RHSA-2026:60440
Vulnerability from csaf_redhat - Published: 2026-09-01 21:39 - Updated: 2026-09-02 08:11Summary
Red Hat Security Advisory: OpenShift Container Platform 4.22.12 bug fix and security update
Severity
Important
Notes
Topic: Red Hat OpenShift Container Platform release 4.22.12 is now available with
updates to packages and images that fix several bugs and add enhancements.
This release includes a security update for Red Hat OpenShift Container
Platform 4.22.
Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.
Details: Red Hat OpenShift Container Platform is Red Hat's cloud computing
Kubernetes application platform solution designed for on-premise or private
cloud deployments.
This advisory contains the container images for Red Hat OpenShift Container
Platform 4.22.12. See the following advisory for the RPM packages for this
release:
https://access.redhat.com/errata/RHBA-2026:60439
Space precludes documenting all of the container images in this advisory.
See the following Release Notes documentation, which will be updated
shortly for this release, for details about these changes:
https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/
Security Fix(es):
* curl: curl: Insecure connection establishment due to TLS configuration
mismatch (CVE-2026-8286)
* curl: curl: Man-in-the-middle attack via SSH host key bypass
(CVE-2026-9547)
* bind9: bind: Potential wildcard CNAME RPZ policy bypass (CVE-2026-11331)
* dracut: dracut: root code execution via unescaped error message written
to sourced emergency hook script in die() (CVE-2026-15816)
* unbound: Unbound: Cache poisoning via insufficient RRSIG.Labels
validation and premature cache writes (CVE-2026-44690)
* unbound: Unbound: Denial of Service via malformed EDNS Report-Channel
option (CVE-2026-55973)
* bind: bind9: Incorrect acceptance of NSEC3 records (CVE-2026-10723)
* kernel: smb: client: validate DFS referral PathConsumed (CVE-2026-68343)
* kbd: Local privilege escalation in openvt via incorrect process owner
verification allowing passwordless root login (CVE-2026-72693)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
All OpenShift Container Platform 4.22 users are advised to upgrade to these
updated packages and images when they are available in the appropriate
release channel. To check for available updates, use the OpenShift CLI (oc)
or web console. Instructions for upgrading a cluster are available at
https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in curl. When a new data transfer attempts to upgrade its connection using STARTTLS, it may incorrectly reuse an existing live connection. This reuse can occur even if the Transport Layer Security (TLS) configuration of the new transfer does not match the existing connection, potentially leading to an insecure connection being established.
8.1 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608251819-0 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608251819-0 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608251819-0 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608251819-0 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in curl. When a libcurl-based application uses SCP:// or SFTP:// for transfers and employs the CURLOPT_SSH_KEYFUNCTION callback, it may silently accept an untrusted server. This occurs if the server's host key type differs from the one stored in the known_hosts file. The callback mechanism fails to enforce the host key restriction, enabling a connection to an untrusted server and risking a man-in-the-middle attack.
7.4 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608251819-0 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608251819-0 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608251819-0 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608251819-0 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
BIND may accept incorrect child-zone NSEC3 records as valid, which could allow an attacker to forge authenticated NXDOMAIN responses.
6.8 (Medium)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608251819-0 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608251819-0 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608251819-0 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608251819-0 | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
A flaw was found in BIND 9, a widely used Domain Name System (DNS) software. A remote attacker could exploit this by sending specially crafted, excessively long DNS queries. This could bypass Response Policy Zone (RPZ) rules, which are designed to block access to malicious domains, and potentially cause the BIND 9 software to crash, leading to a denial of service.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608251819-0 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608251819-0 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608251819-0 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608251819-0 | — |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in dracut. The die() error-handling function writes its message into a shell script under the initramfs emergency-hook directory without properly shell-quoting it. When the message contains data derived from the DHCP ROOT_PATH option, an attacker on the adjacent network who controls a rogue DHCP server can inject a command-substitution sequence that executes as root the next time dracut sources its emergency hook scripts during standard boot-failure handling.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608251819-0 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608251819-0 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608251819-0 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608251819-0 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Unbound. Insufficient validation of the RRSIG.Labels field, combined with premature cache writes during RFC 8198 aggressive NSEC processing, can lead to cache poisoning. This vulnerability allows a malicious actor, controlling a single delegated zone, to poison arbitrary sibling zones under NSEC-signed parent domains. The primary impact is the integrity of DNS resolution, potentially leading to users being directed to malicious websites or services.
