RHSA-2026:86675
Vulnerability from csaf_redhat - Published: 2026-10-21 07:25 - Updated: 2026-10-21 14:59Summary
Red Hat Security Advisory: Ansible plug-ins for Red Hat Developer Hub Product Release Update
Severity
Important
Notes
Topic: Updated images are now available for Red Hat Ansible Automation Platform 2.2, which include new features, bug fixes, and enhancements for Red Hat Ansible Automation Platform integration with Red Hat Developer Hub.
Details: Red Hat Ansible Automation Platform 2.2 delivers an Ansible-first Red Hat Developer Hub
user experience that simplifies the automation experience for Ansible users of all skill levels.
The Ansible plug-ins provide curated content and features to accelerate Ansible learner
onboarding and streamline Ansible use case adoption across your organization.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in multer, a Node.js middleware for handling multipart/form-data. A remote attacker can exploit a file descriptor leak by sending repeated aborted or malformed multipart uploads. This can exhaust system resources, leading to a denial of service (DoS) for the affected application.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:17e885eb8a7c85fb67221a494bb3b5aba3d78c98029c90a1789d8b496240f9b7_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in adm-zip, a JavaScript library for handling ZIP archives. The `getData()` function in `zipEntry.js` allocates memory based on the declared uncompressed size in a ZIP entry's central directory without validating this value against the actual compressed data. A remote attacker can exploit this by providing a specially crafted, small ZIP file that declares a multi-gigabyte uncompressed size. This can lead to excessive memory consumption, causing applications to terminate or suffer service-wide memory exhaustion, resulting in a Denial of Service (DoS).
6.5 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-77037
Threats
Impact
Moderate
A flaw was found in Multer, a Node.js middleware for handling multipart/form-data. A remote attacker can send a specially crafted multipart request containing oversized array indices in field names. This can cause Multer's field parser to synchronously iterate a maximum-length sparse array, which blocks the event loop and prevents the application from processing other requests. This vulnerability leads to a denial of service, making the affected application unresponsive.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-77037
Threats
Impact
Important
A flaw was found in proxy-addr. When an application defines trusted proxy subnets using IPv4-mapped IPv6 addresses with an improper prefix length, the subnet parser fails open and erroneously treats all incoming network addresses as trusted. A remote, unauthenticated attacker can exploit this vulnerability by submitting a forged X-Forwarded-For header to spoof their client IP address. This flaw allows attackers to bypass IP-based access controls, rate limiting, and audit logging.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-77037
Threats
Impact
Important
A flaw was found in vm2. This vulnerability allows an attacker running untrusted code within the sandbox to achieve arbitrary code execution on the host system. By accessing internal host properties through standard output streams, the untrusted code can manipulate process event handlers and escape the sandbox environment.
10.0 (Critical)
Affected products
Fixed
1 product, the same list as for
CVE-2026-77037
Threats
Impact
Important
A flaw was found in source-map-js. This vulnerability allows a remote attacker to trigger a denial of service by providing malformed input. Specifically, by supplying extremely large offset line values in indexed source maps, the attacker can cause the service's event loop to block, making it unable to process further requests.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-77037
Threats
Impact
Important
A flaw was found in adm-zip. This vulnerability allows privilege escalation when untrusted archives are extracted with original file permissions enabled. The library fails to filter out special Unix execution flags, such as setuid or setgid, from extracted files. If an administrative process extracts a specially crafted archive, an attacker can place a binary that allows a local unprivileged user to execute code with administrative privileges.
7.1 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-77037
Threats
Impact
Important
A flaw was found in basic-ftp. A malicious or compromised FTP server can cause a Denial of Service (DoS) by returning specially crafted Unix directory listings to the client. Inefficient regular expression processing during directory parsing leads to excessive CPU consumption, blocking the application event loop and causing the process to become unresponsive.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-77037
Threats
Impact
Important
A flaw was found in @backstage/plugin-scaffolder-backend. An authenticated user with permission to view another user's Scaffolder task can retrieve internal task execution data, leading to sensitive information disclosure. If this execution data contains credentials for external services, an attacker could expose those credentials and perform unauthorized actions within those services.
8.1 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-77037
Threats
Impact
Important
A flaw was found in the Backstage plugin-scaffolder-backend component. An authorization bypass allows an authenticated user with access to Scaffolder templates to circumvent configured action restrictions. By manipulating action inputs, an attacker can leverage integration credentials to gain unauthorized access to source-control repositories and associated resources.
