift Virtualization 4 (KubeVirt)

Affected Versions: Red Hat OpenShift Virtualization 4

Vulnerability: This is a path traversal and privilege escalation vulnerability where an attacker with namespace edit and pods/exec permissions can manipulate Unix socket paths during live migration to bypass security boundaries.

Business Impact

The CVSS score of 8.8 reflects the high risk of full node compromise, which could lead to the complete takeover of virtualized workloads and the underlying host. This vulnerability could result in unauthorized access to sensitive data processed by virtual machines and the total loss of control over the virtualization infrastructure.

Remediation Plan

Immediate Action: Apply the vendor security updates immediately to resolve the path validation flaw in the migration proxy.

Proactive Monitoring: Audit pod execution logs and monitor for suspicious file system operations involving Unix sockets within the virtualization namespace.

Compensating Controls: Enforce strict Kubernetes Network Policies and Pod Security Admissions to restrict the ability of users to execute commands within pods, thereby reducing the risk of exploitation.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 13, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The requirement for specific namespace permissions limits the initial attack surface, but the potential for full node compromise remains a significant risk.

Analyst Recommendation

The ability to escalate to full node compromise makes this vulnerability a high priority for remediation. Infrastructure teams should verify their OpenShift Virtualization versions and apply the necessary patches provided by Red Hat as soon as they become available.

---METADATA---
VENDOR: Red Hat
PRODUCT: OpenShift Virtualization
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A vulnerability exists in the KubeVirt migration proxy component of Red Hat OpenShift Virtualization that could lead to unauthorized system access.

Executive Summary:
A high-severity flaw in Red Hat OpenShift Virtualization's KubeVirt migration proxy poses a significant risk of unauthorized access to virtualized infrastructure.

Vulnerability Details

CVE-ID: CVE-2026-13325

Affected Software: Red Hat OpenShift Virtualization

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability resides within the KubeVirt migration proxy, which manages virtual machine migration across cluster nodes. The level of authentication required depends on the cluster configuration, but it typically allows an attacker with network access to the proxy to manipulate migration traffic.

Business Impact

The exploitation of this vulnerability could lead to unauthorized access to virtual machine data or disruption of critical business services hosted on the OpenShift platform. With a CVSS score of 8.5, this high-severity issue necessitates immediate attention to prevent potential lateral movement within the containerized environment and subsequent data exfiltration.

Remediation Plan

Immediate Action: Review the official Red Hat security advisory to identify and apply the latest patches for the affected OpenShift Virtualization components.

Proactive Monitoring: Monitor cluster migration logs and network traffic patterns for anomalous activity involving the KubeVirt migration proxy.

Compensating Controls: Implement strict network policies to restrict access to the migration proxy to only authorized cluster nodes and management interfaces.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the critical role of the migration proxy in cluster operations, the potential for exploitation is high.

Analyst Recommendation

Given the high CVSS score, organizations should treat this vulnerability with urgency. Administrators must verify their current version of OpenShift Virtualization and coordinate with Red Hat’s security team to apply the necessary patches, ensuring the integrity of the virtualized environment remains intact.

---METADATA---
VENDOR: Red Hat
PRODUCT: Apicurio Registry
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security flaw exists within the Red Hat build of Apicurio Registry 3 that may lead to unauthorized system impacts.

Executive Summary:
A high-severity security vulnerability in the Red Hat build of Apicurio Registry 3 poses a significant risk of unauthorized system compromise.

Vulnerability Details

CVE-ID: CVE-2026-12975

Affected Software: Red Hat Apicurio Registry

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability involves an unspecified flaw within the Apicurio Registry component. While specific authentication requirements are not detailed, flaws of this nature typically allow for potential unauthorized access or service disruption if left unmitigated.

Business Impact

The identified vulnerability carries a CVSS score of 8.5, indicating a high risk of operational disruption or unauthorized data access. Successful exploitation could lead to a compromise of registry integrity, potentially impacting the development lifecycle or production services that rely on the registry for configuration management.