8.6 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608251819-0 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608251819-0 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608251819-0 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608251819-0 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Unbound. When the 'dns-error-reporting: yes' option is enabled, a remote attacker can send a specially crafted DNS response containing a malformed EDNS Report-Channel option from a delegated zone they control. This can lead to a stack variable overwrite, causing the Unbound daemon to terminate. This vulnerability results in a denial of service.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608251819-0 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608251819-0 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608251819-0 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608251819-0 | — |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in the Linux kernel's Server Message Block (SMB) client. A remote attacker could send a specially crafted SMB response containing a malformed Distributed File System (DFS) referral. This could cause the PathConsumed value to exceed the search name length, leading to an out-of-bounds read during DFS path parsing. This vulnerability may result in information disclosure or a denial of service.
7.0 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608251819-0 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608251819-0 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608251819-0 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608251819-0 | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
`openvt -u` is intended to identify the owner of the current VT and then execute `login` as that user from a privileged context. In the documented `kbrequest`/init usage, the ownership test in `authenticate_user()` relies on `stat("/proc/<pid>/fd/0")`. `stat()` on `/proc/<pid>/fd/0` follows the symlink to the underlying TTY device node. As a result, `buf.st_uid` reflects the owner of the TTY node rather than the owner of the process holding the file descriptor. If the TTY owner returns to `root` or the getty owner after logout while an unprivileged process still has `fd 0` attached to that TTY, the check can incorrectly treat that process as belonging to the privileged console owner. Once that check succeeds, the `-u` path executes a passwordless login as the selected user. In the documented `kbrequest`/init deployment using `openvt -us`, this can result in passwordless `login -f root` on the spawned VT. This report establishes that privilege escalation path for that documented deployment; it does not claim equivalent reachability for deployments that do not use `openvt -u` from a privileged `kbrequest`/init path.
7.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608251819-0 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608251819-0 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608251819-0 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608251819-0 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
References
60 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat OpenShift Container Platform release 4.22.12 is now available with\nupdates to packages and images that fix several bugs and add enhancements.\n\n This release includes a security update for Red Hat OpenShift Container\nPlatform 4.22.\n\nRed Hat Product Security has rated this update as having a security impact\nof Important. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available for each vulnerability\nfrom the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat OpenShift Container Platform is Red Hat\u0027s cloud computing\nKubernetes application platform solution designed for on-premise or private\ncloud deployments.\n\nThis advisory contains the container images for Red Hat OpenShift Container\nPlatform 4.22.12. See the following advisory for the RPM packages for this\nrelease:\n\nhttps://access.redhat.com/errata/RHBA-2026:60439\n\nSpace precludes documenting all of the container images in this advisory.\nSee the following Release Notes documentation, which will be updated\nshortly for this release, for details about these changes:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nSecurity Fix(es):\n\n* curl: curl: Insecure connection establishment due to TLS configuration\nmismatch (CVE-2026-8286)\n* curl: curl: Man-in-the-middle attack via SSH host key bypass\n(CVE-2026-9547)\n* bind9: bind: Potential wildcard CNAME RPZ policy bypass (CVE-2026-11331)\n* dracut: dracut: root code execution via unescaped error message written\nto sourced emergency hook script in die() (CVE-2026-15816)\n* unbound: Unbound: Cache poisoning via insufficient RRSIG.Labels\nvalidation and premature cache writes (CVE-2026-44690)\n* unbound: Unbound: Denial of Service via malformed EDNS Report-Channel\noption (CVE-2026-55973)\n* bind: bind9: Incorrect acceptance of NSEC3 records (CVE-2026-10723)\n* kernel: smb: client: validate DFS referral PathConsumed (CVE-2026-68343)\n* kbd: Local privilege escalation in openvt via incorrect process owner\nverification allowing passwordless root login (CVE-2026-72693)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE\npage(s) listed in the References section.\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these\nupdated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift CLI (oc)\nor web console. Instructions for upgrading a cluster are available at\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:60440",
"url": "https://access.redhat.com/errata/RHSA-2026:60440"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2462115",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2462115"
},
{
"category": "external",
"summary": "2496758",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496758"
},
{
"category": "external",
"summary": "2496763",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496763"
},
{
"category": "external",
"summary": "2500889",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500889"
},
{
"category": "external",
"summary": "2503063",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503063"
},
{
"category": "external",
"summary": "2503075",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503075"
},
{
"category": "external",
"summary": "2503721",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503721"
},
{
"category": "external",
"summary": "2504560",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2504560"
},
{
"category": "external",
"summary": "2513373",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2513373"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_60440.json"
