Red Hat Security Advisory

RHSA-2026:50873

RHTAS 1.4.3 - Red Hat Trusted Artifact Signer Release

Released 2026-08-05 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Trusted Artifact Signer 1.4 registry.redhat.io/rhtas/fulcio-rhel9, registry.redhat.io/rhtas/rekor-backfill-redis-rhel9, registry.redhat.io/rhtas/rekor-search-ui-rhel9 +2

TI-2026-42684 CVE-2026-59869 · GHSA-52cp-r559-cp3m

HIGH 72

js-yaml is a JavaScript YAML parser and dumper.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00585 Published 2026-07-08 Partial fix · 3.15.0, 4.3.0 CWE-407

TI-2026-28713 CVE-2026-39831 · GHSA-89gr-r52h-f8rx

MEDIUM 48

The Verify() method for FIDO/U2F security key types ([email protected], [email protected]) did not check the User Presence flag.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00478 Published 2026-05-22 Partial fix · 0.52.0 CWE-862

TI-2026-35984 CVE-2026-48702 · GHSA-47q9-m4ww-924m

LOW 39

Rekor is a software supply chain transparency log.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0046 Published 2026-08-13 Partial fix · 1.5.2 CWE-770

TI-2026-34256 CVE-2026-46597 · GHSA-q4h4-gmj2-qvw2

LOW 39

An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00473 Published 2026-05-22 Partial fix · 0.52.0 CWE-704