RHSA-2026:54288
Vulnerability from csaf_redhat - Published: 2026-08-12 10:22 - Updated: 2026-08-18 20:45Summary
Red Hat Security Advisory: OpenShift File Integrity Operator bug fix and enhancement update
Severity
Important
Notes
Topic: An updated OpenShift File Integrity Operator image that fixes various bugs and adds new
enhancements is now available for the Red Hat OpenShift Enterprise 4 catalog.
Details: The OpenShift File Integrity Operator v1.4.1 is now available.
See the documentation for bug fix information:
https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/security_and_compliance/file-integrity-operator
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in golang.org/x/net/html. When arbitrary HTML is parsed and then rendered, it can result in an unexpected HTML tree. This allows an attacker to bypass HTML sanitization mechanisms, leading to Cross-Site Scripting (XSS) attacks in applications. Such attacks can result in information disclosure or arbitrary code execution.
8.1 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:25da62811e1ea81c6a39469173d9e2be2393f825dae053b77b137a2eca2e2b76_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:ad5f1c38a11e4164c26775e62d67b9361d798c93d0441f7f5f51605b2d140135_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:ceae8d1964727c09992eb9d353f7014bfb151f143b1ab04798d3d061f8a84e9f_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-operator-bundle@sha256:c38526d3744cb4f6b2487656c617a8bf40dd996d6e8ad903aa75a69050e290c8_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Go's `crypto/x509` package. A remote attacker could exploit this by presenting a specially crafted certificate chain containing a large number of policy mappings. This inefficient validation process consumes excessive resources, which can lead to a denial of service (DoS) for applications or systems performing certificate validation.
5.9 (Medium)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:25da62811e1ea81c6a39469173d9e2be2393f825dae053b77b137a2eca2e2b76_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:ad5f1c38a11e4164c26775e62d67b9361d798c93d0441f7f5f51605b2d140135_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:ceae8d1964727c09992eb9d353f7014bfb151f143b1ab04798d3d061f8a84e9f_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-operator-bundle@sha256:c38526d3744cb4f6b2487656c617a8bf40dd996d6e8ad903aa75a69050e290c8_amd64 | — |
Workaround
|
Threats
Impact
Moderate
A flaw was found in the internal/syscall/unix package in the Go standard library. If the target of the `Root.Chmod` function is replaced with a symbolic link during execution, specifically after `Root.Chmod` checks the target but before acting, the `chmod` operation will be performed on the file the symbolic link points to. This issue can bypass directory restrictions and lead to unauthorized permission changes on the filesystem.
7.8 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:25da62811e1ea81c6a39469173d9e2be2393f825dae053b77b137a2eca2e2b76_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:ad5f1c38a11e4164c26775e62d67b9361d798c93d0441f7f5f51605b2d140135_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:ceae8d1964727c09992eb9d353f7014bfb151f143b1ab04798d3d061f8a84e9f_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-operator-bundle@sha256:c38526d3744cb4f6b2487656c617a8bf40dd996d6e8ad903aa75a69050e290c8_amd64 | — |
Workaround
|
Threats
Impact
Moderate
A flaw was found in Prometheus, an open-source monitoring system. The `client_secret` field within the Azure Active Directory (AD) remote write OAuth configuration was incorrectly handled as a plain string instead of a secure Secret type. This misconfiguration allowed any user or process with access to the `/-/config` HTTP API endpoint to view the Azure OAuth client secret in plaintext. This vulnerability leads to information disclosure, potentially compromising the security of integrated Azure AD services.
7.5 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:25da62811e1ea81c6a39469173d9e2be2393f825dae053b77b137a2eca2e2b76_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:ad5f1c38a11e4164c26775e62d67b9361d798c93d0441f7f5f51605b2d140135_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:ceae8d1964727c09992eb9d353f7014bfb151f143b1ab04798d3d061f8a84e9f_ppc64le | — |
Vendor Fix
fix
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-operator-bundle@sha256:c38526d3744cb4f6b2487656c617a8bf40dd996d6e8ad903aa75a69050e290c8_amd64 | — |
Threats
Impact
Important
A flaw was found in Prometheus. An unauthenticated attacker can exploit the remote read endpoint (`/api/v1/read`) by sending a specially crafted, small snappy-compressed payload. This payload causes a disproportionately large memory allocation, leading to memory exhaustion and a Denial of Service (DoS) by crashing the Prometheus process.