Remediation Plan

Immediate Action: Review the official Red Hat security advisory and apply the necessary patches or security updates as soon as they become available.

Proactive Monitoring: Monitor system and application logs for unusual access patterns or unauthorized attempts to interact with the registry API.

Compensating Controls: Implement strict network segmentation and ensure the registry is not exposed to untrusted networks to limit the attack surface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 26, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the high CVSS score, organizations should prioritize the evaluation of this vulnerability within their infrastructure. It is critical to monitor vendor release channels for updates and apply them immediately upon release to mitigate the risk of potential exploitation.

---METADATA---
VENDOR: Red Hat
PRODUCT: Red Hat Enterprise Linux 10
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A vulnerability in the libtiff library used within Red Hat Enterprise Linux 10 may allow for memory corruption or arbitrary code execution.

Executive Summary:
A critical flaw in the libtiff library on Red Hat Enterprise Linux 10 could allow attackers to compromise system security through malformed image processing.

Vulnerability Details

CVE-ID: CVE-2026-12912

Affected Software: Red Hat Red Hat Enterprise Linux 10

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability exists within the libtiff library, specifically concerning how it handles image data. An attacker could potentially trigger this flaw by providing a specially crafted TIFF file, leading to memory corruption or arbitrary code execution.

Business Impact

Successful exploitation poses a significant threat to data integrity and system availability, particularly on servers that process user-uploaded images. With a CVSS score of 7.3, this high-severity vulnerability warrants immediate attention to prevent system-level compromise.

Remediation Plan

Immediate Action: Apply the latest package updates for libtiff and related system libraries via the Red Hat package management system.

Proactive Monitoring: Review system logs for segmentation faults or unusual process crashes associated with image processing services.

Compensating Controls: Restrict image processing services to run in sandboxed or containerized environments with limited privileges to minimize the impact of a potential breach.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 30, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

System administrators must prioritize the deployment of security updates for libtiff on all Red Hat Enterprise Linux 10 instances. Immediate patching is the most effective way to secure the environment against potential exploitation of this library-level vulnerability.

---METADATA---
VENDOR: Red Hat
PRODUCT: OpenShift Dev Spaces
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security flaw exists in the vscode-java extension used within Red Hat OpenShift Dev Spaces, potentially impacting Java language support environments.

Executive Summary:
A high-severity vulnerability in the Red Hat OpenShift Dev Spaces vscode-java extension poses a significant risk to development environments and underlying container security.

Vulnerability Details

CVE-ID: CVE-2026-12856

Affected Software: Red Hat OpenShift Dev Spaces

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The flaw resides within the vscode-java extension, which provides Java language support. While specific authentication requirements are not detailed, such extensions often execute code within the context of the developer's workspace, necessitating careful access control.

Business Impact

Successful exploitation of this vulnerability could lead to unauthorized code execution within development containers, potentially allowing attackers to pivot into the broader OpenShift cluster. Given the CVSS score of 8.8, the risk of lateral movement and compromise of proprietary source code is substantial, justifying a high-priority remediation stance.

Remediation Plan

Immediate Action: Apply the latest security updates provided by Red Hat for OpenShift Dev Spaces immediately.

Proactive Monitoring: Review container logs for unauthorized process execution or anomalous network activity originating from developer workspaces.

Compensating Controls: Implement strict NetworkPolicies to isolate development namespaces and limit the impact of a potential container breakout.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 30, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The vulnerability represents a significant risk to the integrity of the development pipeline. Organizations should prioritize updating the vscode-java extension and verifying the security posture of all affected OpenShift Dev Spaces instances to mitigate the threat of unauthorized access.

---METADATA---
VENDOR: Red Hat
PRODUCT: Red Hat Ansible Automation Platform 2
AFFECTED_VERSIONS: See vendor advisory
CONFIDENCE: medium
MISSING: versions, patch
---END_METADATA---

Description Summary:
The Event-Driven Ansible server is vulnerable to event injection due to insufficient verification of data authenticity and reliance on spoofable HTTP headers.

Executive Summary:
A flaw in the Red Hat Ansible Automation Platform 2 Event-Driven Ansible server allows unauthenticated attackers to inject malicious events into protected streams.