}
],
"title": "Red Hat Security Advisory: OpenShift Container Platform 4.22.12 bug fix and security update",
"tracking": {
"current_release_date": "2026-09-02T08:11:07+00:00",
"generator": {
"date": "2026-09-02T08:11:07+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.16"
}
},
"id": "RHSA-2026:60440",
"initial_release_date": "2026-09-01T21:39:31+00:00",
"revision_history": [
{
"date": "2026-09-01T21:39:31+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-09-01T21:39:31+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-09-02T08:11:07+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat OpenShift Container Platform 4.22",
"product": {
"name": "Red Hat OpenShift Container Platform 4.22",
"product_id": "9Base-RHOSE-4.22",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openshift:4.22::el9"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenShift Enterprise"
},
{
"branches": [
{
"category": "product_version",
"name": "rhcos-aarch64-4.22.9.8.202608251819-0",
"product": {
"name": "rhcos-aarch64-4.22.9.8.202608251819-0",
"product_id": "rhcos-aarch64-4.22.9.8.202608251819-0",
"product_identification_helper": {
"purl": "pkg:generic/redhat/rhcos@4.22.9.8.202608251819?arch=aarch64"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "rhcos-ppc64le-4.22.9.8.202608251819-0",
"product": {
"name": "rhcos-ppc64le-4.22.9.8.202608251819-0",
"product_id": "rhcos-ppc64le-4.22.9.8.202608251819-0",
"product_identification_helper": {
"purl": "pkg:generic/redhat/rhcos@4.22.9.8.202608251819?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "rhcos-s390x-4.22.9.8.202608251819-0",
"product": {
"name": "rhcos-s390x-4.22.9.8.202608251819-0",
"product_id": "rhcos-s390x-4.22.9.8.202608251819-0",
"product_identification_helper": {
"purl": "pkg:generic/redhat/rhcos@4.22.9.8.202608251819?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "rhcos-x86_64-4.22.9.8.202608251819-0",
"product": {
"name": "rhcos-x86_64-4.22.9.8.202608251819-0",
"product_id": "rhcos-x86_64-4.22.9.8.202608251819-0",
"product_identification_helper": {
"purl": "pkg:generic/redhat/rhcos@4.22.9.8.202608251819?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "rhcos-aarch64-4.22.9.8.202608251819-0 as a component of Red Hat OpenShift Container Platform 4.22",
"product_id": "9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608251819-0"
},
"product_reference": "rhcos-aarch64-4.22.9.8.202608251819-0",
"relates_to_product_reference": "9Base-RHOSE-4.22"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhcos-ppc64le-4.22.9.8.202608251819-0 as a component of Red Hat OpenShift Container Platform 4.22",
"product_id": "9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608251819-0"
},
"product_reference": "rhcos-ppc64le-4.22.9.8.202608251819-0",
"relates_to_product_reference": "9Base-RHOSE-4.22"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhcos-s390x-4.22.9.8.202608251819-0 as a component of Red Hat OpenShift Container Platform 4.22",
"product_id": "9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608251819-0"
},
"product_reference": "rhcos-s390x-4.22.9.8.202608251819-0",
"relates_to_product_reference": "9Base-RHOSE-4.22"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhcos-x86_64-4.22.9.8.202608251819-0 as a component of Red Hat OpenShift Container Platform 4.22",
"product_id": "9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608251819-0"
},
"product_reference": "rhcos-x86_64-4.22.9.8.202608251819-0",
"relates_to_product_reference": "9Base-RHOSE-4.22"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-8286",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"discovery_date": "2026-07-03T07:01:27.043110+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2496763"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in curl. When a new data transfer attempts to upgrade its connection using STARTTLS, it may incorrectly reuse an existing live connection. This reuse can occur even if the Transport Layer Security (TLS) configuration of the new transfer does not match the existing connection, potentially leading to an insecure connection being established.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "curl: curl: Insecure connection establishment due to TLS configuration mismatch",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw as `curl` may establish an insecure connection when attempting to upgrade a transfer with STARTTLS, potentially reusing an existing connection with mismatched TLS configurations. This could lead to unexpected data exposure or compromise, particularly in environments where `curl` is used for sensitive data transfers and relies on STARTTLS for security.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608251819-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608251819-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608251819-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608251819-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-8286"
},
{
"category": "external",
"summary": "RHBZ#2496763",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496763"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-8286",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-8286"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-8286",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8286"
},
{
"category": "external",
"summary": "https://curl.se/docs/CVE-2026-8286.html",
"url": "https://curl.se/docs/CVE-2026-8286.html"
},
{
"category": "external",
"summary": "https://curl.se/docs/CVE-2026-8286.json",
"url": "https://curl.se/docs/CVE-2026-8286.json"
},
{
"category": "external",
"summary": "https://hackerone.com/reports/3718195",
"url": "https://hackerone.com/reports/3718195"
}
],
"release_date": "2026-07-03T06:14:17.541000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-01T21:39:31+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation,\nwhich will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata\nfor x86_64, s390x, ppc64le, and aarch64 architectures. The image digests\nmay be found at\nhttps://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is\nsha256:c987c0017b86a5aed02d5fa854b4649039e7221e14fca2e824dc37b2937ce7b2\n\n (For s390x architecture)\n The image digest is\nsha256:e38f225c850f6fdbdaf6ac3ef1f762b1e7068da19ef3cd57a00f72554e3d0a72\n\n (For ppc64le architecture)\n The image digest is\nsha256:ea726e65a0f5f8ae5b5fe4ce31f2aa75943c893c91bd75feb644c4042c88865d\n\n (For aarch64 architecture)\n The image digest is\nsha256:ab1d1b8e7b22fb2a6b3923e6e8fe77b8f0f774c762836a07542b7ed5ad52d86d\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these\nupdated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift CLI (oc)\nor web console. Instructions for upgrading a cluster are available at\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608251819-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608251819-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608251819-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608251819-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60440"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608251819-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608251819-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608251819-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608251819-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608251819-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608251819-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608251819-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608251819-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "curl: curl: Insecure connection establishment due to TLS configuration mismatch"
