Red Hat Security AdvisoryRHSA-2026:26547
RHACS 4.10.4 security and bug fix update
Released 2026-06-17 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10 registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator, registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8 +1
Fixes 7 records
Priority MEDIUM 57
Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.0691 · Published 2026-05-22 · Partial fix · 0.52.0 CWE-295
Priority MEDIUM 50
Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped.
CVSS 3.1CRITICAL 10.0· Network · No auth · No interaction · EPSS 0.00556 · Published 2026-05-22 · Partial fix · 0.52.0 CWE-863
Priority MEDIUM 47
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label.
CVSS 3.1CRITICAL 9.6· Network · Low privileges · No interaction · EPSS 0.01834 · Published 2026-05-22 · Partial fix · 1.25.13, 1.26.6 +2 CWE-1289
Priority LOW 39
The RSA and DSA public key parsers did not enforce size limits on key parameters.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00467 · Published 2026-05-22 · Partial fix · 0.52.0 CWE-347
Priority LOW 28
When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a sec…
CVSS 3.1MEDIUM 6.3· Network · Low privileges · No interaction · EPSS 0.00369 · Published 2026-05-22 · Partial fix · 0.52.0 CWE-295
Priority LOW 27
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00223 · Published 2026-05-22 · Partial fix · 0.55.0 CWE-1021
Priority LOW 25
SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00504 · Published 2026-05-22 · Partial fix · 0.52.0 CWE-295
THREATIST.IORead the docs