Vulnerability Details

CVE-ID: CVE-2026-12383

Affected Software: Red Hat Ansible Automation Platform 2

Affected Versions: See vendor advisory

Vulnerability: The vulnerability (CWE-345) involves permissive access controls and an over-reliance on a spoofable Subject HTTP header during mTLS authentication. This flaw permits an attacker to inject arbitrary events into event streams that are intended to be protected by mTLS, thereby triggering unintended downstream automation.

Business Impact

With a CVSS score of 7.5, this vulnerability presents a significant risk to the integrity of automated infrastructure workflows. Successful exploitation allows an attacker to manipulate automation outcomes, which could lead to unauthorized configuration changes, system disruption, or the execution of arbitrary tasks within the managed environment.

Remediation Plan

Immediate Action: Review the official Red Hat security advisory for the specific patch version and apply the required updates to the Event-Driven Ansible server.

Proactive Monitoring: Inspect automation logs for anomalous event triggers or events originating from unexpected or non-authenticated sources.

Compensating Controls: Restrict network access to the EDA server to trusted management subnets and enforce strict mTLS validation policies at the network edge if possible.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 28, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Per CISA's SSVC assessment, there is no confirmed active exploitation, and the risk should be managed according to standard vulnerability management cycles.

Analyst Recommendation

This vulnerability represents a serious risk to automated systems and requires prompt attention. Organizations should monitor the Red Hat security portal for the latest patch information and apply the necessary updates to secure their Ansible automation pipelines against event injection.

---METADATA---
VENDOR: Red Hat
PRODUCT: Red Hat Ansible Automation Platform
AFFECTED_VERSIONS: 2.6 for RHEL 9 and 2.6
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A flaw in the Red Hat Ansible Automation Platform Gateway Envoy proxy configuration allows for authentication bypass through spoofing.

Executive Summary:
A critical authentication bypass vulnerability in the Red Hat Ansible Automation Platform Gateway proxy allows unauthenticated attackers to spoof identity, potentially leading to unauthorized system control.

Vulnerability Details

CVE-ID: CVE-2026-12382

Affected Software: Red Hat Ansible Automation Platform 2.6

Affected Versions: 2.6 for RHEL 9 (fixed in 0:2.6.20260422-1.el9ap and later); 2.6 (fixed in 1777311120 and later)

Vulnerability: This is an authentication bypass vulnerability (CWE-290) located in the Envoy proxy configuration of the AAP Gateway. The issue allows remote, unauthenticated attackers to bypass authentication mechanisms by spoofing requests.

Business Impact

Successful exploitation allows an attacker to bypass authentication, which could lead to full unauthorized access to the automation platform. With a CVSS score of 8.2, this poses a high risk to the integrity of automated workflows and the security of managed infrastructure across the enterprise.

Remediation Plan

Immediate Action: Apply the vendor-provided security errata (RHSA-2026:13508 or RHSA-2026:13545) immediately to update the AAP Gateway components.

Proactive Monitoring: Monitor proxy logs for unusual traffic patterns or requests that originate from unexpected sources or bypass standard authentication headers.

Compensating Controls: Ensure that the AAP Gateway is not exposed to the public internet and utilize network segmentation to limit access to the management interface.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of July 17, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The nature of the flaw, involving proxy configuration, suggests that internal security controls are insufficient if the proxy itself is compromised.

Analyst Recommendation

Given the high impact on integrity and the critical nature of automation platforms, organizations must treat this update with high priority. Apply the provided Red Hat errata as soon as possible to ensure the integrity of your automation environment.

---METADATA---
VENDOR: Red Hat
PRODUCT: Satellite
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A vulnerability in the foreman-mcp-server component of Red Hat Satellite may allow for unauthorized system interaction.

Executive Summary:
A high-severity flaw in Red Hat Satellite's foreman-mcp-server poses a significant risk of unauthorized access or service disruption.