},
{
"cve": "CVE-2026-9547",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-07-03T07:01:12.182841+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2496758"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in curl. When a libcurl-based application uses SCP:// or SFTP:// for transfers and employs the CURLOPT_SSH_KEYFUNCTION callback, it may silently accept an untrusted server. This occurs if the server\u0027s host key type differs from the one stored in the known_hosts file. The callback mechanism fails to enforce the host key restriction, enabling a connection to an untrusted server and risking a man-in-the-middle attack.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "curl: curl: Man-in-the-middle attack via SSH host key bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw where libcurl-based applications performing SCP or SFTP transfers with the CURLOPT_SSH_KEYFUNCTION callback may silently accept an untrusted server. This occurs when a server presents a host key type that differs from the one recorded in the known_hosts file, bypassing a critical host key verification and enabling potential man-in-the-middle attacks. The vulnerability requires specific application callback usage, not a general curl client default.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608251819-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608251819-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608251819-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608251819-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-9547"
},
{
"category": "external",
"summary": "RHBZ#2496758",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496758"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-9547",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-9547"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-9547",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-9547"
},
{
"category": "external",
"summary": "https://curl.se/docs/CVE-2026-9547.html",
"url": "https://curl.se/docs/CVE-2026-9547.html"
},
{
"category": "external",
"summary": "https://curl.se/docs/CVE-2026-9547.json",
"url": "https://curl.se/docs/CVE-2026-9547.json"
},
{
"category": "external",
"summary": "https://hackerone.com/reports/3751712",
"url": "https://hackerone.com/reports/3751712"
}
],
"release_date": "2026-07-03T06:18:44.499000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-01T21:39:31+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation,\nwhich will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata\nfor x86_64, s390x, ppc64le, and aarch64 architectures. The image digests\nmay be found at\nhttps://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is\nsha256:c987c0017b86a5aed02d5fa854b4649039e7221e14fca2e824dc37b2937ce7b2\n\n (For s390x architecture)\n The image digest is\nsha256:e38f225c850f6fdbdaf6ac3ef1f762b1e7068da19ef3cd57a00f72554e3d0a72\n\n (For ppc64le architecture)\n The image digest is\nsha256:ea726e65a0f5f8ae5b5fe4ce31f2aa75943c893c91bd75feb644c4042c88865d\n\n (For aarch64 architecture)\n The image digest is\nsha256:ab1d1b8e7b22fb2a6b3923e6e8fe77b8f0f774c762836a07542b7ed5ad52d86d\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these\nupdated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift CLI (oc)\nor web console. Instructions for upgrading a cluster are available at\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608251819-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608251819-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608251819-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608251819-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60440"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608251819-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608251819-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608251819-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608251819-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608251819-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608251819-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608251819-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608251819-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "curl: curl: Man-in-the-middle attack via SSH host key bypass"
},
{
"cve": "CVE-2026-10723",
"cwe": {
"id": "CWE-345",
"name": "Insufficient Verification of Data Authenticity"
},
"discovery_date": "2026-07-21T21:13:55.893000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2504560"
}
],
"notes": [
{
"category": "description",
"text": "BIND may accept incorrect child-zone NSEC3 records as valid, which could allow an attacker to forge authenticated NXDOMAIN responses.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bind: bind9: Incorrect acceptance of NSEC3 records",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Moderate flaw in BIND allows an attacker to forge authenticated NXDOMAIN responses for sibling zones due to incorrect validation of child-zone NSEC3 records. Exploitation requires high attack complexity, limiting the immediate risk to Red Hat products.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608251819-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608251819-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608251819-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608251819-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-10723"
},
{
"category": "external",
"summary": "RHBZ#2504560",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2504560"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-10723",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-10723"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-10723",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-10723"
