Important: Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.18.27 security, enhancement & bug fix update

Red Hat OpenShift Data Foundation 4.18.27 security, enhancement & bug fix update Red Hat OpenShift Data Foundation 4.18.27 security, enhancement & bug fix update FIXED BUGS: ========== DFBUGS-7383: Backport to odf-4.18.z GSS PDB is created for rgw even though the gateway instance count is 1...

CVE-2026-66783

A flaw in the submariner-operator component of Red Hat Advanced Cluster Management for Kubernetes allows a user with permissions to modify the Submariner Custom Resource (CR) to specify an unvalidated image path . This enables deployment of a malicious image, resulting in arbitrary code execution...

EUVD-2026-61067

A flaw was found in the submariner-operator component of Red Hat Advanced Cluster Management for Kubernetes. This vulnerability allows a cluster administrator, or any user with permissions to modify the Submariner Custom Resource CR, to specify an unvalidated image path. This lack of validation...

CVE-2026-18963

The keycloak-services reset-credentials flow in Red Hat Build of Keycloak allows an unauthenticated attacker to bypass email verification and directly set new credentials for any user, enabling full account takeover (CVSS 9.1 Critical). No affected version or patch details are provided. No exploi...

CVE-2026-18963 Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass

A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the...

EUVD-2026-61063

A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the...

CVE-2026-18963 Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass

A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the...

Important: Red Hat Security Advisory: Ansible plug-ins for Red Hat Developer Hub Product Release Update

Updated images are now available for Red Hat Ansible Automation Platform 2.2, which include new features, bug fixes, and enhancements for Red Hat Ansible Automation Platform integration with Red Hat Developer Hub. Red Hat Ansible Automation Platform 2.2 delivers an Ansible-first Red Hat Developer...

Important: Red Hat Security Advisory: Migration Toolkit for Applications

A new version of Migration Toolkit for Applications MTA is now available. Migration Toolkit for Applications MTA accelerates large-scale application modernization efforts across hybrid cloud environments on Red Hat OpenShift. This solution provides insight throughout the adoption process, at both...

SUSE CVE-2026-72585

Red Hat CNA-LR concluded that this CVE is not valid...

Important: Red Hat Security Advisory: Logging for Red Hat OpenShift - 6.5.2

Logging for Red Hat OpenShift - 6.5.2 Red Hat OpenShift Logging 6.5.2 is a cluster-wide logging solution for OpenShift that collects and manages applications, infrastructure, and audit logs...

Important: Red Hat Security Advisory: Ansible plug-ins for Red Hat Developer Hub Product Release Update

Updated images are now available for Red Hat Ansible Automation Platform 2.1, which include new features, bug fixes, and enhancements for Red Hat Ansible Automation Platform integration with Red Hat Developer Hub. Red Hat Ansible Automation Platform 2.1 delivers an Ansible-first Red Hat Developer...

CVE-2026-75485

A flaw was found in the must-gather component of Red Hat Advanced Cluster Management for Kubernetes. The cluster Proxy object is dumped in raw form, bypassing the oc inspect redaction that would normally sanitize sensitive fields. This exposes proxy basic-auth credentials in the must-gather...

Important: Red Hat Security Advisory: kpatch-patch-5_14_0-427_100_1, kpatch-patch-5_14_0-427_113_1, kpatch-patch-5_14_0-427_126_1, kpatch-patch-5_14_0-427_68_2, and kpatch-patch-5_14_0-427_84_1 security update

An update for multiple packages is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

CVE-2026-66793

A flaw was found in the governance-policy-addon-controller component of Red Hat Advanced Cluster Management for Kubernetes. A user with permissions to annotate the namespaced ManagedClusterAddOn resource can override the governance-policy container image. This allows an attacker to run a controll...

EUVD-2026-60959

A flaw was found in the must-gather component of Red Hat Advanced Cluster Management for Kubernetes. The cluster Proxy object is dumped in raw form, bypassing the oc inspect redaction that would normally sanitize sensitive fields. This exposes proxy basic-auth credentials in the must-gather...

CVE-2026-75485 Must-gather: must-gather: cluster proxy object dumped raw, bypassing inspect redaction of proxy basic-auth credentials

A flaw was found in the must-gather component of Red Hat Advanced Cluster Management for Kubernetes. The cluster Proxy object is dumped in raw form, bypassing the oc inspect redaction that would normally sanitize sensitive fields. This exposes proxy basic-auth credentials in the must-gather...

CVE-2026-75485

In Red Hat Advanced Cluster Management for Kubernetes, the must-gather component dumps the cluster Proxy object raw, bypassing oc inspect redaction and exposing proxy basic-auth credentials in the archive. CVSS 5.5 (MEDIUM), local exploit, no in-the-wild exploitation reported. Monitor Red Hat adv...

CVE-2026-75485

A flaw was found in the must-gather component of Red Hat Advanced Cluster Management for Kubernetes. The cluster Proxy object is dumped in raw form, bypassing the oc inspect redaction that would normally sanitize sensitive fields. This exposes proxy basic-auth credentials in the must-gather...

CVE-2026-73834 Must-gather: must-gather: embedded secret data in acm wrapper crs collected without redaction

A flaw was found in the must-gather component of Red Hat Advanced Cluster Management for Kubernetes. Certain ACM wrapper Custom Resources that embed Secret data are collected without redaction. When an administrator runs must-gather, credentials and tokens are captured in cleartext in the resulti...