Vulnerability Details

CVE-ID: CVE-2026-12112

Affected Software: Red Hat Satellite

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability resides within the foreman-mcp-server component, which handles communication protocols for system management. While specific authentication requirements are not detailed, flaws in management components often allow authenticated users to escalate privileges or bypass intended controls.

Business Impact

Successful exploitation of this vulnerability could lead to unauthorized control over infrastructure managed by Red Hat Satellite. Given the CVSS score of 7.8, this represents a high risk to organizational security, potentially enabling lateral movement or full compromise of managed endpoints, leading to significant operational downtime and data integrity loss.

Remediation Plan

Immediate Action: Review the official Red Hat security advisory for the release of a patch and apply it to all Satellite instances immediately.

Proactive Monitoring: Inspect system access logs for anomalous behavior related to the foreman-mcp-server process or unexpected administrative activity.

Compensating Controls: Restrict network access to the Satellite management interface to trusted administrative segments only to reduce the attack surface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 24, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The severity of this flaw necessitates immediate attention from IT security teams. Administrators should prioritize identifying vulnerable instances and applying vendor-supplied updates as soon as they become available to prevent potential system compromise.

---METADATA---
VENDOR: Red Hat
PRODUCT: Ansible Automation Platform 2.5
AFFECTED_VERSIONS: 2.5 for RHEL 8
---END_METADATA---

Description Summary:
A missing authorization vulnerability in the Event-Driven Ansible (EDA) websocket API allows authenticated users to access plaintext credentials, including SSH keys and tokens.

Executive Summary:
A critical authorization flaw in Red Hat Ansible Automation Platform 2.5 allows authenticated users to perform unauthorized credential access and account takeover.

Vulnerability Details

CVE-ID: CVE-2026-11807

Affected Software: Red Hat Ansible Automation Platform 2.5 for RHEL 8

Affected Versions: 2.5 for RHEL 8

Vulnerability: The /api/eda/ws/ansible-rulebook endpoint fails to perform proper permission checks on Worker messages. An authenticated user can leverage this to retrieve sensitive data, including OAuth tokens, vault passwords, and SSH keys.

Business Impact

With a CVSS score of 9.6, this vulnerability represents a severe threat to the integrity of automated workflows. Compromised credentials can facilitate lateral movement across the infrastructure, potentially leading to unauthorized control over the entire Ansible-managed environment and associated target systems.

Remediation Plan

Immediate Action: Update Red Hat Ansible Automation Platform 2.5 to the latest patched version provided by the vendor.

Proactive Monitoring: Audit access logs for the EDA websocket API to identify unusual activity or unauthorized requests targeting the /api/eda/ws/ansible-rulebook endpoint.

Compensating Controls: Limit access to the Ansible Automation Platform dashboard to strictly authorized personnel and implement network-level access controls to minimize the attack surface.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of June 23, 2026, there is no public information indicating active exploitation of this vulnerability. However, the high severity and the nature of the information exposed necessitate rapid remediation.

Analyst Recommendation

Given the potential for complete credential exposure, organizations utilizing Red Hat Ansible Automation Platform 2.5 must apply the necessary updates immediately. Failure to patch could result in widespread unauthorized access to sensitive automation secrets and infrastructure control.

---METADATA---
VENDOR: Red Hat
PRODUCT: Keycloak
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security flaw has been identified in the Red Hat build of Keycloak, potentially impacting authentication or authorization mechanisms.

Executive Summary:
A high-severity security flaw in the Red Hat build of Keycloak may allow for unauthorized access or compromise of identity management services.

Vulnerability Details

CVE-ID: CVE-2026-11800

Affected Software: Red Hat Keycloak

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability involves a critical flaw within the Keycloak identity and access management platform. The specific nature of the flaw allows for potential security bypasses that could impact the integrity of authentication workflows.

Business Impact

As Keycloak serves as a central authentication provider, a successful exploit could result in full identity compromise, granting attackers access to downstream applications and services. With a CVSS score of 8.1, this represents a high-risk scenario that could lead to widespread unauthorized access and significant operational disruption.

Remediation Plan

Immediate Action: Apply the latest security updates provided by Red Hat to all instances of the Keycloak build.

