Red Hat Openstack Platform vulnerabilities

• red hat migration toolkit for applications 8, migration toolkit for virtualization, openshift service mesh 3 +16 more +18 more Ansible-core: ansible-core: ansible.builtin.git invokes git without a `--` separator, allowing argument injection via a `-`-leading repository url (e.g. --upload-pack) -> rce CVE-2026-84503 6.7 MediumNovember 6, 2026
• red hat ceph storage 9, enterprise linux 10, enterprise linux 6 +7 more +9 more Dnsmasq: dnsmasq: heap out-of-bounds read in dhcpv6 option 39 fqdn decoder CVE-2026-93009 4.3 MediumOctober 29, 2026
• red hat ceph storage 9, enterprise linux 10, enterprise linux 6 +7 more +9 more Dnsmasq: dnsmasq: --leasequery without address argument applies no source address check CVE-2026-93010 4.3 MediumOctober 29, 2026
• red hat ceph storage 9, enterprise linux 10, enterprise linux 6 +7 more +9 more Dnsmasq: dnsmasq: tftp prefetch cache keyed on stale heap pointer serves wrong file content CVE-2026-93006 6.8 MediumOctober 29, 2026
• red hat ceph storage 9, enterprise linux 10, enterprise linux 6 +7 more +9 more Dnsmasq: dnsmasq: tcp/53 child-slot exhaustion starves dnssec validation CVE-2026-93007 5.3 MediumOctober 29, 2026
• red hat ceph storage 9, enterprise linux 10, enterprise linux 6 +7 more +9 more Dnsmasq: dnsmasq: heap out-of-bounds write in dnssec validator via to_wire/from_wire transforms CVE-2026-93011 5.3 MediumOctober 29, 2026
• red hat ceph storage 9, enterprise linux 10, enterprise linux 6 +7 more +9 more Dnsmasq: dnsmasq: out-of-bailiwick cache injection through cname chase in split-dns configurations CVE-2026-93008 6.8 MediumOctober 29, 2026
• red hat agentic cluster security suite 0.2, cost management 4, advanced cluster security for kubernetes 4.11 +51 more +53 more Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns CVE-2026-114406 Fix available 6.8 MediumOctober 21, 2026
• red hat confidential compute attestation, dpu kit for nvidia, exploit intelligence +18 more +20 more Podman: goroutine/file-descriptor leak in storage/pkg/archive.applylayer and applyuncompressedlayer on malformed layers CVE-2026-114236 3.3 LowOctober 21, 2026
• red hat migration toolkit for applications 8, migration toolkit for containers, migration toolkit for virtualization +12 more +14 more Ansible-operator-plugins: ansible operator plugins: arbitrary code execution via jinja2 template injection CVE-2026-92982 8.5 HighOctober 15, 2026
• red hat fast datapath for rhel 10, fast datapath for rhel 8, fast datapath for rhel 9 +5 more +7 more Dpdk: dpdk: integer overflow combined with missing validation leads to host buffer overflow in vhost-crypto CVE-2026-86849 Fix available 6.5 MediumOctober 14, 2026
• red hat fast datapath for rhel 10, fast datapath for rhel 8, fast datapath for rhel 9 +5 more +7 more Dpdk: dpdk: stack and heap buffer overflow in nfp vdpa driver CVE-2026-86856 Fix available 6.5 MediumOctober 14, 2026
• red hat fast datapath for rhel 10, fast datapath for rhel 8, fast datapath for rhel 9 +5 more +7 more Dpdk: dpdk: guest can trigger infinite loop in vhost-crypto writeback chain cleanup CVE-2026-86847 Fix available 6.5 MediumOctober 14, 2026
• red hat fast datapath for rhel 10, fast datapath for rhel 8, fast datapath for rhel 9 +5 more +7 more Dpdk: dpdk: guest can trigger out-of-bounds write by controlling avail ring index in vhost-crypto CVE-2026-86846 Fix available 6.5 MediumOctober 14, 2026
• red hat fast datapath for rhel 10, fast datapath for rhel 8, fast datapath for rhel 9 +5 more +7 more Dpdk: dpdk: guest-triggered use-after-free and type confusion in vhost-crypto session cleanup CVE-2026-86845 Fix available 6.5 MediumOctober 14, 2026
• red hat fast datapath for rhel 10, fast datapath for rhel 8, fast datapath for rhel 9 +5 more +7 more Dpdk: dpdk: guest with runt rx descriptors underflows copy length in vhost enqueue (split and packed rings) CVE-2026-86566 Fix available 6.5 MediumOctober 14, 2026
• red hat fast datapath for rhel 10, fast datapath for rhel 8, fast datapath for rhel 9 +5 more +7 more Dpdk: dpdk: time-of-check/time-of-use vulnerability allowing guest-triggered out-of-bounds write in vhost-crypto CVE-2026-86848 Fix available 8.8 HighOctober 14, 2026