7.5 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:25da62811e1ea81c6a39469173d9e2be2393f825dae053b77b137a2eca2e2b76_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:ad5f1c38a11e4164c26775e62d67b9361d798c93d0441f7f5f51605b2d140135_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:ceae8d1964727c09992eb9d353f7014bfb151f143b1ab04798d3d061f8a84e9f_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-operator-bundle@sha256:c38526d3744cb4f6b2487656c617a8bf40dd996d6e8ad903aa75a69050e290c8_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in golang.org/x/net/html. This vulnerability allows an attacker to manipulate how HTML is processed and displayed. By providing specially crafted HTML, an attacker can cause an unexpected structure in the rendered output. This can lead to Cross-Site Scripting (XSS) attacks, where malicious scripts are executed in a user's web browser, potentially compromising user data or taking control of their session.
6.1 (Medium)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:25da62811e1ea81c6a39469173d9e2be2393f825dae053b77b137a2eca2e2b76_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:ad5f1c38a11e4164c26775e62d67b9361d798c93d0441f7f5f51605b2d140135_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:ceae8d1964727c09992eb9d353f7014bfb151f143b1ab04798d3d061f8a84e9f_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-operator-bundle@sha256:c38526d3744cb4f6b2487656c617a8bf40dd996d6e8ad903aa75a69050e290c8_amd64 | — |
Workaround
|
Threats
Impact
Moderate
References
55 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An updated OpenShift File Integrity Operator image that fixes various bugs and adds new\nenhancements is now available for the Red Hat OpenShift Enterprise 4 catalog.",
"title": "Topic"
},
{
"category": "general",
"text": "The OpenShift File Integrity Operator v1.4.1 is now available.\nSee the documentation for bug fix information:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/security_and_compliance/file-integrity-operator",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:54288",
"url": "https://access.redhat.com/errata/RHSA-2026:54288"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-27136",
"url": "https://access.redhat.com/security/cve/CVE-2026-27136"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-32281",
"url": "https://access.redhat.com/security/cve/CVE-2026-32281"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-32282",
"url": "https://access.redhat.com/security/cve/CVE-2026-32282"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42151",
"url": "https://access.redhat.com/security/cve/CVE-2026-42151"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42154",
"url": "https://access.redhat.com/security/cve/CVE-2026-42154"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42502",
"url": "https://access.redhat.com/security/cve/CVE-2026-42502"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_54288.json"
}
],
"title": "Red Hat Security Advisory: OpenShift File Integrity Operator bug fix and enhancement update",
"tracking": {
"current_release_date": "2026-08-18T20:45:48+00:00",
"generator": {
"date": "2026-08-18T20:45:48+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.16"
}
},
"id": "RHSA-2026:54288",
"initial_release_date": "2026-08-12T10:22:52+00:00",
"revision_history": [
{
"date": "2026-08-12T10:22:52+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-08-15T05:55:47+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-08-18T20:45:48+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Compliance Operator 1",
"product": {
"name": "Compliance Operator 1",
"product_id": "Compliance Operator 1",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openshift_file_integrity_operator:1::el9"
}
}
}
],
"category": "product_family",
"name": "Compliance Operator"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/compliance/openshift-file-integrity-operator-bundle@sha256:c38526d3744cb4f6b2487656c617a8bf40dd996d6e8ad903aa75a69050e290c8_amd64",
"product": {
"name": "registry.redhat.io/compliance/openshift-file-integrity-operator-bundle@sha256:c38526d3744cb4f6b2487656c617a8bf40dd996d6e8ad903aa75a69050e290c8_amd64",
"product_id": "registry.redhat.io/compliance/openshift-file-integrity-operator-bundle@sha256:c38526d3744cb4f6b2487656c617a8bf40dd996d6e8ad903aa75a69050e290c8_amd64",
"product_identification_helper": {
"purl": "pkg:oci/openshift-file-integrity-operator-bundle@sha256%3Ac38526d3744cb4f6b2487656c617a8bf40dd996d6e8ad903aa75a69050e290c8?arch=amd64\u0026repository_url=registry.redhat.io/compliance/openshift-file-integrity-operator-bundle\u0026tag=1786519350"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:ad5f1c38a11e4164c26775e62d67b9361d798c93d0441f7f5f51605b2d140135_amd64",
"product": {
"name": "registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:ad5f1c38a11e4164c26775e62d67b9361d798c93d0441f7f5f51605b2d140135_amd64",
"product_id": "registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:ad5f1c38a11e4164c26775e62d67b9361d798c93d0441f7f5f51605b2d140135_amd64",
"product_identification_helper": {