}
],
"release_date": "2026-07-22T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-01T21:39:31+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation,\nwhich will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata\nfor x86_64, s390x, ppc64le, and aarch64 architectures. The image digests\nmay be found at\nhttps://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is\nsha256:c987c0017b86a5aed02d5fa854b4649039e7221e14fca2e824dc37b2937ce7b2\n\n (For s390x architecture)\n The image digest is\nsha256:e38f225c850f6fdbdaf6ac3ef1f762b1e7068da19ef3cd57a00f72554e3d0a72\n\n (For ppc64le architecture)\n The image digest is\nsha256:ea726e65a0f5f8ae5b5fe4ce31f2aa75943c893c91bd75feb644c4042c88865d\n\n (For aarch64 architecture)\n The image digest is\nsha256:ab1d1b8e7b22fb2a6b3923e6e8fe77b8f0f774c762836a07542b7ed5ad52d86d\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these\nupdated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift CLI (oc)\nor web console. Instructions for upgrading a cluster are available at\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608251819-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608251819-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608251819-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608251819-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60440"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608251819-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608251819-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608251819-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608251819-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "bind: bind9: Incorrect acceptance of NSEC3 records"
},
{
"cve": "CVE-2026-11331",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2026-07-21T16:15:37.317000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2503721"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in BIND 9, a widely used Domain Name System (DNS) software. A remote attacker could exploit this by sending specially crafted, excessively long DNS queries. This could bypass Response Policy Zone (RPZ) rules, which are designed to block access to malicious domains, and potentially cause the BIND 9 software to crash, leading to a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bind9: bind: Potential wildcard CNAME RPZ policy bypass",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608251819-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608251819-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608251819-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608251819-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-11331"
},
{
"category": "external",
"summary": "RHBZ#2503721",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503721"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-11331",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-11331"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-11331",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11331"
}
],
"release_date": "2026-07-22T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-01T21:39:31+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation,\nwhich will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata\nfor x86_64, s390x, ppc64le, and aarch64 architectures. The image digests\nmay be found at\nhttps://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is\nsha256:c987c0017b86a5aed02d5fa854b4649039e7221e14fca2e824dc37b2937ce7b2\n\n (For s390x architecture)\n The image digest is\nsha256:e38f225c850f6fdbdaf6ac3ef1f762b1e7068da19ef3cd57a00f72554e3d0a72\n\n (For ppc64le architecture)\n The image digest is\nsha256:ea726e65a0f5f8ae5b5fe4ce31f2aa75943c893c91bd75feb644c4042c88865d\n\n (For aarch64 architecture)\n The image digest is\nsha256:ab1d1b8e7b22fb2a6b3923e6e8fe77b8f0f774c762836a07542b7ed5ad52d86d\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these\nupdated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift CLI (oc)\nor web console. Instructions for upgrading a cluster are available at\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608251819-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608251819-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608251819-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608251819-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60440"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608251819-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608251819-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608251819-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608251819-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bind9: bind: Potential wildcard CNAME RPZ policy bypass"
},
{
"acknowledgments": [
{
"names": [
"Pavel Valena"
],
"organization": "Red Hat",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2026-15816",
"cwe": {
"id": "CWE-78",
"name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
},
"discovery_date": "2026-06-10T19:21:21+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2500889"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in dracut. The die() error-handling function writes its message into a shell script under the initramfs emergency-hook directory without properly shell-quoting it. When the message contains data derived from the DHCP ROOT_PATH option, an attacker on the adjacent network who controls a rogue DHCP server can inject a command-substitution sequence that executes as root the next time dracut sources its emergency hook scripts during standard boot-failure handling.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die()",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security rates this flaw\u0027s impact as Important. Exploitation requires an attacker-controlled or spoofed DHCP server on the same network segment as a system performing network boot (root=dhcp/netroot=dhcp), and for the DHCP-supplied ROOT_PATH value to fail dracut\u0027s netroot handler resolution -- both fully within an adjacent-network attacker\u0027s control. Reaching the point where the poisoned hook script is actually sourced depends on dracut\u0027s boot-failure handling reinvoking the emergency shell mechanism, which occurs by default when the netroot handler cannot be resolved. This is a separate code path from CVE-2026-6893, which patched modules.d/35network-legacy/dhclient-script.sh but did not modify dracut-lib.sh\u0027s die() function. Systems that do not perform network/PXE boot, or that do not rely on DHCP-supplied ROOT_PATH values, are not exposed to this issue.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608251819-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608251819-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608251819-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608251819-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-15816"