8.1 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-77037
Threats
Impact
Important
References
83 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Updated images are now available for Red Hat Ansible Automation Platform 2.2, which include new features, bug fixes, and enhancements for Red Hat Ansible Automation Platform integration with Red Hat Developer Hub.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat Ansible Automation Platform 2.2 delivers an Ansible-first Red Hat Developer Hub\nuser experience that simplifies the automation experience for Ansible users of all skill levels.\nThe Ansible plug-ins provide curated content and features to accelerate Ansible learner\nonboarding and streamline Ansible use case adoption across your organization.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:86675",
"url": "https://access.redhat.com/errata/RHSA-2026:86675"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-102282",
"url": "https://access.redhat.com/security/cve/CVE-2026-102282"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-102990",
"url": "https://access.redhat.com/security/cve/CVE-2026-102990"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-106501",
"url": "https://access.redhat.com/security/cve/CVE-2026-106501"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-106503",
"url": "https://access.redhat.com/security/cve/CVE-2026-106503"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-77037",
"url": "https://access.redhat.com/security/cve/CVE-2026-77037"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-77301",
"url": "https://access.redhat.com/security/cve/CVE-2026-77301"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-82333",
"url": "https://access.redhat.com/security/cve/CVE-2026-82333"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-90711",
"url": "https://access.redhat.com/security/cve/CVE-2026-90711"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-92955",
"url": "https://access.redhat.com/security/cve/CVE-2026-92955"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-93749",
"url": "https://access.redhat.com/security/cve/CVE-2026-93749"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform",
"url": "https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_86675.json"
}
],
"title": "Red Hat Security Advisory: Ansible plug-ins for Red Hat Developer Hub Product Release Update",
"tracking": {
"current_release_date": "2026-10-21T14:59:54+00:00",
"generator": {
"date": "2026-10-21T14:59:54+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.4.2"
}
},
"id": "RHSA-2026:86675",
"initial_release_date": "2026-10-21T07:25:30+00:00",
"revision_history": [
{
"date": "2026-10-21T07:25:30+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-10-21T07:25:31+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-10-21T14:59:54+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Ansible Automation Platform 2.2",
"product": {
"name": "Red Hat Ansible Automation Platform 2.2",
"product_id": "Red Hat Ansible Automation Platform 2.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:ansible_portal:2.2"
}
}
}
],
"category": "product_family",
"name": "Red Hat Ansible Automation Platform"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/ansible-automation-platform/automation-portal@sha256:17e885eb8a7c85fb67221a494bb3b5aba3d78c98029c90a1789d8b496240f9b7_amd64",
"product": {
"name": "registry.redhat.io/ansible-automation-platform/automation-portal@sha256:17e885eb8a7c85fb67221a494bb3b5aba3d78c98029c90a1789d8b496240f9b7_amd64",
"product_id": "registry.redhat.io/ansible-automation-platform/automation-portal@sha256:17e885eb8a7c85fb67221a494bb3b5aba3d78c98029c90a1789d8b496240f9b7_amd64",
"product_identification_helper": {
"purl": "pkg:oci/automation-portal@sha256%3A17e885eb8a7c85fb67221a494bb3b5aba3d78c98029c90a1789d8b496240f9b7?arch=amd64\u0026repository_url=registry.redhat.io/ansible-automation-platform/automation-portal\u0026tag=1792523640"
}
}
}
],
"category": "architecture",
"name": "amd64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ansible-automation-platform/automation-portal@sha256:17e885eb8a7c85fb67221a494bb3b5aba3d78c98029c90a1789d8b496240f9b7_amd64 as a component of Red Hat Ansible Automation Platform 2.2",
"product_id": "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:17e885eb8a7c85fb67221a494bb3b5aba3d78c98029c90a1789d8b496240f9b7_amd64"
},
"product_reference": "registry.redhat.io/ansible-automation-platform/automation-portal@sha256:17e885eb8a7c85fb67221a494bb3b5aba3d78c98029c90a1789d8b496240f9b7_amd64",
"relates_to_product_reference": "Red Hat Ansible Automation Platform 2.2"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-77037",
"cwe": {
"id": "CWE-772",
"name": "Missing Release of Resource after Effective Lifetime"
},
"discovery_date": "2026-08-28T22:01:52.103221+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2525787"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in multer, a Node.js middleware for handling multipart/form-data. A remote attacker can exploit a file descriptor leak by sending repeated aborted or malformed multipart uploads. This can exhaust system resources, leading to a denial of service (DoS) for the affected application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "multer: Multer: Denial of Service via file descriptor leak on aborted uploads",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A file descriptor leak vulnerability was found in multer, a Node.js middleware for handling multipart/form-data. When using multer\u0027s built-in diskStorage engine, aborted or truncated uploads cause the disk storage engine to remove the visible file but fail to close the underlying write file descriptor. A remote attacker able to reach an upload route can send repeated aborted or malformed multipart uploads, each one leaking a file descriptor and retaining disk blocks until the process exits, which can exhaust system resources and cause a denial of service. This vulnerability only affects applications using multer\u0027s diskStorage; applications using memoryStorage or custom storage engines are not affected.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:17e885eb8a7c85fb67221a494bb3b5aba3d78c98029c90a1789d8b496240f9b7_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-77037"
