RHSA-2026:56959: Important: osbuild-composer security update
A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients.Security Fix(es): google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation (CVE-2026-33186) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Other sources
Important: osbuild-composer security update
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/osbuild-composerto a version that resolves this vulnerability.Fixed in 101.3-4.el9_4.4 - Upgrade
Upgrade
redhat/osbuild-composer-coreto a version that resolves this vulnerability.Fixed in 101.3-4.el9_4.4 - Upgrade
Upgrade
redhat/osbuild-composer-core-debuginfoto a version that resolves this vulnerability.Fixed in 101.3-4.el9_4.4 - Upgrade
Upgrade
redhat/osbuild-composer-debuginfoto a version that resolves this vulnerability.Fixed in 101.3-4.el9_4.4 - Upgrade
Upgrade
redhat/osbuild-composer-debugsourceto a version that resolves this vulnerability.Fixed in 101.3-4.el9_4.4 - Upgrade
Upgrade
redhat/osbuild-composer-tests-debuginfoto a version that resolves this vulnerability.Fixed in 101.3-4.el9_4.4 - Upgrade
Upgrade
redhat/osbuild-composer-workerto a version that resolves this vulnerability.Fixed in 101.3-4.el9_4.4 - Upgrade
Upgrade
redhat/osbuild-composer-worker-debuginfoto a version that resolves this vulnerability.Fixed in 101.3-4.el9_4.4 - Upgrade
Upgrade
redhat/osbuild-composerto a version that resolves this vulnerability.Fixed in 101.3-4.el9_4.4.aa - Upgrade
Upgrade
redhat/osbuild-composer-coreto a version that resolves this vulnerability.Fixed in 101.3-4.el9_4.4.aa - Upgrade
Upgrade
redhat/osbuild-composer-core-debuginfoto a version that resolves this vulnerability.Fixed in 101.3-4.el9_4.4.aa - Upgrade
Upgrade
redhat/osbuild-composer-debuginfoto a version that resolves this vulnerability.Fixed in 101.3-4.el9_4.4.aa - Upgrade
Upgrade
redhat/osbuild-composer-debugsourceto a version that resolves this vulnerability.Fixed in 101.3-4.el9_4.4.aa - Upgrade
Upgrade
redhat/osbuild-composer-tests-debuginfoto a version that resolves this vulnerability.Fixed in 101.3-4.el9_4.4.aa - Upgrade
Upgrade
redhat/osbuild-composer-workerto a version that resolves this vulnerability.Fixed in 101.3-4.el9_4.4.aa - Upgrade
Upgrade
redhat/osbuild-composer-worker-debuginfoto a version that resolves this vulnerability.Fixed in 101.3-4.el9_4.4.aa - Upgrade
Upgrade
osbuild-composerto a version that resolves this vulnerability.Patch CVE-2026-33186
Event History
Frequently Asked Questions
Which packages are included in this update?
The update covers redhat/osbuild-composer, redhat/osbuild-composer-core, redhat/osbuild-composer-worker, and their listed debuginfo, debugsource, and test-debuginfo packages.
Does the advisory provide affected version information or a workaround for systems that cannot be patched immediately?
No affected or fixed version numbers and no temporary mitigation are provided in the supplied advisory data. The referenced CVE page is identified as the source for additional impact and CVSS details.