Read the docs
TI-2026-17723 Aliases CVE-2026-22029GHSA-2w69-qvjg-hvjx

React Router vulnerable to XSS via Open Redirects

Priority LOW 38CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
High
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · High · None
Fix status
Partial Red Hat: 35 fixed, 21 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-79.

Summary

React Router is a router for React. In @remix-run/router version prior to 1.23.2 and react-router 7.0.0 through 7.11.0, React Router (and Remix v1/v2) SPA open navigation redirects originating from loaders or actions in Framework Mode, Data Mode, or the unstable RSC modes can result in unsafe URLs causing unintended javascript execution on the client. This is only an issue if you are creating redirect paths from untrusted content or via an open redirect. There is no impact if Declarative Mode (<BrowserRouter>) is being used. This issue has been patched in @remix-run/router version 1.23.2 and react-router version 7.12.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00866 58th percentileScored 2026-11-07
Fix Partial react-router (remix-run): 7.12.0@remix-run/router (remix-run): 1.23.2+2 more productsRed Hat: 39 advisoriesRed Hat: 35 fixed, 21 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
remix-runreact-router7.0.0 to before 7.12.07.12.0Patch availableCNA
remix-run@remix-run/routerbefore 1.23.21.23.2Patch availableCNA
—react-router (npm)7.0.0 to before 7.12.07.12.0Patch availableGHSA-2w69-qvjg-hvjx
—@remix-run/router (npm)before 1.23.21.23.2Patch availableGHSA-2w69-qvjg-hvjx
  • react-router Vendorremix-run Affected 7.0.0 to before 7.12.0 Fixed in 7.12.0 Patch available CNA
  • @remix-run/router Vendorremix-run Affected before 1.23.2 Fixed in 1.23.2 Patch available CNA
  • react-router (npm) Vendor— Affected 7.0.0 to before 7.12.0 Fixed in 7.12.0 Patch available GHSA-2w69-qvjg-hvjx
  • @remix-run/router (npm) Vendor— Affected before 1.23.2 Fixed in 1.23.2 Patch available GHSA-2w69-qvjg-hvjx

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:shopify:remix-run\/react:*:*:*:*:*:node.js:*:*before 1.23.2Vulnerableremix-run
cpe:2.3:a:shopify:react-router:*:*:*:*:*:node.js:*:*7.0.0 – 7.11.0Vulnerableremix-run
  • cpe:2.3:a:shopify:remix-run\/react:*:*:*:*:*:node.js:*:* Versions before 1.23.2 Vulnerable ·remix-run
  • cpe:2.3:a:shopify:react-router:*:*:*:*:*:node.js:*:* Versions 7.0.0 – 7.11.0 Vulnerable ·remix-run

Remediation

  • Fix · CNA react-router (remix-run) Fixed in 7.12.0
  • Fix · CNA @remix-run/router (remix-run) Fixed in 1.23.2
  • Fix · GHSA-2w69-qvjg-hvjx react-router (npm) Fixed in 7.12.0 Advisory →
  • Fix · GHSA-2w69-qvjg-hvjx @remix-run/router (npm) Fixed in 1.23.2 Advisory →