},
{
"category": "external",
"summary": "RHBZ#2525787",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2525787"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-77037",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-77037"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-77037",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77037"
},
{
"category": "external",
"summary": "https://cna.openjsf.org/security-advisories.html",
"url": "https://cna.openjsf.org/security-advisories.html"
},
{
"category": "external",
"summary": "https://github.com/expressjs/multer/security/advisories/GHSA-qfvm-cv95-jqjf",
"url": "https://github.com/expressjs/multer/security/advisories/GHSA-qfvm-cv95-jqjf"
}
],
"release_date": "2026-08-28T19:44:23.501000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-21T07:25:30+00:00",
"details": "For more about Ansible plugins for Red Hat Developer Hub, see References links",
"product_ids": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:17e885eb8a7c85fb67221a494bb3b5aba3d78c98029c90a1789d8b496240f9b7_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:86675"
},
{
"category": "workaround",
"details": "Upgrade to multer 2.3.0 or later, which properly closes the destination write stream on abnormal source termination and defers cleanup until the stream has closed.",
"product_ids": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:17e885eb8a7c85fb67221a494bb3b5aba3d78c98029c90a1789d8b496240f9b7_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:17e885eb8a7c85fb67221a494bb3b5aba3d78c98029c90a1789d8b496240f9b7_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "multer: Multer: Denial of Service via file descriptor leak on aborted uploads"
},
{
"cve": "CVE-2026-77301",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-09-22T21:58:07.363582+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2539017"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in adm-zip, a JavaScript library for handling ZIP archives. The `getData()` function in `zipEntry.js` allocates memory based on the declared uncompressed size in a ZIP entry\u0027s central directory without validating this value against the actual compressed data. A remote attacker can exploit this by providing a specially crafted, small ZIP file that declares a multi-gigabyte uncompressed size. This can lead to excessive memory consumption, causing applications to terminate or suffer service-wide memory exhaustion, resulting in a Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "adm-zip: adm-zip: Denial of Service via uncontrolled memory allocation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates the impact of this vulnerability as Moderate because successful exploitation requires an application to ingest an untrusted archive and results solely in a denial of service through memory exhaustion, without compromising confidentiality or integrity. Within Red Hat environments, adm-zip is embedded as an internal dependency in containerized dashboards and developer utilities. As a result, excessive resource allocation remains constrained to the specific worker process or container parsing the file, mitigating wider system failure.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:17e885eb8a7c85fb67221a494bb3b5aba3d78c98029c90a1789d8b496240f9b7_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-77301"
},
{
"category": "external",
"summary": "RHBZ#2539017",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2539017"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-77301",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-77301"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-77301",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77301"
},
{
"category": "external",
"summary": "https://github.com/cthackers/adm-zip/commit/491600683dacb6cb9fe0718a0eeb9cb5eb49afa6",
"url": "https://github.com/cthackers/adm-zip/commit/491600683dacb6cb9fe0718a0eeb9cb5eb49afa6"
},
{
"category": "external",
"summary": "https://github.com/cthackers/adm-zip/releases/tag/v0.6.1",
"url": "https://github.com/cthackers/adm-zip/releases/tag/v0.6.1"
},
{
"category": "external",
"summary": "https://github.com/cthackers/adm-zip/security/advisories/GHSA-7q85-xj36-vmfc",
"url": "https://github.com/cthackers/adm-zip/security/advisories/GHSA-7q85-xj36-vmfc"
}
],
"release_date": "2026-09-18T16:38:47.064000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-21T07:25:30+00:00",
"details": "For more about Ansible plugins for Red Hat Developer Hub, see References links",
"product_ids": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:17e885eb8a7c85fb67221a494bb3b5aba3d78c98029c90a1789d8b496240f9b7_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:86675"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:17e885eb8a7c85fb67221a494bb3b5aba3d78c98029c90a1789d8b496240f9b7_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:17e885eb8a7c85fb67221a494bb3b5aba3d78c98029c90a1789d8b496240f9b7_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "adm-zip: adm-zip: Denial of Service via uncontrolled memory allocation"
},
{
"cve": "CVE-2026-82333",
"cwe": {
"id": "CWE-1285",
"name": "Improper Validation of Specified Index, Position, or Offset in Input"
},
