RHSA-2026:97344: Important: rhc-worker-playbook security, bug fix, and enhancement update
A worker for yggdrasil that receives Ansible playbooks and executes them against the local host.Security Fix(es): crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281) crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application (CVE-2026-33810) Bug Fix(es) and Enhancement(s): Let rhc-worker-playbook log all subprocess calls (JIRA:RHEL-146059) Update Ansible dependencies (ansible-runner, collections) [10.3] (JIRA:RHEL-184963) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.Additional Changes:For detailed information on changes in this release, see the Red Hat Enterprise Linux 10 Release Notes linked from the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/rhc-worker-playbookto a version that resolves this vulnerability.Fixed in 0.2.10-2.el10_3 - Upgrade
Upgrade
redhat/rhc-worker-playbook-debuginfoto a version that resolves this vulnerability.Fixed in 0.2.10-2.el10_3 - Upgrade
Upgrade
redhat/rhc-worker-playbook-debugsourceto a version that resolves this vulnerability.Fixed in 0.2.10-2.el10_3 - Upgrade
Upgrade
redhat/rhc-worker-playbookto a version that resolves this vulnerability.Fixed in 0.2.10-2.el10_3.aa - Upgrade
Upgrade
redhat/rhc-worker-playbook-debuginfoto a version that resolves this vulnerability.Fixed in 0.2.10-2.el10_3.aa - Upgrade
Upgrade
redhat/rhc-worker-playbook-debugsourceto a version that resolves this vulnerability.Fixed in 0.2.10-2.el10_3.aa - Upgrade
Upgrade
ansible-runner and Ansible collectionsto a version that resolves this vulnerability.Fixed in 10.3
Event History
Frequently Asked Questions
Which components are included in this update?
The update covers rhc-worker-playbook and its debuginfo and debugsource packages.
What security issues are addressed?
The update addresses CVE-2026-32281, a denial-of-service issue in Go crypto/x509 certificate chain validation, and CVE-2026-33810, a certificate validation bypass involving incorrect DNS constraint application.
What non-security changes are included?
The worker now logs all subprocess calls, and its Ansible dependencies, including ansible-runner and collections, are updated for 10.3.