Proactive Monitoring: Monitor authentication logs for anomalous patterns, such as unexpected administrative logins or signs of session hijacking.

Compensating Controls: Implement strict network segmentation and ensure that the Keycloak management interface is not exposed to the public internet.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given Keycloak's critical role in enterprise security, the risk posed by this vulnerability is substantial. Security teams should prioritize patching affected instances immediately to protect identity services and prevent potential lateral movement within the network.

---METADATA---
VENDOR: Red Hat
PRODUCT: Directory Server
AFFECTED_VERSIONS: See vendor advisory for specific versions
CONFIDENCE: medium
MISSING: patch
---END_METADATA---

Description Summary:
Red Hat Directory Server is vulnerable to LDAP injection, allowing unauthenticated attackers to manipulate query logic.

Executive Summary:
A critical LDAP injection vulnerability in Red Hat Directory Server enables unauthenticated remote attackers to compromise sensitive directory information.

Vulnerability Details

CVE-ID: CVE-2026-11770

Affected Software: Red Hat Directory Server 11, 12, 13 and Enterprise Linux 6, 7, 10

Affected Versions: See vendor advisory for specific versions

Vulnerability: The software fails to properly neutralize special elements within LDAP queries, resulting in an LDAP injection (CWE-90) vulnerability. This allows an unauthenticated remote attacker to craft malicious queries that may return unauthorized data.

Business Impact

With a CVSS score of 7.5, this vulnerability represents a significant risk to identity management and authentication infrastructure. Successful exploitation could lead to the unauthorized disclosure of sensitive directory contents, such as user credentials or organizational structure, resulting in severe data breach consequences.

Remediation Plan

Immediate Action: Review the official Red Hat security advisory and apply the recommended patches or configuration changes provided by the vendor.

Proactive Monitoring: Review LDAP access logs for anomalous, highly complex, or syntactically unusual queries that may indicate injection attempts.

Compensating Controls: Ensure that directory access is restricted via network segmentation and that the application layer sanitizes all user input before inclusion in LDAP queries.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 1, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. LDAP injection is a well-understood attack vector, and the lack of public exploits does not negate the high risk of internal reconnaissance.

Analyst Recommendation

Security teams must treat this vulnerability with high priority, especially if the Directory Server is internet-facing or accessible to low-privilege network segments. Immediate patching or the application of vendor-recommended workarounds is essential to prevent unauthorized access to identity data.

---METADATA---
VENDOR: Red Hat
PRODUCT: Directory Server
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A heap-based buffer overflow vulnerability exists in the SASL I/O layer of Red Hat Directory Server (389-ds-base), potentially allowing for arbitrary code execution.

Executive Summary:
A critical heap buffer overflow in the SASL I/O layer of Red Hat Directory Server exposes systems to potential remote code execution by authenticated attackers.

Vulnerability Details

CVE-ID: CVE-2026-11610

Affected Software: Red Hat Directory Server

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability is a heap-based buffer overflow (CWE-122) located in the SASL I/O layer of the 389 Directory Server. The flaw can be triggered by a remote, authenticated attacker to cause memory corruption, leading to a crash or potential execution of arbitrary code.

Business Impact

The CVSS score of 8.8 reflects the high potential for system compromise. A successful exploit could lead to full loss of confidentiality, integrity, and availability of the directory server, which is often a critical component for authentication and identity management within an enterprise, potentially resulting in unauthorized access to connected systems.

Remediation Plan

Immediate Action: Apply the relevant Red Hat Security Advisories (RHSA-2026:36195 through RHSA-2026:36204) immediately to update the affected directory server packages to the specified fixed versions.

Proactive Monitoring: Monitor system logs for abnormal service crashes or unexpected restarts of the directory server process which may indicate exploitation attempts.

Compensating Controls: Restrict network access to the directory server interface to trusted administrative subnets only to minimize the exposure to potentially malicious authenticated users.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical role of Directory Server in enterprise environments, this vulnerability poses a significant risk to identity security. Administrators must prioritize the application of the vendor-supplied patches across all instances of Red Hat Directory Server to mitigate the risk of arbitrary code execution.