• red hat fast datapath for rhel 10, fast datapath for rhel 8, fast datapath for rhel 9 +5 more +7 more Dpdk: dpdk: vduse handler fails to invalidate vring pointers when iotlb is invalidated, leading to use-after-unmap CVE-2026-86567 Fix available 8.8 HighOctober 14, 2026
• red hat fast datapath for rhel 10, fast datapath for rhel 8, fast datapath for rhel 9 +5 more +7 more Dpdk: dpdk: heap out-of-bounds read/write in gso header copy CVE-2026-100236 Fix available 8.6 HighOctober 14, 2026
• red hat fast datapath for rhel 10, fast datapath for rhel 8, fast datapath for rhel 9 +5 more +7 more Dpdk: dpdk: guest can desynchronize virtqueue size from inflight descriptor table size, causing out-of-bounds write CVE-2026-86565 Fix available 8.2 HighOctober 14, 2026
• red hat fast datapath for rhel 10, fast datapath for rhel 8, fast datapath for rhel 9 +5 more +7 more Dpdk: dpdk: double offset bug in vhost log mapping calculation CVE-2026-86563 Fix available 7.8 HighOctober 14, 2026
• red hat fast datapath for rhel 10, fast datapath for rhel 8, fast datapath for rhel 9 +5 more +7 more Dpdk: dpdk: control-queue descriptor double-fetch overflows host heap in dpdk vhost (vduse) CVE-2026-86562 Fix available 7.8 HighOctober 14, 2026
• red hat fast datapath for rhel 10, fast datapath for rhel 8, fast datapath for rhel 9 +5 more +7 more Dpdk: dpdk: missing memory size validation before mmap in vhost memory region setup CVE-2026-86561 Fix available 6.5 MediumOctober 14, 2026
• red hat fast datapath for rhel 10, fast datapath for rhel 8, fast datapath for rhel 9 +5 more +7 more Dpdk: dpdk: guest-triggered out-of-bounds walk via vhost indirect descriptor length toctou CVE-2026-93683 Fix available 6.4 MediumOctober 14, 2026
• red hat openstack platform 18.0 Openstack-network-exporter: basic-auth uses plaintext password storage and non-constant-time comparison CVE-2026-83535 7.4 HighOctober 12, 2026
• red hat openstack platform 18.0 Openstack-network-exporter: http.server has no readheadertimeout / readtimeout (slowloris) CVE-2026-83536 5.3 MediumOctober 12, 2026
• red hat build of podman desktop, certification program for red hat enterprise linux 9, edge manager 1 +8 more +10 more Gvisor-tap-vsock: gvisor-tap-vsock: unathenticated arbitrary file deletion on the host via /expose CVE-2026-107935 Fix available 9.3 CriticalOctober 9, 2026
• red hat migration toolkit for applications 8, migration toolkit for virtualization, openshift service mesh 3 +15 more +17 more Ansible-core: ansible-core: ansible-galaxy collection install symlink path escape allows arbitrary file write / code execution CVE-2026-89091 Fix available 8.8 HighOctober 8, 2026
• red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +6 more +8 more Qemu-kvm: 9pfs: use-after-free race in tlcreate/twalk allows vm guest escape CVE-2026-93834 Public exploitFix available 8.8 HighSeptember 25, 2026
• red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +6 more +8 more Qemu-kvm: vapic writable rom alias can escape the option-rom window and expose locked smram CVE-2026-81627 Fix available 8.2 HighSeptember 18, 2026
• red hat ansible automation platform 2, enterprise linux 10, enterprise linux 7 +5 more +7 more Jwcrypto: jwcrypto: denial of service via o(n^2) duplicate check on unbounded jwk key_ops array CVE-2026-92091 Fix available 5.9 MediumSeptember 16, 2026
• red hat enterprise linux 8, enterprise linux 9, enterprise linux 9.6 extended update support +1 more +3 more Leapp-repository: leapp-upgrade-el9toel10: leapp-upgrade-el9toel10: scan_mysql runs mysqld --validate-config as root and can load mysql-writable plugins CVE-2026-75092 Fix available 7.3 HighSeptember 15, 2026
• red hat enterprise linux 10, enterprise linux 8, enterprise linux 9 +4 more +6 more Pcs: pcs: non-root haclient users can read arbitrary files via pcs host auth --token CVE-2026-84828 Fix available 6.5 MediumSeptember 10, 2026
• red hat ceph storage 5, ceph storage 9, openstack platform 17.1 +1 more +3 more Community.general: community.general: ocapi module_utils (ocapi_command, ocapi_info) hardcode validate_certs=false with no override, enabling tls man-in-the-middle and credential disclosure CVE-2026-87872 6.8 MediumSeptember 9, 2026
• red hat ceph storage 5, ceph storage 9, openstack platform 17.1 +1 more +3 more Community.general: community.general: memcached cache plugin deserializes untrusted pickle data from memcached, enabling cache-poisoning remote code execution on the ansible controller CVE-2026-87874 8.1 HighSeptember 9, 2026
• red hat ansible automation platform 2, enterprise linux 10, enterprise linux 7 +4 more +6 more Jwcrypto: jwcrypto: general json jws kid binding bypass during jwkset verification CVE-2026-84185 5.9 MediumSeptember 3, 2026
• red hat ansible automation platform 2, enterprise linux 10, enterprise linux 9 +2 more +4 more Jwcrypto: jwcrypto: denial of service via malformed jwe tokens CVE-2026-80179 5.9 MediumAugust 27, 2026
• red hat ceph storage 5, ceph storage 9, openstack platform 17.1 +1 more +3 more Ansible-collection-community-general: community.general: ipa_getkeytab does not set no_log on the bind_pw parameter, disclosing the ipa bind password in logs and process listings CVE-2026-80158 5.5 MediumAugust 26, 2026
• erlang erts, otp, erlang\/otp +3 more +5 more Stack buffer overflow in SCTP error cause parsing in inet_drv allows remote VM crash CVE-2026-49759 Fix available 8.8 HighJune 10, 2026
• red hat enterprise linux 10, enterprise linux 10.0 extended update support, enterprise linux 8 +7 more +9 more Ansible-collection-ansible-posix: ansible.posix authorized_key: local privilege escalation via symlink-following chown CVE-2026-11837 Public exploitFix available 7.3 HighJune 10, 2026
• openstack ironic, red hat openshift container platform 4, openstack platform 16.2 +2 more +4 more OpenStack Ironic: Crafted JSON String to Certain Endpoints on the API or JSON-RPC Service May Result in Service Crash CVE-2026-50589 Fix available 5.3 MediumJune 4, 2026
• red hat openshift container platform 4, openstack platform 16.2, openstack platform 17.1 +1 more +3 more OpenStack oslo.messaging does not verify RabbitMQ broker hostname during TLS handshake CVE-2026-44393 Fix available 7.4 HighJune 4, 2026
• openstack mistral, red hat openstack platform 16.2 +1 more OpenStack Mistral allows Arbitrary Remote Code Execution when the API is exposed CVE-2026-41283 Fix available 9.9 CriticalJune 4, 2026
• go standard library crypto/x509, red hat assisted installer for red hat openshift container platform 2, cert manager support for red hat openshift release 1.19 +128 more +130 more Inefficient candidate hostname parsing in crypto/x509 CVE-2026-27145 Public exploitFix available 6.5 MediumJune 2, 2026
• openstack keystone, red hat openstack platform 13 (queens), openstack platform 16.2 +2 more +4 more OpenStack Keystone has an Incorrect Authorization issue CVE-2026-43000 Fix available 6.0 MediumMay 28, 2026
• openstack keystone, red hat openstack platform 13 (queens), openstack platform 16.2 +2 more +4 more OpenStack Keystone has an Authorization Bypass CVE-2026-42999 Fix available 6.0 MediumMay 28, 2026
• erlang otp, erlang\/otp, red hat hardened images +3 more +5 more nameConstraints DNS bypass via subject CommonName fallback in public_key hostname verification CVE-2026-42790 Fix available 7.6 HighMay 27, 2026
• erlang otp, erlang\/otp, red hat hardened images +3 more +5 more Non-CA certificate accepted as intermediate issuer in public_key path validation CVE-2026-42789 Fix available 7.0 HighMay 27, 2026
• golang crypto, golang.org/x/crypto golang.org/x/crypto/ssh, red hat assisted installer for red hat openshift container platform 2 +54 more +56 more Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh CVE-2026-46595 Public exploitFix available 10.0 CriticalMay 22, 2026
• golang crypto, golang.org/x/crypto golang.org/x/crypto/ssh/knownhosts, red hat assisted installer for red hat openshift container platform 2 +53 more +55 more Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts CVE-2026-42508 Fix available 9.1 CriticalMay 22, 2026
• Show olderLoading…