Red Hat Security AdvisoryRHSA-2026:2900
Network Observability 1.11.0 for OpenShift
Released 2026-02-18 · Red Hat rating Important · View on Red Hat →
Fixed in
- Network Observability (NETOBSERV) 1.11.0 registry.redhat.io/network-observability/network-observability-cli-rhel9, registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9, registry.redhat.io/network-observability/network-observability-console-plugin-rhel9 +2
Fixes 15 records
Priority HIGH 69
node-tar,a Tar for Node.js, contains a vulnerability in versions prior to 7.5.7 where the security check for hardlink entries uses different path resolution semantics than the actual hardlink creation logic.
CVSS 3.1HIGH 8.2· Network · No auth · User interaction · EPSS 0.00608 · Published 2026-01-28 · Partial fix · 7.5.7 CWE-22
Priority HIGH 69
node-tar is a Tar for Node.js.
CVSS 4.0HIGH 8.2· Local · No auth · User interaction · EPSS 0.00376 · Published 2026-01-16 · Partial fix · 7.5.3 CWE-22
Priority MEDIUM 64
wheel is a command line tool for manipulating Python wheel files, as defined in PEP 427.
CVSS 3.1HIGH 7.1· Local · No auth · User interaction · EPSS 0.0035 · Published 2026-01-22 · Partial fix · 0.46.2 CWE-22
Priority MEDIUM 50
urllib3 is an HTTP client library for Python.
CVSS 4.0HIGH 8.9· Network · No auth · No interaction · EPSS 0.02922 · Published 2026-01-07 · Partial fix · 2.6.3 CWE-409
Priority MEDIUM 46
urllib3 is a user-friendly HTTP client library for Python.
CVSS 4.0HIGH 8.9· Network · No auth · No interaction · EPSS 0.00731 · Published 2025-12-05 · Partial fix · 2.6.0 CWE-770
Priority MEDIUM 44
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00446 · Published 2025-11-26 · Partial fix · 1.3.2 CWE-674
Priority MEDIUM 44
An interpretation-conflict (CWE-436) vulnerability in node-forge versions 1.3.1 and earlier enables unauthenticated attackers to craft ASN.1 structures to desynchronize schema validations, yielding a semantic divergence…
CVSS 3.1HIGH 8.6· Network · No auth · No interaction · EPSS 0.0058 · Published 2025-11-25 · Partial fix · 1.3.2 CWE-436
Priority MEDIUM 40
urllib3 is a user-friendly HTTP client library for Python.
CVSS 4.0HIGH 8.9· Network · No auth · No interaction · EPSS 0.00731 · Published 2025-12-05 · Partial fix · 2.6.0 CWE-409
Priority MEDIUM 40
The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.01823 · Published 2026-01-21 · Partial fix · 4.17.23, 4.18.0 CWE-1321
Priority LOW 38
Fulcio is a free-to-use certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00226 · Published 2025-12-04 · Partial fix · 1.8.3 CWE-405
Priority LOW 35
runc is a CLI tool for spawning and running containers according to the OCI specification.
CVSS 4.0HIGH 7.3· Local · Low privileges · User interaction · EPSS 0.00801 · Published 2025-11-06 · Partial fix · 1.2.8, 1.13.0 +2 CWE-363
Priority LOW 35
containerd is an open-source container runtime.
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00168 · Published 2025-11-06 · Partial fix · 1.7.29, 2.0.7 +2 CWE-279
Priority LOW 34
Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue affects qs: < 6.14.1.
CVSS 4.0MEDIUM 6.3· Network · No auth · No interaction · EPSS 0.0045 · Published 2025-12-29 · Partial fix · 6.14.1 CWE-20
Priority LOW 30
containerd is an open-source container runtime.
CVSS 4.0MEDIUM 6.9· Local · No auth · No interaction · EPSS 0.00171 · Published 2025-11-07 · Partial fix · 1.7.29, 2.0.7 +2 CWE-401
Priority LOW 20
tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files.
CVSS 3.1MEDIUM 4.3· Network · No auth · User interaction · EPSS 0.00443 · Published 2025-10-29 · Partial fix · 1.24.8, 1.25.2
THREATIST.IORead the docs