"discovery_date": "2026-08-28T22:02:12.422600+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2525793"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Multer, a Node.js middleware for handling multipart/form-data. A remote attacker can send a specially crafted multipart request containing oversized array indices in field names. This can cause Multer\u0027s field parser to synchronously iterate a maximum-length sparse array, which blocks the event loop and prevents the application from processing other requests. This vulnerability leads to a denial of service, making the affected application unresponsive.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "multer: Multer: Denial of Service via oversized array index in field names",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Multiple vulnerabilities were found in multer, a Node.js middleware for handling multipart/form-data. CVE-2026-82333 allows a remote attacker to send specially crafted multipart requests with oversized array indices in field names, causing multer\u0027s field parser to allocate and iterate maximum-length sparse arrays. This blocks the event loop and prevents the application from processing other requests, leading to a denial of service. CVE-2026-77063 allows a remote attacker to exploit a race condition between an asynchronous file filter and file size limit enforcement to bypass configured file size restrictions. While the underlying parser still truncates oversized files, this circumvents the intended rejection logic. Both vulnerabilities affect all versions of multer before 2.3.0.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:17e885eb8a7c85fb67221a494bb3b5aba3d78c98029c90a1789d8b496240f9b7_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-82333"
},
{
"category": "external",
"summary": "RHBZ#2525793",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2525793"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-82333",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-82333"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-82333",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-82333"
},
{
"category": "external",
"summary": "https://cna.openjsf.org/security-advisories.html",
"url": "https://cna.openjsf.org/security-advisories.html"
},
{
"category": "external",
"summary": "https://github.com/expressjs/multer/security/advisories/GHSA-535w-7cp7-47q4",
"url": "https://github.com/expressjs/multer/security/advisories/GHSA-535w-7cp7-47q4"
}
],
"release_date": "2026-08-28T20:12:21.355000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-21T07:25:30+00:00",
"details": "For more about Ansible plugins for Red Hat Developer Hub, see References links",
"product_ids": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:17e885eb8a7c85fb67221a494bb3b5aba3d78c98029c90a1789d8b496240f9b7_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:86675"
},
{
"category": "workaround",
"details": "Upgrade to multer 2.3.0 or later. For CVE-2026-82333, multer 2.3.0 adds an opt-in fieldArrayIndexLimit option that rejects oversized array indexes - set limits.fieldArrayIndexLimit to the largest array index your application needs.",
"product_ids": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:17e885eb8a7c85fb67221a494bb3b5aba3d78c98029c90a1789d8b496240f9b7_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:17e885eb8a7c85fb67221a494bb3b5aba3d78c98029c90a1789d8b496240f9b7_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "multer: Multer: Denial of Service via oversized array index in field names"
},
{
"cve": "CVE-2026-90711",
"cwe": {
"id": "CWE-290",
"name": "Authentication Bypass by Spoofing"
},
"discovery_date": "2026-09-15T06:41:11.029083+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2533602"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in proxy-addr. When an application defines trusted proxy subnets using IPv4-mapped IPv6 addresses with an improper prefix length, the subnet parser fails open and erroneously treats all incoming network addresses as trusted. A remote, unauthenticated attacker can exploit this vulnerability by submitting a forged X-Forwarded-For header to spoof their client IP address. This flaw allows attackers to bypass IP-based access controls, rate limiting, and audit logging.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "proxy-addr: proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Important because unauthenticated remote attackers can spoof client IP addresses and circumvent security controls, such as rate limits or network access lists, by sending custom forwarding headers. Exploitation is contingent on application configurations that define reverse proxy trust subnets using IPv4-mapped IPv6 notation with short IPv4 prefix lengths. Environments configuring trusted proxies via canonical IPv4 CIDR blocks, hostnames, or default loopback addresses are not vulnerable to this behavior.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:17e885eb8a7c85fb67221a494bb3b5aba3d78c98029c90a1789d8b496240f9b7_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-90711"
},
{
"category": "external",
"summary": "RHBZ#2533602",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533602"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-90711",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-90711"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-90711",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-90711"
},
{
"category": "external",
"summary": "https://cna.openjsf.org/security-advisories.html",
"url": "https://cna.openjsf.org/security-advisories.html"
},
{
"category": "external",
"summary": "https://github.com/jshttp/proxy-addr/security/advisories/GHSA-jqcg-44mw-7w3h",
"url": "https://github.com/jshttp/proxy-addr/security/advisories/GHSA-jqcg-44mw-7w3h"
}
],
"release_date": "2026-09-15T06:19:46.332000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-21T07:25:30+00:00",
"details": "For more about Ansible plugins for Red Hat Developer Hub, see References links",
"product_ids": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:17e885eb8a7c85fb67221a494bb3b5aba3d78c98029c90a1789d8b496240f9b7_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:86675"
},
{
"category": "workaround",
"details": "To mitigate this flaw through configuration:\n\n1. Configure trusted proxy definitions using standard IPv4 notation (such as `10.0.0.0/8`) rather than IPv4-mapped IPv6 notation.\n2. If IPv4-mapped IPv6 notation is required, set the subnet prefix length to at least 97 to cover the mapped boundary (for example, specify `::ffff:10.0.0.0/104` instead of `::ffff:10.0.0.0/8`).\n3. Alternatively, sanitize or strip incoming `X-Forwarded-For` headers at edge load balancers or boundary reverse proxies before passing traffic to backend applications.\n\nWarning: Modifying application configuration files requires restarting the Node.js application service, which will temporarily interrupt service availability and active connections.",