Red Hat 39 advisories

  • RHSA-2026:83622 Released 2026-10-15 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.17.28 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.17 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +16
  • RHSA-2026:41928 Released 2026-07-20 · Red Hat rating Important
    Red Hat Migration Toolkit for Containers
    • Red Hat Migration Toolkit 1.8 registry.redhat.io/rhmtc/openshift-migration-controller-rhel8, registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8, registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8 +6
  • RHSA-2026:41064 Released 2026-07-16 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.11.10 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.11 registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/console-rhel9, registry.redhat.io/rhacm2/multicluster-operators-subscription-rhel9
Show 36 more Red Hat advisories
  • RHSA-2026:40984 Released 2026-07-16 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.20.15 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.20 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +19
  • RHSA-2026:40945 Released 2026-07-16 · Red Hat rating Important
    Red Hat Edge Manager Version 1.1.3 Security Update
    • Red Hat Edge Manager 1.1 registry.redhat.io/rhem/flightctl-alert-exporter-rhel10, registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10, registry.redhat.io/rhem/flightctl-api-rhel10 +11
  • RHSA-2026:40118 Released 2026-07-15 · Red Hat rating Important
    Red Hat Edge Manager Version 1.1.3 Security Update
    • Red Hat Edge Manager 1.1 registry.redhat.io/rhem/flightctl-alert-exporter-rhel9, registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel9, registry.redhat.io/rhem/flightctl-api-rhel9 +11
  • RHSA-2026:34100 Released 2026-07-09 · Red Hat rating Important
    OpenShift Container Platform 4.17.55 security and extras update
    • Red Hat OpenShift Container Platform 4.17 registry.redhat.io/openshift4/nmstate-console-plugin-rhel9, registry.redhat.io/openshift4/ose-aws-efs-csi-driver-container-rhel9, registry.redhat.io/openshift4/ose-csi-external-provisioner-rhel9 +6
  • RHSA-2026:36882 Released 2026-07-08 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.14.3 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.14 registry.redhat.io/rhacm2/acm-cli-rhel9, registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9, registry.redhat.io/rhacm2/acm-governance-policy-framework-addon-rhel9 +10
  • RHSA-2026:36651 Released 2026-07-08 · Red Hat rating Important
    Red Hat Edge Manager Version 1.0.3 Security Update
    • Red Hat Edge Manager 1.0 registry.redhat.io/rhem/flightctl-alert-exporter-rhel9, registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel9, registry.redhat.io/rhem/flightctl-api-rhel9 +9
  • RHSA-2026:26420 Released 2026-06-16 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.18.24 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.18 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +16
  • RHSA-2026:26413 Released 2026-06-16 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.19.19 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.19 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +17
  • RHSA-2026:21658 Released 2026-06-03 · Red Hat rating Important
    OpenShift Container Platform 4.18.43 security and extras update
    • Red Hat OpenShift Container Platform 4.18 registry.redhat.io/openshift4/nmstate-console-plugin-rhel9, registry.redhat.io/openshift4/ose-aws-efs-csi-driver-container-rhel9, registry.redhat.io/openshift4/ose-cluster-nfd-rhel9-operator +5
  • RHSA-2026:20041 Released 2026-05-27 · Red Hat rating Important
    OpenShift Container Platform 4.19.32 bug fix and security update
    • Red Hat OpenShift Container Platform 4.19 registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9, registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9 +47
  • RHSA-2026:20042 Released 2026-05-27 · Red Hat rating Important
    OpenShift Container Platform 4.19.32 security and extras update