},
{
"category": "external",
"summary": "RHBZ#2500889",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500889"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-15816",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-15816"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-15816",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15816"
},
{
"category": "external",
"summary": "https://bugzilla.redhat.com/show_bug.cgi?id=2459963",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2459963"
},
{
"category": "external",
"summary": "https://github.com/dracutdevs/dracut/blob/master/modules.d/40network/netroot.sh",
"url": "https://github.com/dracutdevs/dracut/blob/master/modules.d/40network/netroot.sh"
},
{
"category": "external",
"summary": "https://github.com/dracutdevs/dracut/blob/master/modules.d/99base/dracut-lib.sh",
"url": "https://github.com/dracutdevs/dracut/blob/master/modules.d/99base/dracut-lib.sh"
}
],
"release_date": "2026-08-05T23:59:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-01T21:39:31+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation,\nwhich will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata\nfor x86_64, s390x, ppc64le, and aarch64 architectures. The image digests\nmay be found at\nhttps://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is\nsha256:c987c0017b86a5aed02d5fa854b4649039e7221e14fca2e824dc37b2937ce7b2\n\n (For s390x architecture)\n The image digest is\nsha256:e38f225c850f6fdbdaf6ac3ef1f762b1e7068da19ef3cd57a00f72554e3d0a72\n\n (For ppc64le architecture)\n The image digest is\nsha256:ea726e65a0f5f8ae5b5fe4ce31f2aa75943c893c91bd75feb644c4042c88865d\n\n (For aarch64 architecture)\n The image digest is\nsha256:ab1d1b8e7b22fb2a6b3923e6e8fe77b8f0f774c762836a07542b7ed5ad52d86d\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these\nupdated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift CLI (oc)\nor web console. Instructions for upgrading a cluster are available at\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608251819-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608251819-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608251819-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608251819-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60440"
},
{
"category": "workaround",
"details": "Restrict DHCP server access on networks used for network boot (DHCP snooping, dedicated/trusted provisioning VLANs) until a fix is available.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608251819-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608251819-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608251819-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608251819-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608251819-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608251819-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608251819-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608251819-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die()"
},
{
"cve": "CVE-2026-44690",
"cwe": {
"id": "CWE-354",
"name": "Improper Validation of Integrity Check Value"
},
"discovery_date": "2026-07-20T21:52:20.922000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2503063"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Unbound. Insufficient validation of the RRSIG.Labels field, combined with premature cache writes during RFC 8198 aggressive NSEC processing, can lead to cache poisoning. This vulnerability allows a malicious actor, controlling a single delegated zone, to poison arbitrary sibling zones under NSEC-signed parent domains. The primary impact is the integrity of DNS resolution, potentially leading to users being directed to malicious websites or services.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "unbound: Unbound: Cache poisoning via insufficient RRSIG.Labels validation and premature cache writes",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in Unbound allows a remote attacker to perform DNS cache poisoning. By controlling a delegated zone, a malicious actor can manipulate DNS resolution for arbitrary sibling zones under NSEC-signed parent domains, potentially redirecting users to malicious destinations. This poses a significant integrity risk to systems relying on Unbound for DNS resolution.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608251819-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608251819-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608251819-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608251819-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-44690"
},
{
"category": "external",
"summary": "RHBZ#2503063",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503063"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-44690",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44690"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44690",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44690"
},
{
"category": "external",
"summary": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-44690.txt",
"url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-44690.txt"
}
],
"release_date": "2026-07-22T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-01T21:39:31+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation,\nwhich will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata\nfor x86_64, s390x, ppc64le, and aarch64 architectures. The image digests\nmay be found at\nhttps://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is\nsha256:c987c0017b86a5aed02d5fa854b4649039e7221e14fca2e824dc37b2937ce7b2\n\n (For s390x architecture)\n The image digest is\nsha256:e38f225c850f6fdbdaf6ac3ef1f762b1e7068da19ef3cd57a00f72554e3d0a72\n\n (For ppc64le architecture)\n The image digest is\nsha256:ea726e65a0f5f8ae5b5fe4ce31f2aa75943c893c91bd75feb644c4042c88865d\n\n (For aarch64 architecture)\n The image digest is\nsha256:ab1d1b8e7b22fb2a6b3923e6e8fe77b8f0f774c762836a07542b7ed5ad52d86d\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these\nupdated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift CLI (oc)\nor web console. Instructions for upgrading a cluster are available at\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608251819-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608251819-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608251819-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608251819-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60440"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608251819-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608251819-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608251819-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608251819-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608251819-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608251819-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608251819-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608251819-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "unbound: Unbound: Cache poisoning via insufficient RRSIG.Labels validation and premature cache writes"