"product_ids": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:17e885eb8a7c85fb67221a494bb3b5aba3d78c98029c90a1789d8b496240f9b7_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:17e885eb8a7c85fb67221a494bb3b5aba3d78c98029c90a1789d8b496240f9b7_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "proxy-addr: proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet"
},
{
"cve": "CVE-2026-92955",
"cwe": {
"id": "CWE-913",
"name": "Improper Control of Dynamically-Managed Code Resources"
},
"discovery_date": "2026-09-17T13:51:33.999468+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2536027"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in vm2. This vulnerability allows an attacker running untrusted code within the sandbox to achieve arbitrary code execution on the host system. By accessing internal host properties through standard output streams, the untrusted code can manipulate process event handlers and escape the sandbox environment.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "vm2: vm2 before 3.11.8 Sandbox Escape via NodeVM",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Important because escaping the sandbox allows untrusted code execution within the host service context, potentially compromising the underlying container or application environment. \n\nRed Hat products that bundle vm2 do so only via typescript-json-schema, which uses the base VM class. The vulnerability requires NodeVM with the default console: \u0027inherit\u0027, which injects the host console object (exposing _stdout/_stderr) into the sandbox; the base VM class never provides a console. Red Hat products does not instantiates NodeVM by default so this vulnerability is an Important rather than a Critical.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:17e885eb8a7c85fb67221a494bb3b5aba3d78c98029c90a1789d8b496240f9b7_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-92955"
},
{
"category": "external",
"summary": "RHBZ#2536027",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536027"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-92955",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-92955"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-92955",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92955"
},
{
"category": "external",
"summary": "https://github.com/patriksimek/vm2/security/advisories/GHSA-88hf-g992-jg85",
"url": "https://github.com/patriksimek/vm2/security/advisories/GHSA-88hf-g992-jg85"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/vm2-before-3.11.8-sandbox-escape-via-nodevm",
"url": "https://www.vulncheck.com/advisories/vm2-before-3.11.8-sandbox-escape-via-nodevm"
}
],
"release_date": "2026-09-17T13:46:13.508000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-21T07:25:30+00:00",
"details": "For more about Ansible plugins for Red Hat Developer Hub, see References links",
"product_ids": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:17e885eb8a7c85fb67221a494bb3b5aba3d78c98029c90a1789d8b496240f9b7_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:86675"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:17e885eb8a7c85fb67221a494bb3b5aba3d78c98029c90a1789d8b496240f9b7_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10.0,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:17e885eb8a7c85fb67221a494bb3b5aba3d78c98029c90a1789d8b496240f9b7_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "vm2: vm2 before 3.11.8 Sandbox Escape via NodeVM"
},
{
"cve": "CVE-2026-93749",
"cwe": {
"id": "CWE-1285",
"name": "Improper Validation of Specified Index, Position, or Offset in Input"
},
"discovery_date": "2026-09-22T18:17:34.349880+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2538368"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in source-map-js. This vulnerability allows a remote attacker to trigger a denial of service by providing malformed input. Specifically, by supplying extremely large offset line values in indexed source maps, the attacker can cause the service\u0027s event loop to block, making it unable to process further requests.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "source-map-js: source-map-js: Denial of Service via malformed indexed source maps",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Important because an unauthenticated remote attacker can supply crafted data that synchronously blocks the single-threaded event loop, resulting in a sustained denial of service for affected services. In standard Red Hat application environments, source map parsing utilities are predominantly utilized in build systems or developer tooling rather than production-facing services, which limits general exposure. However, server-side applications accepting and processing untrusted source maps from external clients are directly susceptible to availability disruption.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:17e885eb8a7c85fb67221a494bb3b5aba3d78c98029c90a1789d8b496240f9b7_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-93749"
},
{
"category": "external",
"summary": "RHBZ#2538368",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2538368"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-93749",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93749"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93749",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93749"
},
{
"category": "external",
"summary": "https://github.com/7rulnik/source-map-js",
"url": "https://github.com/7rulnik/source-map-js"
},
{
"category": "external",
"summary": "https://github.com/7rulnik/source-map-js/blob/c1cd8904bb7bd0c7fb5879fcda48134d82a27934/lib/source-node.js#L115-L118",
"url": "https://github.com/7rulnik/source-map-js/blob/c1cd8904bb7bd0c7fb5879fcda48134d82a27934/lib/source-node.js#L115-L118"
},
{
"category": "external",
"summary": "https://github.com/7rulnik/source-map-js/issues/76",