---METADATA---
VENDOR: Red Hat
PRODUCT: Advanced Cluster Management for Kubernetes
AFFECTED_VERSIONS: Red Hat Advanced Cluster Management for Kubernetes 2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A privilege escalation vulnerability in the Red Hat Advanced Cluster Management Application Subscription controller allows authenticated users to gain cluster-admin privileges.

Executive Summary:
A critical privilege escalation vulnerability in Red Hat Advanced Cluster Management for Kubernetes allows authenticated users with limited privileges to achieve full cluster-admin access.

Vulnerability Details

CVE-ID: CVE-2026-10090

Affected Software: Red Hat Advanced Cluster Management for Kubernetes 2

Affected Versions: Red Hat Advanced Cluster Management for Kubernetes 2

Vulnerability: This flaw stems from improper capability checks within the Application Subscription controller, which fails to validate if an authenticated user possesses the subscription-admin role before processing Helm charts. This allows a user with namespace-scoped edit privileges to deploy malicious resources, including ClusterRoleBindings, which grant unauthorized administrative control over the cluster.

Business Impact

The vulnerability carries a CVSS score of 9.9, reflecting its ability to facilitate total compromise of the Kubernetes environment. Successful exploitation grants an attacker full administrative control, leading to unauthorized data access, potential lateral movement across the infrastructure, and total loss of system integrity.

Remediation Plan

Immediate Action: Update Red Hat Advanced Cluster Management for Kubernetes 2 to the latest patched version provided by Red Hat.

Proactive Monitoring: Review audit logs for suspicious activity, specifically monitoring for the creation of unexpected ClusterRoleBindings or modifications to cluster-scoped resources by non-privileged accounts.

Compensating Controls: Strictly enforce Role-Based Access Control (RBAC) policies and limit the ability of users to create or modify Channel and Subscription resources within the hub namespace until the patch is applied.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 5, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the elevated authority the controller uses to process user-supplied input.

Analyst Recommendation

Given the critical severity and the potential for full cluster takeover, immediate action is required. Administrators must prioritize applying the vendor-supplied update to remediate the underlying logic error in the Subscription controller.

Executive Summary:
A high-severity vulnerability has been identified in the OpenShift API server, a core component of the container platform. This flaw could allow a remote attacker to compromise the entire cluster, potentially leading to unauthorized access to sensitive data, application disruption, or the execution of malicious code. Organizations using the affected products are urged to apply security updates immediately to mitigate significant security risks.

Vulnerability Details

CVE-ID: CVE-2025-14443

Affected Software: flaw Multiple Products (specifically affecting the ose-openshift-apiserver component within Red Hat OpenShift)

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability exists within the ose-openshift-apiserver component due to improper handling of API requests. A remote attacker can craft a specialized request that bypasses authentication and authorization checks. Successful exploitation allows the attacker to execute arbitrary commands with the privileges of the API server process, granting them administrative control over the entire OpenShift cluster.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 8.5. A successful exploit would grant an attacker complete control over the organization's containerized environment. This could lead to severe consequences, including the theft or destruction of sensitive data, deployment of malicious containers (e.g., ransomware, cryptominers), widespread application downtime, and loss of customer trust. The compromised cluster could also be used as a foothold to launch further attacks against the internal network, posing a significant risk to the entire organization.

Remediation Plan

Immediate Action: Apply the security updates provided by the vendor across all affected OpenShift clusters immediately. After patching, review API server access logs and audit logs for any unusual or unauthorized activity that may have occurred prior to the update.

Proactive Monitoring: System administrators should actively monitor ose-openshift-apiserver logs for malformed or suspicious API requests. Monitor for the creation of unexpected pods, services, or roles/clusterroles. Additionally, monitor for unusual outbound network connections originating from control plane components.

