Red Hat Security Advisory

RHSA-2026:11331

Red Hat OpenShift Builds 1.7.2

Released 2026-04-28 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat OpenShift Builds 1.7.3 registry.redhat.io/openshift-builds/openshift-builds-rhel9-operator, registry.redhat.io/openshift-builds/openshift-builds-shared-resource-rhel9, registry.redhat.io/openshift-builds/openshift-builds-shared-resource-webhook-rhel9 +1

Fixes 6 records

TI-2025-41709 CVE-2025-68121 · GHSA-h355-32pf-p2xm

Unexpected session resumption in crypto/tls

MEDIUM 51

During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have…

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00902 Published 2026-02-05 Partial fix · 1.24.13, 1.25.7 +1 CWE-295

TI-2026-25614 CVE-2026-33186 · GHSA-p77j-4mvh-x3m3

gRPC-Go has an authorization bypass via missing leading slash in :path

MEDIUM 49

gRPC-Go is the Go language implementation of gRPC.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.01619 Published 2026-03-20 Partial fix · 1.79.3 CWE-285

TI-2026-26182 CVE-2026-33810 · GHSA-fv83-x2xw-2j55

Case-sensitive excludedSubtrees name constraints cause Auth Bypass in crypto/x509

MEDIUM 42

When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different case than the constraint.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00346 Published 2026-04-08 Partial fix · 1.26.2 CWE-295

TI-2026-25632 CVE-2026-33211 · GHSA-j5q5-j9gm-2w5c

Tekton Pipelines git resolver has path traversal that allows reading arbitrary files from the resolver pod

MEDIUM 42

Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines.

CVSS 3.1CRITICAL 9.6 Network Low privileges No interaction EPSS 0.00583 Published 2026-03-23 Partial fix · 1.0.1, 1.3.3 +3 CWE-22

TI-2026-21587 CVE-2026-27137 · GHSA-7hfw-r8qc-89v4

Incorrect enforcement of email constraints in crypto/x509

MEDIUM 40

When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applie…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00661 Published 2026-03-06 Partial fix · 1.26.1 CWE-295

TI-2026-20764 CVE-2026-25679 · GHSA-j3gx-2473-5fp8

Incorrect parsing of IPv6 host literals in net/url

MEDIUM 40

url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00827 Published 2026-03-06 Partial fix · 1.25.8, 1.26.1 CWE-425