"purl": "pkg:oci/openshift-file-integrity-rhel8-operator@sha256%3Aad5f1c38a11e4164c26775e62d67b9361d798c93d0441f7f5f51605b2d140135?arch=amd64\u0026repository_url=registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator\u0026tag=1786439449"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:ceae8d1964727c09992eb9d353f7014bfb151f143b1ab04798d3d061f8a84e9f_ppc64le",
"product": {
"name": "registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:ceae8d1964727c09992eb9d353f7014bfb151f143b1ab04798d3d061f8a84e9f_ppc64le",
"product_id": "registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:ceae8d1964727c09992eb9d353f7014bfb151f143b1ab04798d3d061f8a84e9f_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/openshift-file-integrity-rhel8-operator@sha256%3Aceae8d1964727c09992eb9d353f7014bfb151f143b1ab04798d3d061f8a84e9f?arch=ppc64le\u0026repository_url=registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator\u0026tag=1786439449"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:25da62811e1ea81c6a39469173d9e2be2393f825dae053b77b137a2eca2e2b76_s390x",
"product": {
"name": "registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:25da62811e1ea81c6a39469173d9e2be2393f825dae053b77b137a2eca2e2b76_s390x",
"product_id": "registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:25da62811e1ea81c6a39469173d9e2be2393f825dae053b77b137a2eca2e2b76_s390x",
"product_identification_helper": {
"purl": "pkg:oci/openshift-file-integrity-rhel8-operator@sha256%3A25da62811e1ea81c6a39469173d9e2be2393f825dae053b77b137a2eca2e2b76?arch=s390x\u0026repository_url=registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator\u0026tag=1786439449"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/compliance/openshift-file-integrity-operator-bundle@sha256:c38526d3744cb4f6b2487656c617a8bf40dd996d6e8ad903aa75a69050e290c8_amd64 as a component of Compliance Operator 1",
"product_id": "Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-operator-bundle@sha256:c38526d3744cb4f6b2487656c617a8bf40dd996d6e8ad903aa75a69050e290c8_amd64"
},
"product_reference": "registry.redhat.io/compliance/openshift-file-integrity-operator-bundle@sha256:c38526d3744cb4f6b2487656c617a8bf40dd996d6e8ad903aa75a69050e290c8_amd64",
"relates_to_product_reference": "Compliance Operator 1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:25da62811e1ea81c6a39469173d9e2be2393f825dae053b77b137a2eca2e2b76_s390x as a component of Compliance Operator 1",
"product_id": "Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:25da62811e1ea81c6a39469173d9e2be2393f825dae053b77b137a2eca2e2b76_s390x"
},
"product_reference": "registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:25da62811e1ea81c6a39469173d9e2be2393f825dae053b77b137a2eca2e2b76_s390x",
"relates_to_product_reference": "Compliance Operator 1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:ad5f1c38a11e4164c26775e62d67b9361d798c93d0441f7f5f51605b2d140135_amd64 as a component of Compliance Operator 1",
"product_id": "Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:ad5f1c38a11e4164c26775e62d67b9361d798c93d0441f7f5f51605b2d140135_amd64"
},
"product_reference": "registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:ad5f1c38a11e4164c26775e62d67b9361d798c93d0441f7f5f51605b2d140135_amd64",
"relates_to_product_reference": "Compliance Operator 1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:ceae8d1964727c09992eb9d353f7014bfb151f143b1ab04798d3d061f8a84e9f_ppc64le as a component of Compliance Operator 1",
"product_id": "Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:ceae8d1964727c09992eb9d353f7014bfb151f143b1ab04798d3d061f8a84e9f_ppc64le"
},
"product_reference": "registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:ceae8d1964727c09992eb9d353f7014bfb151f143b1ab04798d3d061f8a84e9f_ppc64le",
"relates_to_product_reference": "Compliance Operator 1"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-27136",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2026-05-22T16:00:56.609820+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-operator-bundle@sha256:c38526d3744cb4f6b2487656c617a8bf40dd996d6e8ad903aa75a69050e290c8_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480757"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/net/html. When arbitrary HTML is parsed and then rendered, it can result in an unexpected HTML tree. This allows an attacker to bypass HTML sanitization mechanisms, leading to Cross-Site Scripting (XSS) attacks in applications. Such attacks can result in information disclosure or arbitrary code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability in `golang.org/x/net/html` is rated as Important. It allows for Cross-Site Scripting (XSS) attacks by enabling an attacker to bypass HTML sanitization mechanisms when arbitrary HTML is parsed and rendered. This can lead to information disclosure or arbitrary code execution in affected applications. Exploitation typically requires user interaction, where a user processes specially crafted malicious HTML content.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:25da62811e1ea81c6a39469173d9e2be2393f825dae053b77b137a2eca2e2b76_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:ad5f1c38a11e4164c26775e62d67b9361d798c93d0441f7f5f51605b2d140135_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:ceae8d1964727c09992eb9d353f7014bfb151f143b1ab04798d3d061f8a84e9f_ppc64le"