    • Red Hat OpenShift Container Platform 4.19 registry.redhat.io/openshift4/nmstate-console-plugin-rhel9, registry.redhat.io/openshift4/ose-aws-efs-csi-driver-container-rhel9, registry.redhat.io/openshift4/ose-dpu-cni-rhel9 +5
  • RHSA-2026:19712 Released 2026-05-20 · Red Hat rating Critical
    RHOAI 3.3.3 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.3 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9 +33
  • RHSA-2026:17468 Released 2026-05-20 · Red Hat rating Important
    OpenShift Container Platform 4.20.23 bug fix and security update
    • Red Hat OpenShift Container Platform 4.20 registry.redhat.io/openshift4/azure-service-rhel9-operator, registry.redhat.io/openshift4/kube-metrics-server-rhel9, registry.redhat.io/openshift4/ose-agent-installer-ui-rhel9 +14
  • RHSA-2026:17469 Released 2026-05-20 · Red Hat rating Important
    OpenShift Container Platform 4.20.23 security and extras update
    • Red Hat OpenShift Container Platform 4.20 registry.redhat.io/openshift4/nmstate-console-plugin-rhel9, registry.redhat.io/openshift4/ose-node-feature-discovery-rhel9
  • RHSA-2026:17474 Released 2026-05-19 · Red Hat rating Important
    OpenShift Container Platform 4.21.16 bug fix and security update
    • Red Hat OpenShift Container Platform 4.21 registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/azure-service-rhel9-operator, registry.redhat.io/openshift4/kube-metrics-server-rhel9 +13
  • RHSA-2026:13548 Released 2026-05-04 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.15.2 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.15 registry.redhat.io/rhacm2/acm-cli-rhel9, registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9, registry.redhat.io/rhacm2/acm-governance-policy-framework-addon-rhel9 +8
  • RHSA-2026:13542 Released 2026-05-04 · Red Hat rating Important
    multicluster engine for Kubernetes v2.10.2 security update
    • multicluster engine for Kubernetes 2.10 registry.redhat.io/multicluster-engine/backplane-rhel9-operator, registry.redhat.io/multicluster-engine/console-mce-rhel9, registry.redhat.io/multicluster-engine/discovery-rhel9 +1
  • RHSA-2026:9848 Released 2026-04-22 · Red Hat rating Important
    multicluster engine for Kubernetes v2.6.10 security update
    • multicluster engine for Kubernetes 2.6 registry.redhat.io/multicluster-engine/backplane-rhel9-operator, registry.redhat.io/multicluster-engine/console-mce-rhel9, registry.redhat.io/multicluster-engine/discovery-rhel9 +1
  • RHSA-2026:8229 Released 2026-04-15 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.13.6 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.13 registry.redhat.io/rhacm2/acm-cli-rhel9, registry.redhat.io/rhacm2/acm-cluster-permission-rhel9, registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9 +12
  • RHSA-2026:8218 Released 2026-04-15 · Red Hat rating Important
    multicluster engine for Kubernetes v2.8.5 security update
    • multicluster engine for Kubernetes 2.8 registry.redhat.io/multicluster-engine/backplane-rhel9-operator, registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9, registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9 +5
  • RHSA-2026:5636 Released 2026-03-24 · Red Hat rating Important
    multicluster engine for Kubernetes v2.7.9 security update
    • multicluster engine for Kubernetes 2.7 registry.redhat.io/multicluster-engine/backplane-rhel9-operator, registry.redhat.io/multicluster-engine/cluster-proxy-rhel9, registry.redhat.io/multicluster-engine/console-mce-rhel9 +4
  • RHSA-2026:5633 Released 2026-03-24 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.12.8 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.12 registry.redhat.io/rhacm2/acm-cluster-permission-rhel9, registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9, registry.redhat.io/rhacm2/acm-grafana-rhel9 +23
  • RHSA-2026:3959 Released 2026-03-06 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update
    • Red Hat Ansible Automation Platform 2.5 for RHEL 8 automation-controller-4.6.26-1.el8ap, automation-controller-cli-4.6.26-1.el8ap, automation-controller-server-4.6.26-1.el8ap +10
