TI-2026-29801 CVE-2026-41178 · GHSA-5wrp-cwcj-q835
OpenTelemetry-Go's baggage parsing no longer caps raw header length
Priority MEDIUM 63
OpenTelemetry-Go is the Go implementation of OpenTelemetry.
RHSA-2026:63016
Submariner v0.24 security fixes and container updates
Released 2026-09-03 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Advanced Cluster Management for Kubernetes 2.17 registry.redhat.io/rhacm2/lighthouse-agent-rhel9, registry.redhat.io/rhacm2/lighthouse-coredns-rhel9, registry.redhat.io/rhacm2/subctl-rhel9 +4
Fixes 13 records
TI-2026-47432 CVE-2026-66788 · GHSA-264j-8377-4hmm
Lighthouse: lighthouse: arbitrary namespace injection via attacker-controlled broker label
Priority MEDIUM 44
A flaw was found in Lighthouse.
TI-2026-47430 CVE-2026-66786 · GHSA-f6r4-g4jr-h7f2
Submariner: submariner: ipsec.conf stanza injection via remote-supplied cablename and subnets
Priority MEDIUM 44
A flaw was found in submariner.
TI-2026-44488 CVE-2026-62309
CoreDNS: proxyproto plugin panics on PPv2 datagram with non-UDP transport — single 28-byte packet remote DoS
Priority MEDIUM 40
CoreDNS is a DNS server written in Go.
TI-2026-47431 CVE-2026-66787 · GHSA-7fh9-j94v-w42j
Lighthouse: lighthouse: cross-cluster dns spoofing via unvalidated endpointslice ip addresses
Priority LOW 39
A flaw was found in the lighthouse component of Red Hat Advanced Cluster Management for Kubernetes.
TI-2026-47429 CVE-2026-66785 · GHSA-37mq-728j-5q43
Submariner: submariner: missing validation of remote endpoint subnets and clusterid enables cross-cluster traffic hijack
Priority LOW 39
A flaw was found in Submariner.
TI-2026-47425 CVE-2026-66780 · GHSA-3xmh-phwc-5f4g
Submariner-operator: broker serviceaccount secret (token + ca) logged in full at trace verbosity
Priority LOW 32
A flaw was found in the submariner-operator component.
TI-2026-21595 CVE-2026-27145 · GHSA-4279-q6mj-392r
Inefficient candidate hostname parsing in crypto/x509
Priority LOW 30
(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries.
TI-2026-47427 CVE-2026-66782 · GHSA-4mpr-hwg7-q5x5
Submariner-operator: operator clusterrole grants cluster-wide create/update on all configmaps
Priority LOW 28
A flaw was found in the Submariner operator.
TI-2026-30785 CVE-2026-42502 · GHSA-wrh2-89vg-4j9g
Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html
Priority LOW 27
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree.
TI-2026-21586 CVE-2026-27136 · GHSA-m9x8-m34x-fj9q
Invoking duplicate attributes can cause XSS in golang.org/x/net/html
Priority LOW 27
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree.
TI-2026-47426 CVE-2026-66781 · GHSA-gcch-g8g2-6852
Submariner-operator: pprof debug endpoint enabled by default on 0.0.0.0:8082 without authentication
Priority LOW 25
A flaw was found in the Submariner operator.
TI-2026-47428 CVE-2026-66783 · GHSA-95w2-696m-24mq
Submariner-operator: release workflow consumes same-org composite action via mutable @devel branch ref
Priority LOW 22
A flaw was found in the `submariner-operator` component of Red Hat Advanced Cluster Management for Kubernetes.