Red Hat Security Advisory

RHSA-2026:95611

Red Hat Hardened Images RPMs Security Update

Released 2026-11-05 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Hardened Images podman-5:6.1.4-1.3.hum1@aarch64, podman-5:6.1.4-1.3.hum1@s390x, podman-5:6.1.4-1.3.hum1@src +12

Fixes 2 records

TI-2026-84834 CVE-2026-121522

BuildKit daemon can panic when resolving a Git source twice

LOW 28

In BuildKit versions v0.26.0 through v0.34.1, a specific build definition that resolves metadata for the same Git source reference twice can cause the BuildKit daemon to panic and crash, interrupting builds handled by th…

CVSS 4.0MEDIUM 6.7 Local No auth User interaction EPSS 0.00118 Published 2026-11-03 Partial fix · 0.34.2 CWE-476

TI-2026-84833 CVE-2026-121520

Path escape in BuildKit lets clients set extended attributes

LOW 20

In BuildKit versions prior to v0.34.1, a malicious client with access to the BuildKit control APIs can submit a build request that sets an extended attribute on a file outside the BuildKit state directory.

CVSS 4.0MEDIUM 4.5 Local High privileges No interaction EPSS 0.00139 Published 2026-11-03 Partial fix · 0.34.1 CWE-61