],
"known_not_affected": [
"Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-operator-bundle@sha256:c38526d3744cb4f6b2487656c617a8bf40dd996d6e8ad903aa75a69050e290c8_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-27136"
},
{
"category": "external",
"summary": "RHBZ#2480757",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480757"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-27136",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27136"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27136",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27136"
},
{
"category": "external",
"summary": "https://go.dev/cl/781685",
"url": "https://go.dev/cl/781685"
},
{
"category": "external",
"summary": "https://go.dev/issue/79575",
"url": "https://go.dev/issue/79575"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8",
"url": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5030",
"url": "https://pkg.go.dev/vuln/GO-2026-5030"
}
],
"release_date": "2026-05-22T15:01:22.111000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-12T10:22:52+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your\nsystem have been applied. For details on how to apply this update, refer to:\n\nhttps://docs.openshift.com/container-platform/latest/updating/updating_a_cluster/updating-cluster-cli.html",
"product_ids": [
"Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:25da62811e1ea81c6a39469173d9e2be2393f825dae053b77b137a2eca2e2b76_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:ad5f1c38a11e4164c26775e62d67b9361d798c93d0441f7f5f51605b2d140135_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:ceae8d1964727c09992eb9d353f7014bfb151f143b1ab04798d3d061f8a84e9f_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:54288"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-operator-bundle@sha256:c38526d3744cb4f6b2487656c617a8bf40dd996d6e8ad903aa75a69050e290c8_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:25da62811e1ea81c6a39469173d9e2be2393f825dae053b77b137a2eca2e2b76_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:ad5f1c38a11e4164c26775e62d67b9361d798c93d0441f7f5f51605b2d140135_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:ceae8d1964727c09992eb9d353f7014bfb151f143b1ab04798d3d061f8a84e9f_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-operator-bundle@sha256:c38526d3744cb4f6b2487656c617a8bf40dd996d6e8ad903aa75a69050e290c8_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:25da62811e1ea81c6a39469173d9e2be2393f825dae053b77b137a2eca2e2b76_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:ad5f1c38a11e4164c26775e62d67b9361d798c93d0441f7f5f51605b2d140135_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:ceae8d1964727c09992eb9d353f7014bfb151f143b1ab04798d3d061f8a84e9f_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass"
},
{
"cve": "CVE-2026-32281",
"cwe": {
"id": "CWE-1050",
"name": "Excessive Platform Resource Consumption within a Loop"
},
"discovery_date": "2026-04-08T02:01:00.930989+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-operator-bundle@sha256:c38526d3744cb4f6b2487656c617a8bf40dd996d6e8ad903aa75a69050e290c8_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456333"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Go\u0027s `crypto/x509` package. A remote attacker could exploit this by presenting a specially crafted certificate chain containing a large number of policy mappings. This inefficient validation process consumes excessive resources, which can lead to a denial of service (DoS) for applications or systems performing certificate validation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw occurs during the validation of otherwise trusted certificate chains that contain a large number of policy mappings, leading to excessive resource consumption. Exploitation requires an attacker to present a specially crafted, yet trusted, certificate chain which would require the attacker has already compromised a trusted certificate root. Red Hat continuously monitors certificate authorities and curates the set which is trusted by default for Red Hat products.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:25da62811e1ea81c6a39469173d9e2be2393f825dae053b77b137a2eca2e2b76_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:ad5f1c38a11e4164c26775e62d67b9361d798c93d0441f7f5f51605b2d140135_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:ceae8d1964727c09992eb9d353f7014bfb151f143b1ab04798d3d061f8a84e9f_ppc64le"
],
"known_not_affected": [
"Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-operator-bundle@sha256:c38526d3744cb4f6b2487656c617a8bf40dd996d6e8ad903aa75a69050e290c8_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32281"
},
{
"category": "external",
"summary": "RHBZ#2456333",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456333"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32281",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32281"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32281",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32281"
