RHSA-2026:61245: Important: osbuild-composer security update
A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients.Security Fix(es): google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation (CVE-2026-33186) golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/osbuild-composerto a version that resolves this vulnerability.Fixed in 76.1-7.el9_2 - Upgrade
Upgrade
redhat/osbuild-composer-coreto a version that resolves this vulnerability.Fixed in 76.1-7.el9_2 - Upgrade
Upgrade
redhat/osbuild-composer-core-debuginfoto a version that resolves this vulnerability.Fixed in 76.1-7.el9_2 - Upgrade
Upgrade
redhat/osbuild-composer-debuginfoto a version that resolves this vulnerability.Fixed in 76.1-7.el9_2 - Upgrade
Upgrade
redhat/osbuild-composer-debugsourceto a version that resolves this vulnerability.Fixed in 76.1-7.el9_2 - Upgrade
Upgrade
redhat/osbuild-composer-dnf-jsonto a version that resolves this vulnerability.Fixed in 76.1-7.el9_2 - Upgrade
Upgrade
redhat/osbuild-composer-tests-debuginfoto a version that resolves this vulnerability.Fixed in 76.1-7.el9_2 - Upgrade
Upgrade
redhat/osbuild-composer-workerto a version that resolves this vulnerability.Fixed in 76.1-7.el9_2 - Upgrade
Upgrade
redhat/osbuild-composer-worker-debuginfoto a version that resolves this vulnerability.Fixed in 76.1-7.el9_2 - Upgrade
Upgrade
redhat/osbuild-composerto a version that resolves this vulnerability.Fixed in 76.1-7.el9_2.aa - Upgrade
Upgrade
redhat/osbuild-composer-coreto a version that resolves this vulnerability.Fixed in 76.1-7.el9_2.aa - Upgrade
Upgrade
redhat/osbuild-composer-core-debuginfoto a version that resolves this vulnerability.Fixed in 76.1-7.el9_2.aa - Upgrade
Upgrade
redhat/osbuild-composer-debuginfoto a version that resolves this vulnerability.Fixed in 76.1-7.el9_2.aa - Upgrade
Upgrade
redhat/osbuild-composer-debugsourceto a version that resolves this vulnerability.Fixed in 76.1-7.el9_2.aa - Upgrade
Upgrade
redhat/osbuild-composer-dnf-jsonto a version that resolves this vulnerability.Fixed in 76.1-7.el9_2.aa - Upgrade
Upgrade
redhat/osbuild-composer-tests-debuginfoto a version that resolves this vulnerability.Fixed in 76.1-7.el9_2.aa - Upgrade
Upgrade
redhat/osbuild-composer-workerto a version that resolves this vulnerability.Fixed in 76.1-7.el9_2.aa - Upgrade
Upgrade
redhat/osbuild-composer-worker-debuginfoto a version that resolves this vulnerability.Fixed in 76.1-7.el9_2.aa - Upgrade
Upgrade
golang.org/x/net/idnato a version that resolves this vulnerability.Patch CVE-2026-39821 - Upgrade
Upgrade
google.golang.org/grpc/grpc-goto a version that resolves this vulnerability.Patch CVE-2026-33186
Event History
Frequently Asked Questions
Which installed components are covered by this update?
The advisory covers osbuild-composer, osbuild-composer-core, osbuild-composer-worker, osbuild-composer-dnf-json, and the listed debug, debuginfo, and test-debuginfo packages.
What security issues are addressed?
The update addresses an authorization bypass in gRPC-Go caused by improper HTTP/2 path validation (CVE-2026-33186) and a privilege-escalation issue in golang.org/x/net/idna caused by incorrect Punycode label processing (CVE-2026-39821).
Which deployments are potentially exposed?
Deployments using osbuild-composer to build customized OS artifacts, including VM images and OSTree commits, are within the affected product scope. The service can build images locally or upload images directly to cloud environments.