Red Hat Security Advisory

RHSA-2026:74536

Red Hat Hardened Images RPMs bug fix and enhancement update

Released 2026-10-01 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Hardened Images oauth2-proxy-7.15.5-0.1.hum1@aarch64, oauth2-proxy-7.15.5-0.1.hum1@src, oauth2-proxy-7.15.5-0.1.hum1@x86_64

Fixes 2 records

TI-2026-53671 CVE-2026-76835 · GHSA-vvqv-7vrf-88vh

OAuth2 Proxy 7.15.2 through 7.15.4 Authentication Bypass via X-Forwarded-Uri Under the Default Trusted Proxy Set

HIGH 81

OAuth2 Proxy honours a client-supplied X-Forwarded-Uri header when deciding whether a request may skip authentication, because the guard added for CVE-2026-40575 is inert in the default reverse-proxy configuration.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00453 Published 2026-08-24 Fixed CWE-290

TI-2026-69257 CVE-2026-56851 · GHSA-gx9w-9qq8-m485

Panic in golang.org/x/text Nickname profile parsing crafted input

LOW 39

The Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00466 Published 2026-10-07 Partial fix · 0.41.0 CWE-787