CVE-2026-89491 ocfs2: cluster: don't sleep while holding o2hb_live_lock in o2hb_region_pin()

In the Linux kernel, the following vulnerability has been resolved: ocfs2: cluster: don't sleep while holding o2hblivelock in o2hbregionpin Patch series "ocfs2: cluster: o2hbregionpin fixes", v2. This series fixes three related issues in o2hbregionpin, all are from the original implementation in...

EUVD-2026-76397

In the Linux kernel, the following vulnerability has been resolved: ocfs2: cluster: don't sleep while holding o2hblivelock in o2hbregionpin Patch series "ocfs2: cluster: o2hbregionpin fixes", v2. This series fixes three related issues in o2hbregionpin, all are from the original implementation in...

[SECURITY] Fedora 45 Update: corosync-3.1.10-8.fc45

This package contains the Corosync Cluster Engine Executive, several default APIs and libraries, default configuration files, and an init script...

CVE-2026-89060

A cross-namespace authorization flaw in multicluster-observability-addon allows a user with permission to modify a managed cluster’s ManagedClusterAddOn configuration to reference ClusterLogForwarder or OpenTelemetryCollector resources outside the permitted namespace. If those resources reference...

CVE-2026-89060 Stolostron/multicluster-observability-addon: cross-namespace secret disclosure in multicluster-observability-addon via unvalidated configuration references

A cross-namespace authorization flaw in multicluster-observability-addon allows a user with permission to modify a managed cluster’s ManagedClusterAddOn configuration to reference ClusterLogForwarder or OpenTelemetryCollector resources outside the permitted namespace. If those resources reference...

CVE-2026-89060

Stolostron multicluster-observability-addon is affected by a cross-namespace secret disclosure flaw. A managed-cluster identity can reference configuration resources outside its designated namespace, allowing an attacker-controlled managed cluster to access sensitive hub Secrets . The CVSS 3.1 sc...

EUVD-2026-75948

A cross-namespace authorization flaw in multicluster-observability-addon allows a user with permission to modify a managed cluster’s ManagedClusterAddOn configuration to reference ClusterLogForwarder or OpenTelemetryCollector resources outside the permitted namespace. If those resources reference...

CVE-2026-89060

A cross-namespace authorization flaw in multicluster-observability-addon allows a user with permission to modify a managed cluster’s ManagedClusterAddOn configuration to reference ClusterLogForwarder or OpenTelemetryCollector resources outside the permitted namespace. If those resources reference...

[SECURITY] Fedora 43 Update: corosync-3.1.10-3.fc43

This package contains the Corosync Cluster Engine Executive, several default APIs and libraries, default configuration files, and an init script...

PT-2026-90330

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the NTFS driver where the ntfs cluster alloc function bounds its scan of the vol-lcn empty bits per page array by the size of the $Bitmap instead of the volume's clust...

CVE-2026-89614: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ntfs: bound the free-cluster bitmap scan to the volume vol-lcnemptybitsperpage is sized from vol-nrclusters at mount, but ntfsclusteralloc bounds its scan of that array by the size of $Bitmap. Those are independent on-disk...

PT-2026-89767

Name of the Vulnerable Software and Affected Versions multicluster-observability-addon affected versions not specified Description A cross-namespace authorization flaw exists in the multicluster-observability-addon. A user with permissions to modify the ManagedClusterAddOn configuration of a...

wildfly-messaging-activemq-subsystem: artemis-server: jgroups: artemis cluster password leak via jgroups spoof

Artemis and JGroups lack of access controls in certain situations can allow an attacker to spoof a password request in JGroups and subsequently gain access to the cluster. This allows the attacker manage-level authority for provided messaging and queue operations...

Security Bulletin: Consul vulnerable to an authorization bypass in the catalog deregistration path

Summary Consul and Consul Enterprise are vulnerable to an authorization bypass in the catalog deregistration path that may allow a local ACL token to delete peer-imported catalog objects. A caller with service:write or node:write permission may exploit this issue to remove services, checks, or...

Consul vulnerable to an authorization bypass in the catalog deregistration path

Summary Consul and Consul Enterprise are vulnerable to an authorization bypass in the catalog deregistration path that may allow a local ACL token to delete peer-imported catalog objects. A caller with service:write or node:write permission may exploit this issue to remove services, checks, or...

Security Bulletin: IBM MQ Appliance is affected by an improper validation vulnerability (CVE-2026-10853)

Summary IBM MQ Appliance has addressed an improper validation vulnerability that could allow an authenticated attacker with cluster access to cause a denial of service or potentially execute arbitrary code due to improper validation of cluster command message lengths. Vulnerability Details...

Security Bulletin: IBM MQ Appliance is affected by an improper validation vulnerability in cluster migration data processing (CVE-2026-11716)

Summary IBM MQ Appliance has addressed an improper validation vulnerability in cluster migration data processing that could allow an authenticated attacker to cause a denial of service or execute arbitrary code during queue manager startup. Vulnerability Details CVEID:CVE-2026-11716 DESCRIPTION:...

Important: Red Hat Security Advisory: Logging for Red Hat OpenShift - 6.6.1

Logging for Red Hat OpenShift - 6.6.1 Red Hat OpenShift Logging 6.6.1 is a cluster-wide logging solution for OpenShift that collects and manages applications, infrastructure, and audit logs...

wildfly-messaging-activemq-subsystem: artemis-server: jgroups: artemis cluster password leak via jgroups spoof

Artemis and JGroups lack of access controls in certain situations can allow an attacker to spoof a password request in JGroups and subsequently gain access to the cluster. This allows the attacker manage-level authority for provided messaging and queue operations...

GO-2026-6362 OpenChoreo: Unauthenticated access to data-plane operations via OpenChoreo cluster-gateway management APIs in github.com/openchoreo/openchoreo

OpenChoreo: Unauthenticated access to data-plane operations via OpenChoreo cluster-gateway management APIs in github.com/openchoreo/openchoreo...