Compensating Controls: If immediate patching is not feasible, restrict network access to the OpenShift API server to only trusted IP addresses and administrative networks using strict firewall rules or network policies. Consider implementing enhanced API request validation and rate limiting as temporary measures to reduce the attack surface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of December 17, 2025, there are no known public exploits or active exploitation campaigns targeting this vulnerability. However, given the high severity and the critical nature of the affected component, it is highly probable that threat actors will develop and release exploit code in the near future.

Analyst Recommendation

Given the high CVSS score of 8.5 and the critical role of the OpenShift API server, this vulnerability presents a significant and immediate risk. Although not currently listed on the CISA KEV list, its potential impact warrants urgent action. We strongly recommend that organizations prioritize the deployment of vendor-supplied patches to all affected systems without delay. In parallel, implement the proactive monitoring and compensating controls described above to detect and mitigate potential exploitation attempts.

Executive Summary:
A critical privilege escalation vulnerability has been discovered in Red Hat OpenShift AI. This flaw allows a low-privileged user, such as a data scientist, to gain full administrative control over the AI platform by exploiting a weakness from within a standard user environment like a Jupyter notebook. Successful exploitation could lead to a complete compromise of the system, enabling theft of sensitive data and AI models, service disruption, and unauthorized access to the underlying infrastructure.

Vulnerability Details

CVE-ID: CVE-2025-10725

Affected Software: A flaw was found in Red Hat Openshift AI Multiple Products

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability allows for privilege escalation within the Red Hat OpenShift AI environment. An authenticated but low-privileged attacker can execute specially crafted code from within a sandboxed environment, such as a Jupyter notebook pod. This action exploits a flaw in the service's container management or resource allocation, allowing the attacker to break out of their container, escalate their privileges on the underlying cluster node, and ultimately gain administrative (cluster-admin) access to the entire OpenShift AI platform.

Business Impact

This vulnerability is rated as critical severity with a CVSS score of 9.9, posing a severe and immediate risk to the organization. A successful exploit could lead to a complete takeover of the OpenShift AI environment, resulting in catastrophic consequences. Key business impacts include the theft or manipulation of proprietary AI models and sensitive training data, disruption of critical business operations dependent on AI/ML workloads, and the potential for attackers to move laterally from the compromised cluster into the broader corporate network. This could lead to significant financial loss, reputational damage, and regulatory penalties.

Remediation Plan

Immediate Action: Immediately update all instances of Red Hat OpenShift AI to the latest patched version as recommended by the vendor. After applying the patch, it is critical to monitor for any signs of post-patch exploitation attempts and to conduct a thorough review of all relevant access logs for any anomalous activity that occurred prior to the update.

Proactive Monitoring: Implement enhanced monitoring of the OpenShift AI environment. Security teams should look for unusual commands being executed within user pods (e.g., Jupyter notebooks), unexpected network connections from these pods to internal cluster services (like the Kubernetes API server), and any alerts from runtime security tools indicating potential container escape activity. Review audit logs for unauthorized privilege escalations or modifications to cluster-level roles and permissions.

Compensating Controls: If immediate patching is not feasible, implement the following compensating controls to mitigate risk:

• Apply stricter network policies to limit egress and pod-to-pod communication for all data science workloads.
• Enforce the principle of least privilege by reviewing and reducing permissions for all user and service accounts.
• Utilize runtime security solutions to detect and block suspicious in-container behavior and container escape attempts in real-time.
• Temporarily restrict or increase monitoring for accounts with access to create and run notebook instances.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Sep 30, 2025, there is no known public proof-of-concept exploit code, and the vulnerability is not being actively exploited in the wild. However, due to the critical CVSS score of 9.9 and the low complexity of the attack, it is highly probable that threat actors will rapidly develop and deploy exploits. Organizations should assume imminent exploitation.

Analyst Recommendation
Given the critical severity (CVSS 9.9) of this privilege escalation vulnerability, we recommend treating its remediation as the highest priority. Although this CVE is not currently listed on the CISA KEV catalog, its potential impact warrants immediate action. Organizations must apply the vendor-supplied patches to all affected Red Hat OpenShift AI instances without delay. If patching is delayed, the compensating controls listed above must be implemented immediately to reduce the attack surface while preparing for the update.