Critical: idm:DL1 security, bug fix, and enhancement update

Critical: idm:DL1 security, bug fix, and enhancement update

Important: libsoup security update

Important: OpenShift Container Platform 4.19.51 packages and security update

Critical: cjose security update

Important: Red Hat build of MicroShift 4.18.57 security update

Important: kernel security, bug fix, and enhancement update

A flaw was found in Keycloak Admin REST (Representational State Transfer) API. This vulnerability allows information disclosure of sensitive role metadata via insufficient authorization checks on the /admin/realms/{realm}/roles endpoint.

A deserialization of untrusted data vulnerability was found in ManageIQ. The YamlLoadAliases module overrides YAML.safeload to silently fall back to YAML.unsafeload in production when a Psych::DisallowedClass error occurs. An authenticated attacker with dialog import access can exploit this to achieve remote code execution by uploading a crafted YAML payload that triggers the fallback and deserializes arbitrary Ruby objects.

Red Hat CloudForms, which was based on ManageIQ, has reached End of Life and is no longer supported. No errata or patches will be issued. This CVE is being assigned for the benefit of the ManageIQ community and downstream consumers.

Important: kernel-rt security, bug fix, and enhancement update

Important: kernel security, bug fix, and enhancement update

Important: kernel security update

Red Hat AI Inference 3.4.6 (rocm)

Red Hat AI Inference 3.4.6 (cuda)

Red Hat AI Inference Model Optimization Tools 3.4.6 (cuda)

Red Hat AI Inference 3.4.6 (spyre)

Red Hat AI Inference 3.4.6 (cpu)

Red Hat Hardened Images RPMs Security Update

A flaw was found in the clevis PKCS#11 pin. The clevis-pkcs11-afunix-socket-unlock daemon crashes when an AFUNIX client connects to the data socket without a bound address, due to an integer underflow in the getpeername result handling. This causes a denial of service, preventing LUKS disk decryption from completing during boot.

A flaw was found in Podman. In a Containerfile or Podman, data written to RUN --mount=type=bind mounts during the podman build is not discarded. This issue can lead to files created within the container appearing in the temporary build context directory on the host, leaving the created files accessible.

A flaw was found in Undertow. This vulnerability allows a remote attacker to construct specially crafted requests where header names are parsed differently by Undertow compared to upstream proxies. This discrepancy in header interpretation can be exploited to launch request smuggling attacks, potentially bypassing security controls and accessing unauthorized resources.

A flaw was found in Undertow. A remote attacker can exploit this vulnerability by sending \r\r\r as a header block terminator. This can be used for request smuggling with certain proxy servers, such as older versions of Apache Traffic Server and Google Cloud Classic Application Load Balancer, potentially leading to unauthorized access or manipulation of web requests.

Critical: ipa security, bug fix, and enhancement update

Critical: ipa security update

Critical: ipa security update

Webhook notification SSRF: hostname-string blocklist trivially bypassable

CWEs: CWE-918 CVSS: 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Component: quay/quay

Description HOSTNAMEBLACKLIST = ["localhost", "127.0.0.1"] extended by WEBHOOKHOSTNAMEBLACKLIST (default [], config.py:840). WebhookMethod.validate() and .perform() test only urlparse(url).hostname.lower() in HOSTNAMEBLACKLIST before requests.post(url, ...). No DNS resolution, no IP-range check, no use of util/security/ssrf.py. Any repo admin (i.e. any authenticated tenant on their own repo) can target 169.254.169.254, 0.0.0.0, [::1], 127.0.0.2, decimal/octal IP encodings, or an attacker DNS name resolving to RFC1918/link-local. Response body is logged on non-2xx (resp.content), giving a partial oracle.

Impact: blind/semi-blind POST SSRF to cloud-metadata and in-cluster services from the Quay pod network namespace.

Affected Locations - notifications/notificationmethod.py:22-23,213,236,253

Attack Pattern A repo admin configures a webhook notification pointing at an internal/metadata address using an encoding that evades the hostname string blocklist, causing the Quay pod to issue an authenticated-context POST to that internal target and expose limited response information via logged non-2xx bodies.

Remediation Route all webhook target validation through util/security/ssrf.py (DNS resolution + IP-range blocklist, not hostname string matching), consistent with the proxy-cache and mirror validators.

Note This finding shares its root cause class (missing SSRF validation in notifications/proxy/workers/repomirrorworker) with CVE-2026-32591 (already public, fixed). The CVSS vector/score above was computed independently -- the original audit did not provide one.

--- Source: Ex-Wing security assessment, finding QUAY-001

A flaw was found in Quay. An authenticated attacker can access repository auto-prune configurations from other namespaces, leading to unauthorized information disclosure. This issue occurs because the application does not properly enforce namespace scoping when retrieving policy details by repository name and policy identifier. To exploit the vulnerability, the attacker must manage a repository sharing the target's name and know the target policy's unique identifier.

Important: mariadb-connector-c security update

Important: mariadb-connector-c security update

Important: firefox security update