    • Red Hat Ansible Automation Platform 2.5 for RHEL 9 automation-controller-4.6.26-1.el9ap, automation-controller-cli-4.6.26-1.el9ap, automation-controller-server-4.6.26-1.el9ap +10
  • RHSA-2026:3960 Released 2026-03-06 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.6 Container Release Update
    • Red Hat Ansible Automation Platform 2.6 registry.redhat.io/ansible-automation-platform-26/de-minimal-rhel9, registry.redhat.io/ansible-automation-platform-26/de-supported-rhel9, registry.redhat.io/ansible-automation-platform-26/ee-minimal-rhel9 +9
  • RHSA-2026:3958 Released 2026-03-06 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update
    • Red Hat Ansible Automation Platform 2.6 for RHEL 10 receptor-1.6.3-4.el10ap, receptorctl-1.6.3-4.el10ap
    • Red Hat Ansible Automation Platform 2.6 for RHEL 9 automation-controller-4.7.9-1.el9ap, automation-controller-cli-4.7.9-1.el9ap, automation-controller-server-4.7.9-1.el9ap +8
  • RHSA-2026:3782 Released 2026-03-04 · Red Hat rating Critical
    RHOAI 2.25.3 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-caikit-tgis-serving-rhel9, registry.redhat.io/rhoai/odh-codeflare-operator-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9 +27
  • RHSA-2026:3087 Released 2026-02-23 · Red Hat rating Important
    RHTAS 1.3.2 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.3 registry.redhat.io/rhtas/rhtas-console-rhel9, registry.redhat.io/rhtas/rhtas-console-ui-rhel9
  • RHSA-2026:2694 Released 2026-02-12 · Red Hat rating Important
    A Subscription Management tool for finding and reporting Red Hat product usage
    • Red Hat Discovery 2 registry.redhat.io/discovery/discovery-server-rhel9, registry.redhat.io/discovery/discovery-ui-rhel9
  • RHSA-2026:2572 Released 2026-02-11 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.14.2 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.14 registry.redhat.io/rhacm2/acm-cli-rhel9, registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/config-policy-controller-rhel9 +16
  • RHSA-2026:2568 Released 2026-02-11 · Red Hat rating Important
    RHACS 4.9.3 security and bug fix update
    • Red Hat Advanced Cluster Security 4.9 registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-collector-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8 +6
  • RHSA-2026:2456 Released 2026-02-10 · Red Hat rating Important
    Red Hat OpenShift Dev Spaces 3.26.0 Release.
    • Red Hat OpenShift Dev Spaces (RHOSDS) 3.26 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/configbump-rhel9, registry.redhat.io/devspaces/dashboard-rhel9 +9
  • RHSA-2026:2350 Released 2026-02-09 · Red Hat rating Important
    RHACS 4.9.3 security and bug fix update
    • Red Hat Advanced Cluster Security 4.9 registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-collector-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8 +6
  • RHSA-2026:2149 Released 2026-02-05 · Red Hat rating Important
    Kiali 2.17.3 for Red Hat OpenShift Service Mesh 3.2
    • Red Hat OpenShift Service Mesh 3.2 registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9, registry.redhat.io/openshift-service-mesh/kiali-rhel9
  • RHSA-2026:2148 Released 2026-02-05 · Red Hat rating Important
    Kiali 2.11.6 for Red Hat OpenShift Service Mesh 3.1
    • Red Hat OpenShift Service Mesh 3.1 registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9, registry.redhat.io/openshift-service-mesh/kiali-rhel9
  • RHSA-2026:2147 Released 2026-02-05 · Red Hat rating Important
    Kiali 2.4.12 for Red Hat OpenShift Service Mesh 3.0
    • Red Hat OpenShift Service Mesh 3.0 registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9, registry.redhat.io/openshift-service-mesh/kiali-rhel9
  • RHSA-2026:1517 Released 2026-01-28 · Red Hat rating Important
    RHACS 4.8.8 security and bug fix update
    • Red Hat Advanced Cluster Security 4.8 registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-collector-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8 +8