},
{
"cve": "CVE-2026-55973",
"cwe": {
"id": "CWE-805",
"name": "Buffer Access with Incorrect Length Value"
},
"discovery_date": "2026-07-20T21:57:00.775000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2503075"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Unbound. When the \u0027dns-error-reporting: yes\u0027 option is enabled, a remote attacker can send a specially crafted DNS response containing a malformed EDNS Report-Channel option from a delegated zone they control. This can lead to a stack variable overwrite, causing the Unbound daemon to terminate. This vulnerability results in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "unbound: Unbound: Denial of Service via malformed EDNS Report-Channel option",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important denial of service flaw in Unbound occurs when the `dns-error-reporting` option is explicitly enabled, allowing a remote attacker to terminate the daemon with a crafted DNS response. While several Red Hat products are affected, many Red Hat Enterprise Linux and OpenShift Container Platform versions are not vulnerable as the affected code is not present.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608251819-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608251819-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608251819-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608251819-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-55973"
},
{
"category": "external",
"summary": "RHBZ#2503075",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503075"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-55973",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-55973"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-55973",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55973"
},
{
"category": "external",
"summary": "https://nlnetlabs.nl/projects/unbound/download/#unbound-1-25-2",
"url": "https://nlnetlabs.nl/projects/unbound/download/#unbound-1-25-2"
}
],
"release_date": "2026-07-22T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-01T21:39:31+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation,\nwhich will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata\nfor x86_64, s390x, ppc64le, and aarch64 architectures. The image digests\nmay be found at\nhttps://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is\nsha256:c987c0017b86a5aed02d5fa854b4649039e7221e14fca2e824dc37b2937ce7b2\n\n (For s390x architecture)\n The image digest is\nsha256:e38f225c850f6fdbdaf6ac3ef1f762b1e7068da19ef3cd57a00f72554e3d0a72\n\n (For ppc64le architecture)\n The image digest is\nsha256:ea726e65a0f5f8ae5b5fe4ce31f2aa75943c893c91bd75feb644c4042c88865d\n\n (For aarch64 architecture)\n The image digest is\nsha256:ab1d1b8e7b22fb2a6b3923e6e8fe77b8f0f774c762836a07542b7ed5ad52d86d\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these\nupdated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift CLI (oc)\nor web console. Instructions for upgrading a cluster are available at\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608251819-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608251819-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608251819-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608251819-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60440"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608251819-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608251819-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608251819-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608251819-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "unbound: Unbound: Denial of Service via malformed EDNS Report-Channel option"
},
{
"cve": "CVE-2026-68343",
"cwe": {
"id": "CWE-805",
"name": "Buffer Access with Incorrect Length Value"
},
"discovery_date": "2026-08-10T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2513373"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Linux kernel\u0027s Server Message Block (SMB) client. A remote attacker could send a specially crafted SMB response containing a malformed Distributed File System (DFS) referral. This could cause the PathConsumed value to exceed the search name length, leading to an out-of-bounds read during DFS path parsing. This vulnerability may result in information disclosure or a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "kernel: smb: client: validate DFS referral PathConsumed",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608251819-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608251819-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608251819-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608251819-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-68343"
},
{
"category": "external",
"summary": "RHBZ#2513373",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2513373"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-68343",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68343"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-68343",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68343"
},
{
"category": "external",
"summary": "https://lore.kernel.org/linux-cve-announce/2026081037-CVE-2026-68343-843c@gregkh/T",
"url": "https://lore.kernel.org/linux-cve-announce/2026081037-CVE-2026-68343-843c@gregkh/T"
}
],