},
{
"category": "external",
"summary": "https://go.dev/cl/758061",
"url": "https://go.dev/cl/758061"
},
{
"category": "external",
"summary": "https://go.dev/issue/78281",
"url": "https://go.dev/issue/78281"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
"url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4946",
"url": "https://pkg.go.dev/vuln/GO-2026-4946"
}
],
"release_date": "2026-04-08T01:06:58.354000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-12T10:22:52+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your\nsystem have been applied. For details on how to apply this update, refer to:\n\nhttps://docs.openshift.com/container-platform/latest/updating/updating_a_cluster/updating-cluster-cli.html",
"product_ids": [
"Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:25da62811e1ea81c6a39469173d9e2be2393f825dae053b77b137a2eca2e2b76_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:ad5f1c38a11e4164c26775e62d67b9361d798c93d0441f7f5f51605b2d140135_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:ceae8d1964727c09992eb9d353f7014bfb151f143b1ab04798d3d061f8a84e9f_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:54288"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-operator-bundle@sha256:c38526d3744cb4f6b2487656c617a8bf40dd996d6e8ad903aa75a69050e290c8_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:25da62811e1ea81c6a39469173d9e2be2393f825dae053b77b137a2eca2e2b76_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:ad5f1c38a11e4164c26775e62d67b9361d798c93d0441f7f5f51605b2d140135_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:ceae8d1964727c09992eb9d353f7014bfb151f143b1ab04798d3d061f8a84e9f_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-operator-bundle@sha256:c38526d3744cb4f6b2487656c617a8bf40dd996d6e8ad903aa75a69050e290c8_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:25da62811e1ea81c6a39469173d9e2be2393f825dae053b77b137a2eca2e2b76_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:ad5f1c38a11e4164c26775e62d67b9361d798c93d0441f7f5f51605b2d140135_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:ceae8d1964727c09992eb9d353f7014bfb151f143b1ab04798d3d061f8a84e9f_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation"
},
{
"cve": "CVE-2026-32282",
"cwe": {
"id": "CWE-367",
"name": "Time-of-check Time-of-use (TOCTOU) Race Condition"
},
"discovery_date": "2026-04-08T02:01:12.683211+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-operator-bundle@sha256:c38526d3744cb4f6b2487656c617a8bf40dd996d6e8ad903aa75a69050e290c8_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456336"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the internal/syscall/unix package in the Go standard library. If the target of the `Root.Chmod` function is replaced with a symbolic link during execution, specifically after `Root.Chmod` checks the target but before acting, the `chmod` operation will be performed on the file the symbolic link points to. This issue can bypass directory restrictions and lead to unauthorized permission changes on the filesystem.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs access to the system and the required permissions to create a symbolic link. Additionally, the attacker must swap the target file with a symbolic link in the exact window after the `Root.Chmod` function checks its target but before acting. Due to these conditions, this flaw has been rated with a moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:25da62811e1ea81c6a39469173d9e2be2393f825dae053b77b137a2eca2e2b76_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:ad5f1c38a11e4164c26775e62d67b9361d798c93d0441f7f5f51605b2d140135_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:ceae8d1964727c09992eb9d353f7014bfb151f143b1ab04798d3d061f8a84e9f_ppc64le"
],
"known_not_affected": [
"Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-operator-bundle@sha256:c38526d3744cb4f6b2487656c617a8bf40dd996d6e8ad903aa75a69050e290c8_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32282"
},
{
"category": "external",
"summary": "RHBZ#2456336",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456336"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32282",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32282"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32282",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32282"
},
{
"category": "external",
"summary": "https://go.dev/cl/763761",
"url": "https://go.dev/cl/763761"
},
{
"category": "external",
"summary": "https://go.dev/issue/78293",
"url": "https://go.dev/issue/78293"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
"url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4864",
"url": "https://pkg.go.dev/vuln/GO-2026-4864"
}
],
"release_date": "2026-04-08T01:06:55.953000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-12T10:22:52+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your\nsystem have been applied. For details on how to apply this update, refer to:\n\nhttps://docs.openshift.com/container-platform/latest/updating/updating_a_cluster/updating-cluster-cli.html",
"product_ids": [
"Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:25da62811e1ea81c6a39469173d9e2be2393f825dae053b77b137a2eca2e2b76_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:ad5f1c38a11e4164c26775e62d67b9361d798c93d0441f7f5f51605b2d140135_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:ceae8d1964727c09992eb9d353f7014bfb151f143b1ab04798d3d061f8a84e9f_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:54288"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-operator-bundle@sha256:c38526d3744cb4f6b2487656c617a8bf40dd996d6e8ad903aa75a69050e290c8_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:25da62811e1ea81c6a39469173d9e2be2393f825dae053b77b137a2eca2e2b76_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:ad5f1c38a11e4164c26775e62d67b9361d798c93d0441f7f5f51605b2d140135_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:ceae8d1964727c09992eb9d353f7014bfb151f143b1ab04798d3d061f8a84e9f_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-operator-bundle@sha256:c38526d3744cb4f6b2487656c617a8bf40dd996d6e8ad903aa75a69050e290c8_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:25da62811e1ea81c6a39469173d9e2be2393f825dae053b77b137a2eca2e2b76_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:ad5f1c38a11e4164c26775e62d67b9361d798c93d0441f7f5f51605b2d140135_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:ceae8d1964727c09992eb9d353f7014bfb151f143b1ab04798d3d061f8a84e9f_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root"
},
{
"cve": "CVE-2026-42151",
"cwe": {
"id": "CWE-256",
"name": "Plaintext Storage of a Password"
},
"discovery_date": "2026-05-04T19:02:26.983660+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-operator-bundle@sha256:c38526d3744cb4f6b2487656c617a8bf40dd996d6e8ad903aa75a69050e290c8_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2466507"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Prometheus, an open-source monitoring system. The `client_secret` field within the Azure Active Directory (AD) remote write OAuth configuration was incorrectly handled as a plain string instead of a secure Secret type. This misconfiguration allowed any user or process with access to the `/-/config` HTTP API endpoint to view the Azure OAuth client secret in plaintext. This vulnerability leads to information disclosure, potentially compromising the security of integrated Azure AD services.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important information disclosure flaw in Prometheus affects instances configured to use Azure AD remote write with OAuth authentication. The client secret, intended to be a secure credential, is exposed in plaintext through the `/-/config` HTTP API endpoint. This could allow an attacker with access to this endpoint to retrieve the secret, potentially compromising integrated Azure AD services.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:25da62811e1ea81c6a39469173d9e2be2393f825dae053b77b137a2eca2e2b76_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:ad5f1c38a11e4164c26775e62d67b9361d798c93d0441f7f5f51605b2d140135_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:ceae8d1964727c09992eb9d353f7014bfb151f143b1ab04798d3d061f8a84e9f_ppc64le"
],
"known_not_affected": [
"Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-operator-bundle@sha256:c38526d3744cb4f6b2487656c617a8bf40dd996d6e8ad903aa75a69050e290c8_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42151"
},
{
"category": "external",
"summary": "RHBZ#2466507",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2466507"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42151",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42151"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42151",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42151"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/pull/18587",
"url": "https://github.com/prometheus/prometheus/pull/18587"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/pull/18590",
"url": "https://github.com/prometheus/prometheus/pull/18590"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/releases/tag/v3.11.3",
"url": "https://github.com/prometheus/prometheus/releases/tag/v3.11.3"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/releases/tag/v3.5.3",
"url": "https://github.com/prometheus/prometheus/releases/tag/v3.5.3"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/security/advisories/GHSA-wg65-39gg-5wfj",
"url": "https://github.com/prometheus/prometheus/security/advisories/GHSA-wg65-39gg-5wfj"
}
],
"release_date": "2026-05-04T18:12:16.917000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-12T10:22:52+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your\nsystem have been applied. For details on how to apply this update, refer to:\n\nhttps://docs.openshift.com/container-platform/latest/updating/updating_a_cluster/updating-cluster-cli.html",
"product_ids": [
"Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:25da62811e1ea81c6a39469173d9e2be2393f825dae053b77b137a2eca2e2b76_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:ad5f1c38a11e4164c26775e62d67b9361d798c93d0441f7f5f51605b2d140135_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:ceae8d1964727c09992eb9d353f7014bfb151f143b1ab04798d3d061f8a84e9f_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:54288"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-operator-bundle@sha256:c38526d3744cb4f6b2487656c617a8bf40dd996d6e8ad903aa75a69050e290c8_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:25da62811e1ea81c6a39469173d9e2be2393f825dae053b77b137a2eca2e2b76_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:ad5f1c38a11e4164c26775e62d67b9361d798c93d0441f7f5f51605b2d140135_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:ceae8d1964727c09992eb9d353f7014bfb151f143b1ab04798d3d061f8a84e9f_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API"
},
{
"cve": "CVE-2026-42154",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-05-04T19:02:19.626646+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-operator-bundle@sha256:c38526d3744cb4f6b2487656c617a8bf40dd996d6e8ad903aa75a69050e290c8_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2466505"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Prometheus. An unauthenticated attacker can exploit the remote read endpoint (`/api/v1/read`) by sending a specially crafted, small snappy-compressed payload. This payload causes a disproportionately large memory allocation, leading to memory exhaustion and a Denial of Service (DoS) by crashing the Prometheus process.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in remote read endpoint",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in Prometheus, allowing an unauthenticated remote attacker to crash the Prometheus process. This could lead to service unavailability in Red Hat products that deploy Prometheus for monitoring, as the remote read endpoint does not properly validate snappy-compressed request lengths.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:25da62811e1ea81c6a39469173d9e2be2393f825dae053b77b137a2eca2e2b76_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:ad5f1c38a11e4164c26775e62d67b9361d798c93d0441f7f5f51605b2d140135_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:ceae8d1964727c09992eb9d353f7014bfb151f143b1ab04798d3d061f8a84e9f_ppc64le"
],
"known_not_affected": [
"Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-operator-bundle@sha256:c38526d3744cb4f6b2487656c617a8bf40dd996d6e8ad903aa75a69050e290c8_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42154"
},
{
"category": "external",
"summary": "RHBZ#2466505",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2466505"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42154",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42154"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42154",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42154"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/pull/18584",
"url": "https://github.com/prometheus/prometheus/pull/18584"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/pull/18585",
"url": "https://github.com/prometheus/prometheus/pull/18585"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/releases/tag/v3.11.3",
"url": "https://github.com/prometheus/prometheus/releases/tag/v3.11.3"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/releases/tag/v3.5.3",
"url": "https://github.com/prometheus/prometheus/releases/tag/v3.5.3"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/security/advisories/GHSA-8rm2-7qqf-34qm",
"url": "https://github.com/prometheus/prometheus/security/advisories/GHSA-8rm2-7qqf-34qm"
}
],
"release_date": "2026-05-04T18:13:12.340000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-12T10:22:52+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your\nsystem have been applied. For details on how to apply this update, refer to:\n\nhttps://docs.openshift.com/container-platform/latest/updating/updating_a_cluster/updating-cluster-cli.html",
"product_ids": [
"Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:25da62811e1ea81c6a39469173d9e2be2393f825dae053b77b137a2eca2e2b76_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:ad5f1c38a11e4164c26775e62d67b9361d798c93d0441f7f5f51605b2d140135_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:ceae8d1964727c09992eb9d353f7014bfb151f143b1ab04798d3d061f8a84e9f_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:54288"
},
{
"category": "workaround",
"details": "To mitigate this issue, restrict network access to the Prometheus remote read endpoint (/api/v1/read). Configure firewall rules or network policies to permit connections only from trusted internal networks or authorized clients. This action reduces the attack surface by limiting exposure to unauthenticated remote attackers. A service restart or reload may be required for the changes to take effect.",
"product_ids": [
"Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-operator-bundle@sha256:c38526d3744cb4f6b2487656c617a8bf40dd996d6e8ad903aa75a69050e290c8_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:25da62811e1ea81c6a39469173d9e2be2393f825dae053b77b137a2eca2e2b76_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:ad5f1c38a11e4164c26775e62d67b9361d798c93d0441f7f5f51605b2d140135_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:ceae8d1964727c09992eb9d353f7014bfb151f143b1ab04798d3d061f8a84e9f_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-operator-bundle@sha256:c38526d3744cb4f6b2487656c617a8bf40dd996d6e8ad903aa75a69050e290c8_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:25da62811e1ea81c6a39469173d9e2be2393f825dae053b77b137a2eca2e2b76_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:ad5f1c38a11e4164c26775e62d67b9361d798c93d0441f7f5f51605b2d140135_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:ceae8d1964727c09992eb9d353f7014bfb151f143b1ab04798d3d061f8a84e9f_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in remote read endpoint"
},
{
"cve": "CVE-2026-42502",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2026-05-22T16:01:11.151484+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-operator-bundle@sha256:c38526d3744cb4f6b2487656c617a8bf40dd996d6e8ad903aa75a69050e290c8_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480762"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/net/html. This vulnerability allows an attacker to manipulate how HTML is processed and displayed. By providing specially crafted HTML, an attacker can cause an unexpected structure in the rendered output. This can lead to Cross-Site Scripting (XSS) attacks, where malicious scripts are executed in a user\u0027s web browser, potentially compromising user data or taking control of their session.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw in golang.org/x/net/html can lead to Cross-Site Scripting (XSS) in applications that parse and render untrusted HTML, even with sanitization attempts. This is due to an unexpected HTML tree structure, allowing malicious scripts to execute in a user\u0027s browser.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:25da62811e1ea81c6a39469173d9e2be2393f825dae053b77b137a2eca2e2b76_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:ad5f1c38a11e4164c26775e62d67b9361d798c93d0441f7f5f51605b2d140135_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:ceae8d1964727c09992eb9d353f7014bfb151f143b1ab04798d3d061f8a84e9f_ppc64le"
],
"known_not_affected": [
"Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-operator-bundle@sha256:c38526d3744cb4f6b2487656c617a8bf40dd996d6e8ad903aa75a69050e290c8_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42502"
},
{
"category": "external",
"summary": "RHBZ#2480762",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480762"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42502",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42502"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42502",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42502"
},
{
"category": "external",
"summary": "https://go.dev/cl/781701",
"url": "https://go.dev/cl/781701"
},
{
"category": "external",
"summary": "https://go.dev/issue/79572",
"url": "https://go.dev/issue/79572"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8",
"url": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5027",
"url": "https://pkg.go.dev/vuln/GO-2026-5027"
}
],
"release_date": "2026-05-22T15:01:21.649000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-12T10:22:52+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your\nsystem have been applied. For details on how to apply this update, refer to:\n\nhttps://docs.openshift.com/container-platform/latest/updating/updating_a_cluster/updating-cluster-cli.html",
"product_ids": [
"Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:25da62811e1ea81c6a39469173d9e2be2393f825dae053b77b137a2eca2e2b76_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:ad5f1c38a11e4164c26775e62d67b9361d798c93d0441f7f5f51605b2d140135_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:ceae8d1964727c09992eb9d353f7014bfb151f143b1ab04798d3d061f8a84e9f_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:54288"
},
{
"category": "workaround",
"details": "Applications utilizing `golang.org/x/net/html` should implement robust sanitization of all untrusted HTML input before rendering to prevent the creation of unexpected HTML structures that could facilitate XSS attacks. If an application does not require rendering arbitrary HTML, it should avoid processing such input.",
"product_ids": [
"Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-operator-bundle@sha256:c38526d3744cb4f6b2487656c617a8bf40dd996d6e8ad903aa75a69050e290c8_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:25da62811e1ea81c6a39469173d9e2be2393f825dae053b77b137a2eca2e2b76_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:ad5f1c38a11e4164c26775e62d67b9361d798c93d0441f7f5f51605b2d140135_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:ceae8d1964727c09992eb9d353f7014bfb151f143b1ab04798d3d061f8a84e9f_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-operator-bundle@sha256:c38526d3744cb4f6b2487656c617a8bf40dd996d6e8ad903aa75a69050e290c8_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:25da62811e1ea81c6a39469173d9e2be2393f825dae053b77b137a2eca2e2b76_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:ad5f1c38a11e4164c26775e62d67b9361d798c93d0441f7f5f51605b2d140135_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:ceae8d1964727c09992eb9d353f7014bfb151f143b1ab04798d3d061f8a84e9f_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…