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Logging Subsystem for Red Hat OpenShiftAffectedNo fix planned: Will not fix
Migration Toolkit for VirtualizationAffectedNo fix planned: Will not fix
Multicluster Engine for KubernetesAffectedNo fix yet
OpenShift LightspeedAffectedNo fix yet
OpenShift PipelinesAffectedNo fix yet
Red Hat Advanced Cluster Management for Kubernetes 2AffectedNo fix yet
Red Hat Ansible Automation Platform 2AffectedNo fix yet
Red Hat Connectivity Link 1AffectedNo fix planned: Will not fix
Red Hat Data Grid 8AffectedNo fix yet
Red Hat Developer Hub 1AffectedNo fix yet
Red Hat Edge Manager previewAffectedNo fix yet
Red Hat Fuse 7AffectedNo fix planned: Will not fix
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet
Red Hat OpenShift Container Platform 4AffectedNo fix planned: Will not fix
Red Hat OpenShift GitOpsAffectedNo fix planned: Will not fix
Red Hat OpenShift Virtualization 4AffectedNo fix yet
Red Hat OpenShift distributed tracing 3AffectedNo fix yet
Red Hat Process Automation 7AffectedNo fix planned: Will not fix
Red Hat Quay 3AffectedNo fix yet
Red Hat Single Sign-On 7AffectedNo fix planned: Will not fix
Red Hat build of Apicurio Registry 2AffectedNo fix yet
Red Hat Advanced Cluster Management for Kubernetes 2.11Fixed RHSA-2026:41064
Red Hat Advanced Cluster Management for Kubernetes 2.12Fixed RHSA-2026:5633
Red Hat Advanced Cluster Management for Kubernetes 2.13Fixed RHSA-2026:8229
Red Hat Advanced Cluster Management for Kubernetes 2.14Fixed RHSA-2026:2572, RHSA-2026:36882
Red Hat Advanced Cluster Management for Kubernetes 2.15Fixed RHSA-2026:13548
Red Hat Advanced Cluster Security 4.8Fixed RHSA-2026:1517
Red Hat Advanced Cluster Security 4.9Fixed RHSA-2026:2350, RHSA-2026:2568
Red Hat Ansible Automation Platform 2.5 for RHEL 8Fixed RHSA-2026:3959
Red Hat Ansible Automation Platform 2.5 for RHEL 9Fixed RHSA-2026:3959
Red Hat Ansible Automation Platform 2.6Fixed RHSA-2026:3960
Red Hat Ansible Automation Platform 2.6 for RHEL 9Fixed RHSA-2026:3958
Red Hat Discovery 2Fixed RHSA-2026:2694
Red Hat Edge Manager 1.0Fixed RHSA-2026:36651
Red Hat Edge Manager 1.1Fixed RHSA-2026:40118, RHSA-2026:40945
Red Hat Migration Toolkit 1.8Fixed RHSA-2026:41928
Red Hat OpenShift AI 2.25Fixed RHSA-2026:3782
Red Hat OpenShift AI 3.3Fixed RHSA-2026:19712
Red Hat OpenShift Container Platform 4.17Fixed RHSA-2026:34100
Red Hat OpenShift Container Platform 4.18Fixed RHSA-2026:21658
Red Hat OpenShift Container Platform 4.19Fixed RHSA-2026:20041, RHSA-2026:20042
Red Hat OpenShift Container Platform 4.20Fixed RHSA-2026:17468, RHSA-2026:17469
Red Hat OpenShift Container Platform 4.21Fixed RHSA-2026:17474
Red Hat OpenShift Dev Spaces (RHOSDS) 3.26Fixed RHSA-2026:2456
Red Hat OpenShift Service Mesh 3.0Fixed RHSA-2026:2147
Red Hat OpenShift Service Mesh 3.1Fixed RHSA-2026:2148
Red Hat OpenShift Service Mesh 3.2Fixed RHSA-2026:2149
Red Hat Openshift Data Foundation 4.17Fixed RHSA-2026:83622
Red Hat Openshift Data Foundation 4.18Fixed RHSA-2026:26420
Red Hat Openshift Data Foundation 4.19Fixed RHSA-2026:26413
Red Hat Openshift Data Foundation 4.20Fixed RHSA-2026:40984
Red Hat Trusted Artifact Signer 1.3Fixed RHSA-2026:3087
multicluster engine for Kubernetes 2.10Fixed RHSA-2026:13542
multicluster engine for Kubernetes 2.6Fixed RHSA-2026:9848
multicluster engine for Kubernetes 2.7Fixed RHSA-2026:5636