"release_date": "2026-08-10T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-01T21:39:31+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation,\nwhich will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata\nfor x86_64, s390x, ppc64le, and aarch64 architectures. The image digests\nmay be found at\nhttps://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is\nsha256:c987c0017b86a5aed02d5fa854b4649039e7221e14fca2e824dc37b2937ce7b2\n\n (For s390x architecture)\n The image digest is\nsha256:e38f225c850f6fdbdaf6ac3ef1f762b1e7068da19ef3cd57a00f72554e3d0a72\n\n (For ppc64le architecture)\n The image digest is\nsha256:ea726e65a0f5f8ae5b5fe4ce31f2aa75943c893c91bd75feb644c4042c88865d\n\n (For aarch64 architecture)\n The image digest is\nsha256:ab1d1b8e7b22fb2a6b3923e6e8fe77b8f0f774c762836a07542b7ed5ad52d86d\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these\nupdated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift CLI (oc)\nor web console. Instructions for upgrading a cluster are available at\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608251819-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608251819-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608251819-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608251819-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60440"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.0,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608251819-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608251819-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608251819-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608251819-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "kernel: smb: client: validate DFS referral PathConsumed"
},
{
"acknowledgments": [
{
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2026-72693",
"cwe": {
"id": "CWE-284",
"name": "Improper Access Control"
},
"discovery_date": "2026-04-26T18:17:20+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2462115"
}
],
"notes": [
{
"category": "description",
"text": "`openvt -u` is intended to identify the owner of the current VT and then execute `login` as that user from a privileged context. In the documented `kbrequest`/init usage, the ownership test in `authenticate_user()` relies on `stat(\"/proc/\u003cpid\u003e/fd/0\")`. `stat()` on `/proc/\u003cpid\u003e/fd/0` follows the symlink to the underlying TTY device node. As a result, `buf.st_uid` reflects the owner of the TTY node rather than the owner of the process holding the file descriptor. If the TTY owner returns to `root` or the getty owner after logout while an unprivileged process still has `fd 0` attached to that TTY, the check can incorrectly treat that process as belonging to the privileged console owner. Once that check succeeds, the `-u` path executes a passwordless login as the selected user. In the documented `kbrequest`/init deployment using `openvt -us`, this can result in passwordless `login -f root` on the spawned VT. This report establishes that privilege escalation path for that documented deployment; it does not claim equivalent reachability for deployments that do not use `openvt -u` from a privileged `kbrequest`/init path.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "kbd: Local privilege escalation in openvt via incorrect process owner verification allowing passwordless root login",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw was found in openvt (part of the kbd package) where incorrect process owner verification can allow a local unprivileged attacker to achieve passwordless root login. However, exploitation requires a non-default kbrequest/init configuration that explicitly invokes openvt -u, combined with a specific timing condition where TTY ownership has returned to root after logout while an unprivileged process still holds an open file descriptor to the TTY. This combination of prerequisites \u2014 a deliberately configured kbrequest/init setup and a narrow TTY-state race \u2014 is not present in standard Red Hat product deployments. For this reason, Red Hat rates the impact of this vulnerability as Moderate despite the high CVSS base score, which reflects only the technical worst-case impact and not the real-world exploitation constraints.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608251819-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608251819-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608251819-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608251819-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-72693"
},
{
"category": "external",
"summary": "RHBZ#2462115",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2462115"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-72693",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72693"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-72693",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-72693"
}
],
"release_date": "2026-08-11T06:58:59.200000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-01T21:39:31+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation,\nwhich will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata\nfor x86_64, s390x, ppc64le, and aarch64 architectures. The image digests\nmay be found at\nhttps://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is\nsha256:c987c0017b86a5aed02d5fa854b4649039e7221e14fca2e824dc37b2937ce7b2\n\n (For s390x architecture)\n The image digest is\nsha256:e38f225c850f6fdbdaf6ac3ef1f762b1e7068da19ef3cd57a00f72554e3d0a72\n\n (For ppc64le architecture)\n The image digest is\nsha256:ea726e65a0f5f8ae5b5fe4ce31f2aa75943c893c91bd75feb644c4042c88865d\n\n (For aarch64 architecture)\n The image digest is\nsha256:ab1d1b8e7b22fb2a6b3923e6e8fe77b8f0f774c762836a07542b7ed5ad52d86d\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these\nupdated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift CLI (oc)\nor web console. Instructions for upgrading a cluster are available at\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608251819-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608251819-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608251819-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608251819-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60440"
},
{
"category": "workaround",
"details": "To mitigate this issue, avoid using `openvt -u` in privileged `kbrequest`/init deployments. Instead, configure the keyboard request to initiate a standard authenticated login on the new virtual terminal, or disable the keyboard request binding entirely until a fix is available. Changes to `kbrequest` configurations may require a system restart or service reload to take effect.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608251819-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608251819-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608251819-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608251819-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608251819-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608251819-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608251819-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608251819-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "kbd: Local privilege escalation in openvt via incorrect process owner verification allowing passwordless root login"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…