"url": "https://github.com/7rulnik/source-map-js/issues/76"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/source-map-js-through-1.2.1-event-loop-denial-of-service",
"url": "https://www.vulncheck.com/advisories/source-map-js-through-1.2.1-event-loop-denial-of-service"
}
],
"release_date": "2026-09-18T17:51:34.972000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-21T07:25:30+00:00",
"details": "For more about Ansible plugins for Red Hat Developer Hub, see References links",
"product_ids": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:17e885eb8a7c85fb67221a494bb3b5aba3d78c98029c90a1789d8b496240f9b7_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:86675"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:17e885eb8a7c85fb67221a494bb3b5aba3d78c98029c90a1789d8b496240f9b7_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "source-map-js: source-map-js: Denial of Service via malformed indexed source maps"
},
{
"cve": "CVE-2026-102282",
"cwe": {
"id": "CWE-278",
"name": "Insecure Preserved Inherited Permissions"
},
"discovery_date": "2026-10-05T17:11:38.925127+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2545998"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in adm-zip. This vulnerability allows privilege escalation when untrusted archives are extracted with original file permissions enabled. The library fails to filter out special Unix execution flags, such as setuid or setgid, from extracted files. If an administrative process extracts a specially crafted archive, an attacker can place a binary that allows a local unprivileged user to execute code with administrative privileges.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "adm-zip: adm-zip: Privilege escalation via unfiltered permission bits in extracted archives",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A local privilege escalation flaw rated IMPORTANT by Red Hat was found in the adm-zip JavaScript library, which is bundled by several Red Hat products for creating and extracting ZIP archives. When extracting a ZIP archive with the keepOriginalPermission option enabled, adm-zip applies the Unix permission bits stored in the archive entry to the extracted file without filtering out the setuid and setgid bits. An attacker who can supply a specially crafted archive to an application or process that extracts it with this option enabled, for example a build, CI, or installation step running with administrative privileges, can cause a binary with the setuid bit set to be written to disk. If a local unprivileged user subsequently executes that file, the attacker\u0027s code runs with administrative privileges, resulting in a full compromise of the confidentiality and integrity of the affected host. Red Hat rates this flaw with a CVSS 3.1 score of 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), consistent with the upstream severity. Fixes for affected Red Hat product streams, including OpenShift Container Platform and community Fedora and EPEL components, are being pursued through the responsible product teams. Red Hat Enterprise Linux is not affected because the vulnerable adm-zip code is not present in the shipped gjs packages, and in the JBoss Fuse 7 ELS stream the vulnerable code is not in an executable path.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:17e885eb8a7c85fb67221a494bb3b5aba3d78c98029c90a1789d8b496240f9b7_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-102282"
},
{
"category": "external",
"summary": "RHBZ#2545998",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2545998"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-102282",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-102282"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-102282",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102282"
},
{
"category": "external",
"summary": "https://github.com/cthackers/adm-zip/commit/6a63c339b83c52915483efacda517660a7a7bf87",
"url": "https://github.com/cthackers/adm-zip/commit/6a63c339b83c52915483efacda517660a7a7bf87"
},
{
"category": "external",
"summary": "https://github.com/cthackers/adm-zip/releases/tag/v0.6.1",
"url": "https://github.com/cthackers/adm-zip/releases/tag/v0.6.1"
},
{
"category": "external",
"summary": "https://github.com/cthackers/adm-zip/security/advisories/GHSA-j5f4-cc29-5x44",
"url": "https://github.com/cthackers/adm-zip/security/advisories/GHSA-j5f4-cc29-5x44"
}
],
"release_date": "2026-10-05T17:00:00.250000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-21T07:25:30+00:00",
"details": "For more about Ansible plugins for Red Hat Developer Hub, see References links",
"product_ids": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:17e885eb8a7c85fb67221a494bb3b5aba3d78c98029c90a1789d8b496240f9b7_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:86675"
},
{
"category": "workaround",
"details": "When extracting archives from untrusted sources with adm-zip, do not enable the keepOriginalPermission option in extractAllTo()/extractEntryTo(); the vulnerable permission-preservation behavior is only invoked when this option is enabled. The upstream project has released a version that filters the setuid/setgid bits from extracted permission metadata, so updating adm-zip to a version that includes this fix, when made available through Red Hat product channels, resolves the issue.",
"product_ids": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:17e885eb8a7c85fb67221a494bb3b5aba3d78c98029c90a1789d8b496240f9b7_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:17e885eb8a7c85fb67221a494bb3b5aba3d78c98029c90a1789d8b496240f9b7_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "adm-zip: adm-zip: Privilege escalation via unfiltered permission bits in extracted archives"
},
{
"cve": "CVE-2026-102990",
"cwe": {
"id": "CWE-1333",
"name": "Inefficient Regular Expression Complexity"
},
"discovery_date": "2026-09-30T19:51:03.342149+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2544216"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in basic-ftp. A malicious or compromised FTP server can cause a Denial of Service (DoS) by returning specially crafted Unix directory listings to the client. Inefficient regular expression processing during directory parsing leads to excessive CPU consumption, blocking the application event loop and causing the process to become unresponsive.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "basic-ftp: basic-ftp: Denial of Service via crafted Unix directory listings",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Important because connecting to an untrusted or hostile remote FTP endpoint allows unauthenticated actors to trigger catastrophic CPU exhaustion, halting application responsiveness. In Red Hat solutions embedding this client library, parsing manipulated directory contents monopolizes the single-threaded Node.js event engine, causing an outright denial of service across all concurrent operations. Risk is confined to workflows where the client actively queries and lists directories on untrusted external file transfer services.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:17e885eb8a7c85fb67221a494bb3b5aba3d78c98029c90a1789d8b496240f9b7_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-102990"
},
{
"category": "external",
"summary": "RHBZ#2544216",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2544216"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-102990",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-102990"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-102990",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102990"
},
{
"category": "external",
"summary": "https://github.com/patrickjuchli/basic-ftp/commit/d0d9e07c56e519587bb50532ac6eadbb0cb0cfe9",
"url": "https://github.com/patrickjuchli/basic-ftp/commit/d0d9e07c56e519587bb50532ac6eadbb0cb0cfe9"
},
{
"category": "external",
"summary": "https://github.com/patrickjuchli/basic-ftp/releases/tag/v6.2.1",
"url": "https://github.com/patrickjuchli/basic-ftp/releases/tag/v6.2.1"
},
{
"category": "external",
"summary": "https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-c475-qrg2-pj4r",
"url": "https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-c475-qrg2-pj4r"
}
],
"release_date": "2026-09-30T19:44:47.303000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-21T07:25:30+00:00",
"details": "For more about Ansible plugins for Red Hat Developer Hub, see References links",
"product_ids": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:17e885eb8a7c85fb67221a494bb3b5aba3d78c98029c90a1789d8b496240f9b7_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:86675"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:17e885eb8a7c85fb67221a494bb3b5aba3d78c98029c90a1789d8b496240f9b7_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:17e885eb8a7c85fb67221a494bb3b5aba3d78c98029c90a1789d8b496240f9b7_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "basic-ftp: basic-ftp: Denial of Service via crafted Unix directory listings"
},
{
"cve": "CVE-2026-106501",
"cwe": {
"id": "CWE-201",
"name": "Insertion of Sensitive Information Into Sent Data"
},
"discovery_date": "2026-10-06T21:51:39.882210+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2547222"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in @backstage/plugin-scaffolder-backend. An authenticated user with permission to view another user\u0027s Scaffolder task can retrieve internal task execution data, leading to sensitive information disclosure. If this execution data contains credentials for external services, an attacker could expose those credentials and perform unauthorized actions within those services.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "@backstage/plugin-scaffolder-backend: Backstage: Sensitive information exposure in Scaffolder",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as an Important impact because authenticated users with read permissions to Scaffolder tasks can inspect internal run data, which may contain sensitive secrets or tokens for integrated downstream services. In environments running Red Hat Developer Hub and Ansible Automation Platform Portal where automated templates interact with protected external systems, this leak allows unauthorized third-party modifications and privilege escalation across integrated infrastructure. While exploitation requires valid portal credentials and permission to view tasks, the potential compromise of external secrets elevates the operational blast radius beyond the application boundary.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:17e885eb8a7c85fb67221a494bb3b5aba3d78c98029c90a1789d8b496240f9b7_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-106501"
},
{
"category": "external",
"summary": "RHBZ#2547222",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2547222"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-106501",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106501"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-106501",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106501"
},
{
"category": "external",
"summary": "https://github.com/backstage/backstage/commit/66d2219edf0abe33ab7d0c1ced5d069d1e065be5",
"url": "https://github.com/backstage/backstage/commit/66d2219edf0abe33ab7d0c1ced5d069d1e065be5"
},
{
"category": "external",
"summary": "https://github.com/backstage/backstage/commit/c19838870476a8e29144c84b1a5ac0654ec20fb5",
"url": "https://github.com/backstage/backstage/commit/c19838870476a8e29144c84b1a5ac0654ec20fb5"
},
{
"category": "external",
"summary": "https://github.com/backstage/backstage/commit/e262d649981ff99bb01ca7077807ae3e25e85560",
"url": "https://github.com/backstage/backstage/commit/e262d649981ff99bb01ca7077807ae3e25e85560"
},
{
"category": "external",
"summary": "https://github.com/backstage/backstage/releases/tag/v1.49.6",
"url": "https://github.com/backstage/backstage/releases/tag/v1.49.6"
},
{
"category": "external",
"summary": "https://github.com/backstage/backstage/releases/tag/v1.50.5",
"url": "https://github.com/backstage/backstage/releases/tag/v1.50.5"
},
{
"category": "external",
"summary": "https://github.com/backstage/backstage/releases/tag/v1.54.6",
"url": "https://github.com/backstage/backstage/releases/tag/v1.54.6"
},
{
"category": "external",
"summary": "https://github.com/backstage/backstage/security/advisories/GHSA-g2v8-7jhw-pp8p",
"url": "https://github.com/backstage/backstage/security/advisories/GHSA-g2v8-7jhw-pp8p"
}
],
"release_date": "2026-10-06T21:32:25.997000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-21T07:25:30+00:00",
"details": "For more about Ansible plugins for Red Hat Developer Hub, see References links",
"product_ids": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:17e885eb8a7c85fb67221a494bb3b5aba3d78c98029c90a1789d8b496240f9b7_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:86675"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:17e885eb8a7c85fb67221a494bb3b5aba3d78c98029c90a1789d8b496240f9b7_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:17e885eb8a7c85fb67221a494bb3b5aba3d78c98029c90a1789d8b496240f9b7_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "@backstage/plugin-scaffolder-backend: Backstage: Sensitive information exposure in Scaffolder"
},
{
"cve": "CVE-2026-106503",
"cwe": {
"id": "CWE-807",
"name": "Reliance on Untrusted Inputs in a Security Decision"
},
"discovery_date": "2026-10-06T21:52:45.886561+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2547234"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Backstage plugin-scaffolder-backend component. An authorization bypass allows an authenticated user with access to Scaffolder templates to circumvent configured action restrictions. By manipulating action inputs, an attacker can leverage integration credentials to gain unauthorized access to source-control repositories and associated resources.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "plugin-scaffolder-backend: plugin-scaffolder-backend: Authorization bypass via scaffolder action inputs",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as an Important severity because authenticated remote users can circumvent execution guardrails defined for backend actions, creating high confidentiality and integrity risks for connected source control management systems. In Red Hat Developer Hub and Ansible Automation Platform environments where software templates are enabled, users with permission to run Scaffolder tasks could manipulate input parameters beyond authorized boundaries. The overall exposure is determined by the privilege scope granted to underlying integration service accounts and tokens.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:17e885eb8a7c85fb67221a494bb3b5aba3d78c98029c90a1789d8b496240f9b7_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-106503"
},
{
"category": "external",
"summary": "RHBZ#2547234",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2547234"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-106503",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106503"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-106503",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106503"
},
{
"category": "external",
"summary": "https://github.com/backstage/backstage/commit/11c1384c0649b8ab26391c6a4e4f34b80ab0d188",
"url": "https://github.com/backstage/backstage/commit/11c1384c0649b8ab26391c6a4e4f34b80ab0d188"
},
{
"category": "external",
"summary": "https://github.com/backstage/backstage/commit/a91ed72d540e80b62a73b39bb1563ff5018d52d1",
"url": "https://github.com/backstage/backstage/commit/a91ed72d540e80b62a73b39bb1563ff5018d52d1"
},
{
"category": "external",
"summary": "https://github.com/backstage/backstage/commit/e307e4f487103d815e484291b3fda778ab9983bf",
"url": "https://github.com/backstage/backstage/commit/e307e4f487103d815e484291b3fda778ab9983bf"
},
{
"category": "external",
"summary": "https://github.com/backstage/backstage/releases/tag/v1.49.6",
"url": "https://github.com/backstage/backstage/releases/tag/v1.49.6"
},
{
"category": "external",
"summary": "https://github.com/backstage/backstage/releases/tag/v1.50.5",
"url": "https://github.com/backstage/backstage/releases/tag/v1.50.5"
},
{
"category": "external",
"summary": "https://github.com/backstage/backstage/releases/tag/v1.54.6",
"url": "https://github.com/backstage/backstage/releases/tag/v1.54.6"
},
{
"category": "external",
"summary": "https://github.com/backstage/backstage/security/advisories/GHSA-hmp2-4m7g-22cv",
"url": "https://github.com/backstage/backstage/security/advisories/GHSA-hmp2-4m7g-22cv"
}
],
"release_date": "2026-10-06T21:37:33.675000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-21T07:25:30+00:00",
"details": "For more about Ansible plugins for Red Hat Developer Hub, see References links",
"product_ids": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:17e885eb8a7c85fb67221a494bb3b5aba3d78c98029c90a1789d8b496240f9b7_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:86675"
},
{
"category": "workaround",
"details": "To reduce the risk associated with this flaw:\n\n1. Restrict template access: Limit permissions to execute Scaffolder templates to trusted users by configuring role-based access control (RBAC) policies in Red Hat Developer Hub or Ansible Automation Platform.\n2. Enforce least privilege on integration credentials: Audit and restrict source control provider tokens (such as GitHub, GitLab, or Bitbucket credentials) to the minimum necessary repository scopes and permissions required for legitimate template actions.\n\nCaveats: Limiting integration credential permissions may cause templates that require administrative or elevated privileges to fail. Modifying credential secrets or configuration files within the deployment environment will require restarting the application pods for the new settings to take effect.",
"product_ids": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:17e885eb8a7c85fb67221a494bb3b5aba3d78c98029c90a1789d8b496240f9b7_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:17e885eb8a7c85fb67221a494bb3b5aba3d78c98029c90a1789d8b496240f9b7_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "plugin-scaffolder-backend: plugin-scaffolder-backend: Authorization bypass via scaffolder action inputs"
}
]
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.