multicluster engine for Kubernetes 2.8Fixed RHSA-2026:8218
Not affected: 57 products
  • Cryostat 4
  • Gatekeeper 3
  • Migration Toolkit for Applications 7
  • Migration Toolkit for Applications 8
  • Network Observability Operator
  • Node HealthCheck Operator
  • OpenShift Service Mesh 2
  • OpenShift Service Mesh 3
  • Red Hat Advanced Cluster Management for Kubernetes 2.11
  • Red Hat Advanced Cluster Management for Kubernetes 2.12
  • Red Hat Advanced Cluster Management for Kubernetes 2.13
  • Red Hat Advanced Cluster Management for Kubernetes 2.14
  • Red Hat Advanced Cluster Management for Kubernetes 2.15
  • Red Hat Advanced Cluster Security 4
  • Red Hat Advanced Cluster Security 4.8
  • Red Hat Advanced Cluster Security 4.9
  • Red Hat Ansible Automation Platform 2
  • Red Hat Ansible Automation Platform 2.5 for RHEL 8
  • Red Hat Ansible Automation Platform 2.5 for RHEL 9
  • Red Hat Ansible Automation Platform 2.6
  • Red Hat Ansible Automation Platform 2.6 for RHEL 10
  • Red Hat Ansible Automation Platform 2.6 for RHEL 9
  • Red Hat Build of Kueue
  • Red Hat Discovery 2
  • Red Hat Edge Manager 1.0
  • Red Hat Edge Manager 1.1
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat JBoss Enterprise Application Platform 8
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat Migration Toolkit 1.8
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift AI 2.25
  • Red Hat OpenShift AI 3.3
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Container Platform 4.17
  • Red Hat OpenShift Container Platform 4.18
  • Red Hat OpenShift Container Platform 4.19
  • Red Hat OpenShift Container Platform 4.20
  • Red Hat OpenShift Container Platform 4.21
  • Red Hat OpenShift Dev Spaces
  • Red Hat OpenShift Dev Spaces (RHOSDS) 3.26
  • Red Hat OpenShift GitOps
  • Red Hat OpenShift Service Mesh 3.2
  • Red Hat Openshift Data Foundation 4.17
  • Red Hat Openshift Data Foundation 4.18
  • Red Hat Openshift Data Foundation 4.19
  • Red Hat Openshift Data Foundation 4.20
  • Red Hat Satellite 6
  • Red Hat Trusted Artifact Signer 1.3
  • Red Hat build of Apache Camel - HawtIO 4
  • Red Hat build of OptaPlanner 8
  • multicluster engine for Kubernetes 2.10
  • multicluster engine for Kubernetes 2.6
  • multicluster engine for Kubernetes 2.7
  • multicluster engine for Kubernetes 2.8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-22029
  2. 2026-10-03 Alias added: GHSA-2w69-qvjg-hvjx
  3. 2026-10-16 Fix available: RHSA-2026:83622 · Red Hat
  4. 2026-10-16 Fix available: Red Hat Openshift Data Foundation 4.17 · Red Hat
  5. 2026-10-27 Affected versions changed · Red Hat

References

Advisory 2

Other 1

  • TI-2026-40200 React Router: Unauthenticated Denial of Service via Inefficient Route Matching CVSS 4.0HIGH 8.7
  • TI-2026-30645 React Router vulnerable to DoS via unbounded path expansion in __manifest endpoint CVSS 3.1HIGH 7.5
  • TI-2026-26400 React Router vulnerable to Denial of Service via reflected user input in single-fetch CVSS 3.1HIGH 7.5
  • TI-2026-17585 React Router SSR XSS in ScrollRestoration CVSS 3.1HIGH 8.2
  • TI-2026-30532 Deserialization of untrusted data in remix-run react-router CVSS 3.1HIGH 8.1
  • TI-2026-28995 Open redirect in remix-run react-router CVSS 4.0MEDIUM 6.6
See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences