Read the docs
TI-2026-29801 Aliases CVE-2026-41178GHSA-5wrp-cwcj-q835

OpenTelemetry-Go's baggage parsing no longer caps raw header length

Priority MEDIUM 63CWE-789Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · Low
Fix status
Partial Red Hat: 57 fixed, 35 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-789.

Summary

OpenTelemetry-Go is the Go implementation of OpenTelemetry. Versions 1.41.0 and 1.43.0 removed raw-length rejection and it causes `Parse` to process arbitrarily large/invalid baggage headers and log errors, enabling DoS via oversized inputs. Versions 1.42.0 and 1.44.0 fix the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00336 27th percentileScored 2026-11-07
Fix Partial go.opentelemetry.io/otel/baggage (Go): 1.42.0, 1.44.0go.opentelemetry.io/otel/propagation (Go): 1.42.0, 1.44.0Red Hat: 93 advisoriesRed Hat: 57 fixed, 35 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
open-telemetrygo.opentelemetry.io/otel/baggage= 1.41.0; = 1.43.0—No fix listedCNA
open-telemetrygo.opentelemetry.io/otel/propagation= 1.41.0; = 1.43.0—No fix listedCNA
—go.opentelemetry.io/otel/baggage (Go)1.41.0 to before 1.42.01.42.0Patch availableGHSA-5wrp-cwcj-q835
—go.opentelemetry.io/otel/propagation (Go)1.41.0 to before 1.42.01.42.0Patch availableGHSA-5wrp-cwcj-q835
—go.opentelemetry.io/otel/baggage (Go)1.43.0 to before 1.44.01.44.0Patch availableGHSA-5wrp-cwcj-q835
—go.opentelemetry.io/otel/propagation (Go)1.43.0 to before 1.44.01.44.0Patch availableGHSA-5wrp-cwcj-q835
  • go.opentelemetry.io/otel/baggage Vendoropen-telemetry Affected = 1.41.0; = 1.43.0 Fixed in — No fix listed CNA
  • go.opentelemetry.io/otel/propagation Vendoropen-telemetry Affected = 1.41.0; = 1.43.0 Fixed in — No fix listed CNA
  • go.opentelemetry.io/otel/baggage (Go) Vendor— Affected 1.41.0 to before 1.42.0 Fixed in 1.42.0 Patch available GHSA-5wrp-cwcj-q835
  • go.opentelemetry.io/otel/propagation (Go) Vendor— Affected 1.41.0 to before 1.42.0 Fixed in 1.42.0 Patch available GHSA-5wrp-cwcj-q835
  • go.opentelemetry.io/otel/baggage (Go) Vendor— Affected 1.43.0 to before 1.44.0 Fixed in 1.44.0 Patch available GHSA-5wrp-cwcj-q835
  • go.opentelemetry.io/otel/propagation (Go) Vendor— Affected 1.43.0 to before 1.44.0 Fixed in 1.44.0 Patch available GHSA-5wrp-cwcj-q835

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:opentelemetry:opentelemetry:*:*:*:*:*:go:*:*before 1.42.0Vulnerableopen-telemetry
cpe:2.3:a:opentelemetry:opentelemetry:1.43.0:*:*:*:*:go:*:*1.43.0Vulnerableopen-telemetry
  • cpe:2.3:a:opentelemetry:opentelemetry:*:*:*:*:*:go:*:* Versions before 1.42.0 Vulnerable ·open-telemetry
  • cpe:2.3:a:opentelemetry:opentelemetry:1.43.0:*:*:*:*:go:*:* Versions 1.43.0 Vulnerable ·open-telemetry

Remediation

  • Fix · GHSA-5wrp-cwcj-q835 go.opentelemetry.io/otel/baggage (Go) Fixed in 1.42.0 Advisory →
  • Fix · GHSA-5wrp-cwcj-q835 go.opentelemetry.io/otel/propagation (Go) Fixed in 1.42.0 Advisory →
  • Fix · GHSA-5wrp-cwcj-q835 go.opentelemetry.io/otel/baggage (Go) Fixed in 1.44.0 Advisory →
  • Fix · GHSA-5wrp-cwcj-q835 go.opentelemetry.io/otel/propagation (Go) Fixed in 1.44.0 Advisory →

Red Hat 93 advisories

  • RHSA-2026:94498 Released 2026-11-03 · Red Hat rating Important
    Red Hat OpenShift API for Data Protection - 1.4.12
    • OpenShift API for Data Protection 1.4 registry.redhat.io/oadp/oadp-cli-binaries-rhel9, registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9, registry.redhat.io/oadp/oadp-mustgather-rhel9 +8
  • RHSA-2026:92593 Released 2026-10-29 · Red Hat rating Important
    Logging for Red Hat OpenShift - 6.6.2
    • Logging Subsystem for Red Hat OpenShift 6.6 registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator, registry.redhat.io/openshift-logging/logging-loki-rhel9, registry.redhat.io/openshift-logging/loki-rhel9-operator +2
  • RHSA-2026:92515 Released 2026-10-29 · Red Hat rating Important
    Logging for Red Hat OpenShift - 6.6.2
    • Logging Subsystem for Red Hat OpenShift 6.6 registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator, registry.redhat.io/openshift-logging/logging-loki-rhel9, registry.redhat.io/openshift-logging/loki-rhel9-operator +2
Show 90 more Red Hat advisories
  • RHSA-2026:92510 Released 2026-10-29 · Red Hat rating Critical
    RHOAI 3.4.6 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-cli-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9 +47
  • RHSA-2026:91958 Released 2026-10-28 · Red Hat rating Important
    osbuild-composer security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.4) osbuild-composer-101.3-4.el9_4.7, osbuild-composer-core-101.3-4.el9_4.7, osbuild-composer-worker-101.3-4.el9_4.7
  • RHSA-2026:90321 Released 2026-10-26 · Red Hat rating Critical
    Red Hat OpenShift Dev Spaces 3.31.0 Release.
    • Red Hat OpenShift Dev Spaces 3.31 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/dashboard-rhel9, registry.redhat.io/devspaces/jetbrains-ide-rhel9 +8
  • RHSA-2026:87410 Released 2026-10-21 · Red Hat rating Critical
    RHOAI 2.25.12 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-caikit-nlp-rhel9, registry.redhat.io/rhoai/odh-codeflare-operator-rhel9 +47
  • RHSA-2026:85247 Released 2026-10-19 · Red Hat rating Important
    DevWorkspace Operator 1.0.0 release.
    • DevWorkspace Operator 1.0 registry.redhat.io/devworkspace/devworkspace-rhel9-operator
  • RHSA-2026:84734 Released 2026-10-19 · Red Hat rating Critical
    RHOAI 3.4.5 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-ai-gateway-payload-processing-rhel9, registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9 +47
  • RHSA-2026:83601 Released 2026-10-15 · Red Hat rating Important
    RHTAS 1.4.4 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.4 registry.redhat.io/rhtas/ctlog-monitor-rhel9, registry.redhat.io/rhtas/rekor-monitor-rhel9
  • RHSA-2026:83598 Released 2026-10-15 · Red Hat rating Important
    RHTAS 1.4.4 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.4 registry.redhat.io/rhtas/certificate-transparency-rhel9, registry.redhat.io/rhtas/fulcio-rhel9, registry.redhat.io/rhtas/rekor-backfill-redis-rhel9 +6
  • RHSA-2026:83597 Released 2026-10-15 · Red Hat rating Important
    RHTAS 1.4.4 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.4 registry.redhat.io/rhtas/cosign-rhel9, registry.redhat.io/rhtas/fetch-tsa-certs-rhel9, registry.redhat.io/rhtas/gitsign-rhel9 +2
  • RHSA-2026:83596 Released 2026-10-15 · Red Hat rating Important
    RHTAS 1.4.4 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.4 registry.redhat.io/rhtas/createtree-rhel9
  • RHSA-2026:83593 Released 2026-10-15 · Red Hat rating Important
    RHTAS 1.0.3 - GA Release Of the Policy Controller Operator
    • Red Hat Trusted Artifact Signer 1.4 registry.redhat.io/rhtas/policy-controller-rhel9
  • RHSA-2026:83013 Released 2026-10-14 · Red Hat rating Important
    Logging for Red Hat OpenShift - 6.0.17
    • Logging Subsystem for Red Hat OpenShift 6.0 registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator, registry.redhat.io/openshift-logging/eventrouter-rhel9, registry.redhat.io/openshift-logging/logging-loki-rhel9 +3
  • RHSA-2026:82315 Released 2026-10-13 · Red Hat rating Important
    Migration Toolkit for Applications
    • Red Hat Migration Toolkit for Applications 8.2 registry.redhat.io/mta/mta-cli-rhel9, registry.redhat.io/mta/mta-hub-rhel9
  • RHSA-2026:77639 Released 2026-10-07 · Red Hat rating Important
    Logging for Red Hat OpenShift - 6.4.7
    • Logging Subsystem for Red Hat OpenShift 6.4 registry.redhat.io/openshift-logging/logging-loki-rhel9, registry.redhat.io/openshift-logging/loki-rhel9-operator, registry.redhat.io/openshift-logging/lokistack-gateway-rhel9 +1
  • RHSA-2026:77269 Released 2026-10-07 · Red Hat rating Important
    Red Hat OpenShift GitOps v1.21.5 security update
    • Red Hat OpenShift GitOps 1.21 registry.redhat.io/openshift-gitops-1/argocd-rhel9, registry.redhat.io/openshift-gitops-1/dex-rhel9, registry.redhat.io/openshift-gitops-1/gitops-rhel9-operator
  • RHSA-2026:76752 Released 2026-10-06 · Red Hat rating Important
    OpenShift Security Profiles Operator bug fix and enhancement update
    • OpenShift Security Profiles Operator 1 registry.redhat.io/compliance/openshift-security-profiles-operator-bundle, registry.redhat.io/compliance/openshift-security-profiles-rhel8-operator, registry.redhat.io/compliance/openshift-selinuxd-rhel8
  • RHSA-2026:74609 Released 2026-10-01 · Red Hat rating Important
    Cluster Observability Operator 1.5.3
    • Cluster Observability Operator 1.5 registry.redhat.io/cluster-observability-operator/alertmanager-rhel9, registry.redhat.io/cluster-observability-operator/cluster-observability-rhel9-operator, registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9 +13
  • RHSA-2026:73538 Released 2026-09-29 · Red Hat rating Important
    Red Hat Lightspeed (formerly Insights) for Runtimes security update
    • Red Hat Lightspeed (formerly Insights) for Runtimes 1.0 registry.redhat.io/rh-lightspeed-runtimes/runtimes-inventory-rhel9-operator
  • RHSA-2026:73531 Released 2026-09-29 · Red Hat rating Important
    Migration Toolkit for Applications
    • Red Hat Migration Toolkit for Applications 8.3 registry.redhat.io/mta/mta-analyzer-addon-rhel9, registry.redhat.io/mta/mta-go-external-provider-rhel9, registry.redhat.io/mta/mta-nodejs-external-provider-rhel9 +1
  • RHSA-2026:73419 Released 2026-09-29 · Red Hat rating Important
    Multicluster Global Hub 1.6.6 security update
    • Multicluster Global Hub 1.6.6 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9 +2
  • RHSA-2026:71454 Released 2026-09-29 · Red Hat rating Important
    OpenShift Container Platform 4.22.16 bug fix and security update
    • Red Hat OpenShift Container Platform 4.22 registry.redhat.io/openshift4/aws-node-termination-handler-rhel9, registry.redhat.io/openshift4/ose-agent-installer-ui-rhel9, registry.redhat.io/openshift4/ose-cluster-cloud-controller-manager-rhel9-operator +8
  • RHSA-2026:73038 Released 2026-09-29 · Red Hat rating Important
    Multicluster Global Hub 1.8.2 security update
    • Multicluster Global Hub 1.8.2 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9 +2
  • RHSA-2026:72892 Released 2026-09-28 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.16.6 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.16 registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9, registry.redhat.io/rhacm2/acm-prometheus-rhel9 +10
  • RHSA-2026:72885 Released 2026-09-28 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.13.13 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.13 registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/endpoint-monitoring-rhel9-operator, registry.redhat.io/rhacm2/grafana-dashboard-loader-rhel9 +2
  • RHSA-2026:72884 Released 2026-09-28 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.15.8 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.15 registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9, registry.redhat.io/rhacm2/acm-prometheus-config-reloader-rhel9 +17
  • RHSA-2026:72882 Released 2026-09-28 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.11.13 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.11 registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-prometheus-config-reloader-rhel9, registry.redhat.io/rhacm2/thanos-rhel9
  • RHSA-2026:72881 Released 2026-09-28 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.14.6 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.14 registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9, registry.redhat.io/rhacm2/acm-prometheus-rhel9 +3
  • RHSA-2026:72879 Released 2026-09-28 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.17.3 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.17 registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9, registry.redhat.io/rhacm2/acm-prometheus-config-reloader-rhel9 +7
  • RHSA-2026:72854 Released 2026-09-28 · Red Hat rating Important
    multicluster engine for Kubernetes v2.8.11 security update
    • multicluster engine for Kubernetes 2.8 registry.redhat.io/multicluster-engine/addon-manager-rhel9, registry.redhat.io/multicluster-engine/backplane-rhel9-operator, registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9 +8
  • RHSA-2026:72853 Released 2026-09-28 · Red Hat rating Important
    multicluster engine for Kubernetes v2.10.7 security update
    • multicluster engine for Kubernetes 2.10 registry.redhat.io/multicluster-engine/addon-manager-rhel9, registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9, registry.redhat.io/multicluster-engine/discovery-rhel9 +7
  • RHSA-2026:72851 Released 2026-09-28 · Red Hat rating Important
    multicluster engine for Kubernetes v2.9.8 security update
    • multicluster engine for Kubernetes 2.9 registry.redhat.io/multicluster-engine/addon-manager-rhel9, registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9, registry.redhat.io/multicluster-engine/console-mce-rhel9 +7
  • RHSA-2026:72850 Released 2026-09-28 · Red Hat rating Important
    multicluster engine for Kubernetes v2.6.15 security update
    • multicluster engine for Kubernetes 2.6 registry.redhat.io/multicluster-engine/addon-manager-rhel9, registry.redhat.io/multicluster-engine/backplane-rhel9-operator, registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9 +7
  • RHSA-2026:72849 Released 2026-09-28 · Red Hat rating Important
    multicluster engine for Kubernetes v2.17.3 security update
    • multicluster engine for Kubernetes 2.17 registry.redhat.io/multicluster-engine/addon-manager-rhel9, registry.redhat.io/multicluster-engine/cloudevents-conductor-rhel9, registry.redhat.io/multicluster-engine/console-mce-rhel9 +7
  • RHSA-2026:72848 Released 2026-09-28 · Red Hat rating Important
    multicluster engine for Kubernetes v2.11.7 security update
    • multicluster engine for Kubernetes 2.11 registry.redhat.io/multicluster-engine/addon-manager-rhel9, registry.redhat.io/multicluster-engine/azure-service-operator-rhel9, registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9 +7
  • RHSA-2026:71597 Released 2026-09-24 · Red Hat rating Important
    Multicluster Global Hub 1.5.8 security update
    • Multicluster Global Hub 1.5.8 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9 +2
  • RHSA-2026:70870 Released 2026-09-23 · Red Hat rating Important
    Logging for Red Hat OpenShift - 6.5.3
    • Logging Subsystem for Red Hat OpenShift 6.5 registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator, registry.redhat.io/openshift-logging/eventrouter-rhel9, registry.redhat.io/openshift-logging/logging-loki-rhel9 +3
  • RHSA-2026:70829 Released 2026-09-23 · Red Hat rating Important
    RHTAS 1.3.8 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.3 registry.redhat.io/rhtas/certificate-transparency-rhel9, registry.redhat.io/rhtas/fulcio-rhel9, registry.redhat.io/rhtas/rekor-backfill-redis-rhel9 +6
  • RHSA-2026:70828 Released 2026-09-23 · Red Hat rating Important
    RHTAS 1.3.8 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.3 registry.redhat.io/rhtas/cosign-rhel9, registry.redhat.io/rhtas/fetch-tsa-certs-rhel9, registry.redhat.io/rhtas/gitsign-rhel9 +2
  • RHSA-2026:70826 Released 2026-09-23 · Red Hat rating Important
    RHTAS 1.3.8 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.3 registry.redhat.io/rhtas/createtree-rhel9
  • RHSA-2026:70824 Released 2026-09-23 · Red Hat rating Important
    RHTAS 1.3.8 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.3 registry.redhat.io/rhtas/rekor-monitor-rhel9
  • RHSA-2026:68550 Released 2026-09-22 · Red Hat rating Important
    OpenShift Container Platform 4.22.15 packages and security update
    • Red Hat OpenShift Container Platform 4.22 openshift-4.22.0-202609141614.p2.g160626b.assembly.stream.el8, openshift-4.22.0-202609141614.p2.g160626b.assembly.stream.el9, openshift-hyperkube-4.22.0-202609141614.p2.g160626b.assembly.stream.el8 +5
  • RHSA-2026:69945 Released 2026-09-22 · Red Hat rating Important
    Red Hat OpenShift Builds 1.8.2
    • Red Hat OpenShift Builds 1.8.3 registry.redhat.io/openshift-builds/openshift-builds-controller-rhel9, registry.redhat.io/openshift-builds/openshift-builds-git-cloner-rhel9, registry.redhat.io/openshift-builds/openshift-builds-image-bundler-rhel9 +4
  • RHSA-2026:69928 Released 2026-09-22 · Red Hat rating Important
    Red Hat OpenShift Builds 1.8.2
    • Red Hat OpenShift Builds 1.8.3 registry.redhat.io/openshift-builds/openshift-builds-controller-rhel9, registry.redhat.io/openshift-builds/openshift-builds-git-cloner-rhel9, registry.redhat.io/openshift-builds/openshift-builds-image-bundler-rhel9 +4
  • RHSA-2026:69917 Released 2026-09-22 · Red Hat rating Important
    OpenShift Source To Image 1.6.4
    • OpenShift Developer Tools and Services 1.6.4 registry.redhat.io/source-to-image/source-to-image-rhel8, registry.redhat.io/source-to-image/source-to-image-rhel9
  • RHSA-2026:68552 Released 2026-09-22 · Red Hat rating Important
    OpenShift Container Platform 4.22.15 bug fix and security update
    • Red Hat OpenShift Container Platform 4.22 registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9, registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/aws-node-termination-handler-rhel9 +47
  • RHSA-2026:69293 Released 2026-09-21 · Red Hat rating Important
    osbuild-composer security update
    • Red Hat Enterprise Linux AppStream (v. 9) osbuild-composer-165.1-5.el9_8, osbuild-composer-core-165.1-5.el9_8, osbuild-composer-worker-165.1-5.el9_8
  • RHSA-2026:68527 Released 2026-09-17 · Red Hat rating Important
    opentelemetry-collector security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.4) opentelemetry-collector-0.152.1-2.el9_4
  • RHSA-2026:68515 Released 2026-09-17 · Red Hat rating Important
    Multicluster Global Hub 1.8.2 security update
    • Multicluster Global Hub 1.8.2 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9 +2
  • RHSA-2026:68334 Released 2026-09-16 · Red Hat rating Important
    Red Hat Edge Manager Version 1.1.4 Security Update
    • RHEM 1.1 for RHEL 10 flightctl-1.1.4-1.el10em, flightctl-agent-1.1.4-1.el10em, flightctl-cli-1.1.4-1.el10em
    • RHEM 1.1 for RHEL 9 flightctl-1.1.4-1.el9em, flightctl-agent-1.1.4-1.el9em, flightctl-cli-1.1.4-1.el9em
  • RHSA-2026:68335 Released 2026-09-16 · Red Hat rating Important
    Red Hat Edge Manager Version 1.2.1 Security Update
    • RHEM 1.2 for RHEL 10 flightctl-1.2.1-1.el10, flightctl-agent-1.2.1-1.el10, flightctl-cli-1.2.1-1.el10
    • RHEM 1.2 for RHEL 9 flightctl-1.2.1-1.el9, flightctl-agent-1.2.1-1.el9, flightctl-cli-1.2.1-1.el9
  • RHSA-2026:68349 Released 2026-09-16 · Red Hat rating Important
    Logging for Red Hat OpenShift - 6.2.13
    • Logging Subsystem for Red Hat OpenShift 6.2 registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator, registry.redhat.io/openshift-logging/eventrouter-rhel9, registry.redhat.io/openshift-logging/loki-rhel9-operator +2
  • RHSA-2026:68333 Released 2026-09-16 · Red Hat rating Important
    Red Hat build of Cryostat security update
    • Cryostat 4 on RHEL 9 cryostat/cryostat-agent-init-rhel9, cryostat/cryostat-grafana-dashboard-rhel9, cryostat/cryostat-openshift-console-plugin-rhel9 +5
  • RHSA-2026:68254 Released 2026-09-16 · Red Hat rating Important
    Red Hat Edge Manager Version 1.2.1 Security Update
    • Red Hat Edge Manager 1.2 registry.redhat.io/rhem/flightctl-alert-exporter-rhel9, registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel9, registry.redhat.io/rhem/flightctl-api-rhel9 +11
  • RHSA-2026:68253 Released 2026-09-16 · Red Hat rating Important
    Red Hat Edge Manager Version 1.1.4 Security Update
    • Red Hat Edge Manager 1.1 registry.redhat.io/rhem/flightctl-alert-exporter-rhel9, registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel9, registry.redhat.io/rhem/flightctl-api-rhel9 +10
  • RHSA-2026:67975 Released 2026-09-16 · Red Hat rating Important
    opentelemetry-collector security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) opentelemetry-collector-0.152.1-2.el9_6
  • RHSA-2026:67974 Released 2026-09-16 · Red Hat rating Important
    opentelemetry-collector security update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) opentelemetry-collector-0.152.1-2.el10_0
  • RHSA-2026:68044 Released 2026-09-16 · Red Hat rating Important
    Red Hat Edge Manager Version 1.1.4 Security Update
    • Red Hat Edge Manager 1.1 registry.redhat.io/rhem/flightctl-alert-exporter-rhel10, registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10, registry.redhat.io/rhem/flightctl-api-rhel10 +11
  • RHSA-2026:68006 Released 2026-09-16 · Red Hat rating Important
    Red Hat Edge Manager Version 1.2.1 Security Update
    • Red Hat Edge Manager 1.2 registry.redhat.io/rhem/flightctl-alert-exporter-rhel10, registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10, registry.redhat.io/rhem/flightctl-api-rhel10 +11
  • RHSA-2026:67543 Released 2026-09-15 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.17.2 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.17 registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9, registry.redhat.io/rhacm2/console-rhel9, registry.redhat.io/rhacm2/grafana-dashboard-loader-rhel9 +3
  • RHSA-2026:67542 Released 2026-09-15 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.16.5 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.16 registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9, registry.redhat.io/rhacm2/acm-prometheus-config-reloader-rhel9 +5
  • RHSA-2026:67541 Released 2026-09-15 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.15.7 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.15 registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9, registry.redhat.io/rhacm2/acm-prometheus-config-reloader-rhel9 +9
  • RHSA-2026:67540 Released 2026-09-15 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.13.12 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.13 registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9, registry.redhat.io/rhacm2/acm-prometheus-config-reloader-rhel9 +5
  • RHSA-2026:67539 Released 2026-09-15 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.14.5 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.14 registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9, registry.redhat.io/rhacm2/acm-prometheus-config-reloader-rhel9 +7
  • RHSA-2026:67538 Released 2026-09-15 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.11.12 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.11 registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/console-rhel9, registry.redhat.io/rhacm2/grafana-dashboard-loader-rhel9 +8
  • RHSA-2026:66358 Released 2026-09-15 · Red Hat rating Important
    OpenShift Container Platform 4.22.14 bug fix and security update
    • Red Hat OpenShift Container Platform 4.22 registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9, registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/aws-node-termination-handler-rhel9 +47
  • RHSA-2026:67516 Released 2026-09-15 · Red Hat rating Important
    Multicluster Global Hub 1.4.9 security update
    • Multicluster Global Hub 1.4.9 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9 +2
  • RHSA-2026:67138 Released 2026-09-14 · Red Hat rating Important
    image-builder security update
    • Red Hat Enterprise Linux AppStream (v. 9) image-builder-52.1-2.el9_8
  • RHSA-2026:67148 Released 2026-09-14 · Red Hat rating Important
    osbuild-composer security update
    • Red Hat Enterprise Linux AppStream (v. 8) osbuild-composer-101.5-3.el8_10, osbuild-composer-core-101.5-3.el8_10, osbuild-composer-worker-101.5-3.el8_10
  • RHSA-2026:67139 Released 2026-09-14 · Red Hat rating Important
    image-builder security update
    • Red Hat Enterprise Linux AppStream (v. 10) image-builder-52.1-2.el10_2
  • RHSA-2026:66432 Released 2026-09-11 · Red Hat rating Important
    osbuild-composer security update
    • Red Hat Enterprise Linux AppStream (v. 10) osbuild-composer-165.1-5.el10_2, osbuild-composer-core-165.1-5.el10_2, osbuild-composer-worker-165.1-5.el10_2
  • RHSA-2026:66521 Released 2026-09-10 · Red Hat rating Important
    Logging for Red Hat OpenShift - 6.6.1
    • Logging Subsystem for Red Hat OpenShift 6.6 registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator, registry.redhat.io/openshift-logging/eventrouter-rhel9, registry.redhat.io/openshift-logging/lokistack-gateway-rhel9 +1
  • RHSA-2026:66363 Released 2026-09-10 · Red Hat rating Important
    external secrets operator for Red Hat OpenShift 1.2.1
    • external secrets operator for Red Hat OpenShift 1.2 registry.redhat.io/external-secrets-operator/external-secrets-rhel9
  • RHSA-2026:66327 Released 2026-09-10 · Red Hat rating Important
    osbuild-composer security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) osbuild-composer-134.1-12.el10_0, osbuild-composer-core-134.1-12.el10_0, osbuild-composer-worker-134.1-12.el10_0
  • RHSA-2026:66022 Released 2026-09-09 · Red Hat rating Important
    Red Hat OpenShift API for Data Protection
    • OpenShift API for Data Protection 1.5 registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9, registry.redhat.io/oadp/oadp-mustgather-rhel9, registry.redhat.io/oadp/oadp-rhel9-operator +4
  • RHSA-2026:65336 Released 2026-09-08 · Red Hat rating Important
    ignition security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) ignition-2.21.0-7.el9_6.1, ignition-edge-2.21.0-7.el9_6.1, ignition-grub-2.21.0-7.el9_6.1 +1
  • RHSA-2026:65117 Released 2026-09-08 · Red Hat rating Important
    opentelemetry-collector security update
    • Red Hat Enterprise Linux AppStream (v. 9) opentelemetry-collector-0.152.1-2.el9_8
  • RHSA-2026:65343 Released 2026-09-08 · Red Hat rating Important
    Red Hat OpenShift distributed tracing platform (Tempo) 3.11.0 release
    • Red Hat OpenShift distributed tracing 3.11 registry.redhat.io/rhosdt/tempo-gateway-rhel9, registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9, registry.redhat.io/rhosdt/tempo-query-rhel9 +2
  • RHSA-2026:65116 Released 2026-09-08 · Red Hat rating Important
    opentelemetry-collector security update
    • Red Hat Enterprise Linux AppStream (v. 10) opentelemetry-collector-0.152.1-2.el10_2
  • RHSA-2026:65130 Released 2026-09-08 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.22.3 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.22 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/devicefinder-rhel9 +25
  • RHSA-2026:65126 Released 2026-09-08 · Red Hat rating Important
    RHOAI 2.25.11 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-caikit-tgis-serving-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9 +47
  • RHSA-2026:63016 Released 2026-09-03 · Red Hat rating Important
    Submariner v0.24 security fixes and container updates
    • Red Hat Advanced Cluster Management for Kubernetes 2.17 registry.redhat.io/rhacm2/lighthouse-agent-rhel9, registry.redhat.io/rhacm2/lighthouse-coredns-rhel9, registry.redhat.io/rhacm2/subctl-rhel9 +4
  • RHSA-2026:62851 Released 2026-09-02 · Red Hat rating Important
    Red Hat Developer Hub 1.10.4 release.
    • Red Hat Developer Hub 1.10 registry.redhat.io/rhdh/rhdh-hub-rhel9, registry.redhat.io/rhdh/rhdh-rhel9-operator
  • RHSA-2026:61314 Released 2026-08-31 · Red Hat rating Important
    Cluster Observability Operator 1.5.2
    • Cluster Observability Operator 1.5 registry.redhat.io/cluster-observability-operator/alertmanager-rhel9, registry.redhat.io/cluster-observability-operator/cluster-health-analyzer-rhel9, registry.redhat.io/cluster-observability-operator/cluster-observability-rhel9-operator +10
  • RHSA-2026:60391 Released 2026-08-26 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.16.4 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.16 registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9, registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9 +19
  • RHSA-2026:60390 Released 2026-08-26 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.13.11 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.13 registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9, registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9 +23
  • RHSA-2026:60388 Released 2026-08-26 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.14.4 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.14 registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9, registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9 +26
  • RHSA-2026:60389 Released 2026-08-26 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.15.6 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.15 registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9, registry.redhat.io/rhacm2/acm-must-gather-rhel9 +19
  • RHSA-2026:60387 Released 2026-08-26 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.11.11 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.11 registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9, registry.redhat.io/rhacm2/acm-must-gather-rhel9, registry.redhat.io/rhacm2/acm-prometheus-config-reloader-rhel9 +24
  • RHSA-2026:59583 Released 2026-08-25 · Red Hat rating Important
    Kiali 2.27.3 for Red Hat OpenShift Service Mesh 3.4
    • Red Hat OpenShift Service Mesh 3.4 registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9, registry.redhat.io/openshift-service-mesh/kiali-rhel9
  • RHSA-2026:54773 Released 2026-08-13 · Red Hat rating Important
    Red Hat build of OpenTelemetry 3.10.2 release
    • Red Hat OpenShift distributed tracing 3.10.1 registry.redhat.io/rhosdt/opentelemetry-collector-rhel9, registry.redhat.io/rhosdt/opentelemetry-rhel9-operator

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Assisted Installer for Red Hat OpenShift Container Platform 2AffectedNo fix yet
Confidential Compute AttestationAffectedNo fix yet
Cryostat 4AffectedNo fix yet
File Integrity OperatorAffectedNo fix yet
Migration Toolkit for Applications 8AffectedNo fix yet
Multicluster Engine for KubernetesAffectedNo fix yet
OpenShift LightspeedAffectedNo fix yet
OpenShift PipelinesAffectedNo fix yet
OpenShift ServerlessAffectedNo fix yet
OpenShift Service Mesh 3AffectedNo fix yet
Power monitoring for Red Hat OpenShiftAffectedNo fix yet
Red Hat Advanced Cluster Management for Kubernetes 2AffectedNo fix yet
Red Hat Advanced Cluster Security 4AffectedNo fix planned: Will not fix
Red Hat Ceph Storage 5AffectedNo fix yet: Fix deferred
Red Hat Ceph Storage 6AffectedNo fix yet: Fix deferred
Red Hat Ceph Storage 7AffectedNo fix yet: Fix deferred
Red Hat Ceph Storage 8AffectedNo fix yet: Fix deferred
Red Hat Ceph Storage 9AffectedNo fix yet: Fix deferred
Red Hat Certification Program for Red Hat Enterprise Linux 9AffectedNo fix yet
Red Hat Connectivity Link 1AffectedNo fix yet
Red Hat Enterprise Linux 10AffectedNo fix yet
Red Hat Enterprise Linux 9AffectedNo fix yet
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet
Red Hat OpenShift Cluster Manager CLIAffectedNo fix yet
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Red Hat OpenShift Container Platform 5AffectedNo fix yet
Red Hat OpenShift Dev SpacesAffectedNo fix yet
Red Hat OpenShift Dev Workspaces OperatorAffectedNo fix yet
Red Hat OpenShift GitOpsAffectedNo fix yet
Red Hat OpenShift distributed tracing 3AffectedNo fix yet
Red Hat OpenShift for Windows ContainersAffectedNo fix yet
Red Hat OpenStack Platform 18.0AffectedNo fix yet
Red Hat Trusted Artifact SignerAffectedNo fix yet
Zero Trust Workload Identity Manager - Tech PreviewAffectedNo fix planned: Will not fix
cert-manager Operator for Red Hat OpenShiftAffectedNo fix yet
Cluster Observability Operator 1.5Fixed RHSA-2026:61314, RHSA-2026:74609
Cryostat 4 on RHEL 9Fixed RHSA-2026:68333
DevWorkspace Operator 1.0Fixed RHSA-2026:85247
Logging Subsystem for Red Hat OpenShift 6.0Fixed RHSA-2026:83013
Logging Subsystem for Red Hat OpenShift 6.2Fixed RHSA-2026:68349
Logging Subsystem for Red Hat OpenShift 6.4Fixed RHSA-2026:77639
Logging Subsystem for Red Hat OpenShift 6.5Fixed RHSA-2026:70870
Logging Subsystem for Red Hat OpenShift 6.6Fixed RHSA-2026:66521, RHSA-2026:92515
Multicluster Global Hub 1.4.9Fixed RHSA-2026:67516
Multicluster Global Hub 1.5.8Fixed RHSA-2026:71597
Multicluster Global Hub 1.6.6Fixed RHSA-2026:73419
Multicluster Global Hub 1.8.2Fixed RHSA-2026:68515, RHSA-2026:73038
OpenShift API for Data Protection 1.4Fixed RHSA-2026:94498
OpenShift API for Data Protection 1.5Fixed RHSA-2026:66022
OpenShift Developer Tools and Services 1.6.4Fixed RHSA-2026:69917
OpenShift Security Profiles Operator 1Fixed RHSA-2026:76752
RHEM 1.1 for RHEL 10Fixed RHSA-2026:68334
RHEM 1.1 for RHEL 9Fixed RHSA-2026:68334
RHEM 1.2 for RHEL 10Fixed RHSA-2026:68335
RHEM 1.2 for RHEL 9Fixed RHSA-2026:68335
Red Hat Advanced Cluster Management for Kubernetes 2.11Fixed RHSA-2026:60387, RHSA-2026:67538, RHSA-2026:72882
Red Hat Advanced Cluster Management for Kubernetes 2.13Fixed RHSA-2026:60390, RHSA-2026:67540, RHSA-2026:72885
Red Hat Advanced Cluster Management for Kubernetes 2.14Fixed RHSA-2026:60388, RHSA-2026:67539, RHSA-2026:72881
Red Hat Advanced Cluster Management for Kubernetes 2.15Fixed RHSA-2026:60389, RHSA-2026:67541, RHSA-2026:72884
Red Hat Advanced Cluster Management for Kubernetes 2.16Fixed RHSA-2026:60391, RHSA-2026:67542, RHSA-2026:72892
Red Hat Advanced Cluster Management for Kubernetes 2.17Fixed RHSA-2026:63016, RHSA-2026:67543, RHSA-2026:72879
Red Hat Developer Hub 1.10Fixed RHSA-2026:62851
Red Hat Edge Manager 1.1Fixed RHSA-2026:68044, RHSA-2026:68253
Red Hat Edge Manager 1.2Fixed RHSA-2026:68006, RHSA-2026:68254
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:65116, RHSA-2026:66432, RHSA-2026:67139
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2026:67148
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:65117, RHSA-2026:67138, RHSA-2026:69293
Red Hat Enterprise Linux AppStream E4S (v.9.4)Fixed RHSA-2026:68527, RHSA-2026:91958
Red Hat Enterprise Linux AppStream EUS (v. 10.0)Fixed RHSA-2026:66327, RHSA-2026:67974
Red Hat Enterprise Linux AppStream EUS (v.9.6)Fixed RHSA-2026:65336, RHSA-2026:67975
Red Hat Lightspeed (formerly Insights) for Runtimes 1.0Fixed RHSA-2026:73538
Red Hat Migration Toolkit for Applications 8.2Fixed RHSA-2026:82315
Red Hat Migration Toolkit for Applications 8.3Fixed RHSA-2026:73531
Red Hat OpenShift AI 2.25Fixed RHSA-2026:65126, RHSA-2026:87410
Red Hat OpenShift AI 3.4Fixed RHSA-2026:84734, RHSA-2026:92510
Red Hat OpenShift Builds 1.8.3Fixed RHSA-2026:69945
Red Hat OpenShift Container Platform 4.22Fixed RHSA-2026:66358, RHSA-2026:68550, RHSA-2026:68552, RHSA-2026:71454
Red Hat OpenShift Dev Spaces 3.31Fixed RHSA-2026:90321
Red Hat OpenShift GitOps 1.21Fixed RHSA-2026:77269
Red Hat OpenShift Service Mesh 3.4Fixed RHSA-2026:59583
Red Hat OpenShift distributed tracing 3.10.1Fixed RHSA-2026:54773
Red Hat OpenShift distributed tracing 3.11Fixed RHSA-2026:65343
Red Hat Openshift Data Foundation 4.22Fixed RHSA-2026:65130
Red Hat Trusted Artifact Signer 1.3Fixed RHSA-2026:70824, RHSA-2026:70826, RHSA-2026:70828, RHSA-2026:70829
Red Hat Trusted Artifact Signer 1.4Fixed RHSA-2026:83593, RHSA-2026:83596, RHSA-2026:83597, RHSA-2026:83598, RHSA-2026:83601
external secrets operator for Red Hat OpenShift 1.2Fixed RHSA-2026:66363
multicluster engine for Kubernetes 2.10Fixed RHSA-2026:72853
multicluster engine for Kubernetes 2.11Fixed RHSA-2026:72848
multicluster engine for Kubernetes 2.17Fixed RHSA-2026:72849
multicluster engine for Kubernetes 2.6Fixed RHSA-2026:72850
multicluster engine for Kubernetes 2.8Fixed RHSA-2026:72854
multicluster engine for Kubernetes 2.9Fixed RHSA-2026:72851
Not affected: 78 products
  • Assisted Installer for Red Hat OpenShift Container Platform 2
  • Cluster Observability Operator 1.5
  • Confidential Compute Attestation
  • Cryostat 4
  • Cryostat 4 on RHEL 9
  • Custom Metric Autoscaler operator for Red Hat Openshift
  • DevWorkspace Operator 1.0
  • ExternalDNS Operator
  • File Integrity Operator
  • Logging Subsystem for Red Hat OpenShift 6.0
  • Logging Subsystem for Red Hat OpenShift 6.2
  • Logging Subsystem for Red Hat OpenShift 6.4
  • Logging Subsystem for Red Hat OpenShift 6.5
  • Logging Subsystem for Red Hat OpenShift 6.6
  • Logical Volume Manager Storage
  • Migration Toolkit for Applications 8
  • Migration Toolkit for Containers
  • Multiarch Tuning Operator
  • Multicluster Engine for Kubernetes
  • Multicluster Global Hub 1.4.9
  • Multicluster Global Hub 1.5.8
  • Multicluster Global Hub 1.6.6
  • Multicluster Global Hub 1.8.2
  • Network Observability Operator
  • OpenShift API for Data Protection 1.4
  • OpenShift API for Data Protection 1.5
  • OpenShift Developer Tools and Services
  • OpenShift Security Profiles Operator 1
  • OpenShift Service Mesh 3
  • RHEM 1.1 for RHEL 10
  • RHEM 1.1 for RHEL 9
  • RHEM 1.2 for RHEL 10
  • RHEM 1.2 for RHEL 9
  • Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Advanced Cluster Management for Kubernetes 2.11
  • Red Hat Advanced Cluster Management for Kubernetes 2.13
  • Red Hat Advanced Cluster Management for Kubernetes 2.14
  • Red Hat Advanced Cluster Management for Kubernetes 2.15
  • Red Hat Advanced Cluster Management for Kubernetes 2.16
  • Red Hat Advanced Cluster Management for Kubernetes 2.17
  • Red Hat Developer Hub 1.10
  • Red Hat Edge Manager 1.1
  • Red Hat Edge Manager 1.2
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat Lightspeed (formerly Insights) for Runtimes 1.0
  • Red Hat Migration Toolkit for Applications 8.2
  • Red Hat Migration Toolkit for Applications 8.3
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift AI 2.25
  • Red Hat OpenShift AI 3.4
  • Red Hat OpenShift Builds 1.8.3
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Container Platform 4.22
  • Red Hat OpenShift Container Platform 5
  • Red Hat OpenShift Dev Spaces
  • Red Hat OpenShift Dev Spaces 3.31
  • Red Hat OpenShift GitOps
  • Red Hat OpenShift GitOps 1.21
  • Red Hat OpenShift Service Mesh 3.4
  • Red Hat OpenShift Virtualization 4
  • Red Hat OpenShift distributed tracing 3.10.1
  • Red Hat OpenShift distributed tracing 3.11
  • Red Hat OpenStack Platform 16.2
  • Red Hat OpenStack Platform 17.1
  • Red Hat OpenStack Platform 18.0
  • Red Hat Openshift Data Foundation 4.22
  • Red Hat Quay 3
  • Red Hat Trusted Artifact Signer 1.3
  • Red Hat Trusted Artifact Signer 1.4
  • Zero Trust Workload Identity Manager
  • multicluster engine for Kubernetes 2.10
  • multicluster engine for Kubernetes 2.11
  • multicluster engine for Kubernetes 2.17
  • multicluster engine for Kubernetes 2.6
  • multicluster engine for Kubernetes 2.8
  • multicluster engine for Kubernetes 2.9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-41178
  2. 2026-10-03 Alias added: GHSA-5wrp-cwcj-q835
  3. 2026-10-07 Fix available: RHSA-2026:77269 · Red Hat
  4. 2026-10-07 Fix available: Red Hat OpenShift GitOps 1.21 · Red Hat
  5. 2026-10-07 Fix available: RHSA-2026:76752 · Red Hat
  6. 2026-10-07 Fix available: OpenShift Security Profiles Operator 1 · Red Hat
  7. 2026-10-08 Fix available: RHSA-2026:77639 · Red Hat
  8. 2026-10-08 Fix available: Logging Subsystem for Red Hat OpenShift 6.4 · Red Hat
  9. 2026-10-09 Fix available: Red Hat OpenShift distributed tracing 3.11.2 · Red Hat
  10. 2026-10-10 Affected versions changed · Red Hat
  11. 2026-10-12 Affected versions changed · Red Hat
  12. 2026-10-13 Fix available: Red Hat OpenShift distributed tracing 3.11 · Red Hat
  13. 2026-10-14 Fix available: RHSA-2026:82315 · Red Hat
  14. 2026-10-15 Fix available: RHSA-2026:83013 · Red Hat
  15. 2026-10-16 Fix available: RHSA-2026:83593 · Red Hat
  16. 2026-10-16 Fix available: RHSA-2026:83596 · Red Hat
  17. 2026-10-16 Fix available: RHSA-2026:83597 · Red Hat
  18. 2026-10-16 Fix available: RHSA-2026:83601 · Red Hat
  19. 2026-10-16 Fix available: RHSA-2026:83598 · Red Hat
  20. 2026-10-16 Fix available: Logging Subsystem for Red Hat OpenShift 6.0, Red Hat Migration Toolkit for Applications 8.2, Red Hat Trusted Artifact Signer 1.4 · Red Hat
  21. 2026-10-20 Fix available: RHSA-2026:85247 · Red Hat
  22. 2026-10-20 Fix available: RHSA-2026:84734 · Red Hat
  23. 2026-10-20 Fix available: DevWorkspace Operator 1.0, Red Hat OpenShift AI 3.4 · Red Hat
  24. 2026-10-22 Fix available: RHSA-2026:87410 · Red Hat
  25. 2026-10-23 Affected versions changed · Red Hat
  26. 2026-10-24 Fix available: Red Hat OpenShift distributed tracing 3.11.3 · Red Hat
  27. 2026-10-25 Fix available: Red Hat OpenShift Builds 1.8.3 · Red Hat
  28. 2026-10-26 Fix available: Red Hat OpenShift distributed tracing 3.11 · Red Hat
  29. 2026-10-29 Fix available: Red Hat OpenShift Dev Spaces 3.31 · Red Hat
  30. 2026-10-30 Fix available: RHSA-2026:91958 · Red Hat
  31. 2026-10-30 Fix available: RHSA-2026:90321 · Red Hat
  32. 2026-10-30 Fix available: RHSA-2026:92510 · Red Hat
  33. 2026-10-30 Affected versions changed · Red Hat
  34. 2026-10-30 Affected versions changed · Red Hat
  35. 2026-10-31 Fix available: RHSA-2026:92593 · Red Hat
  36. 2026-10-31 Fix available: RHSA-2026:92515 · Red Hat
  37. 2026-10-31 Fix available: Red Hat OpenShift distributed tracing 3.10.1 · Red Hat
  38. 2026-11-04 Fix available: RHSA-2026:94498 · Red Hat
  39. 2026-11-04 Fix available: OpenShift API for Data Protection 1.4 · Red Hat
  40. 2026-11-05 Fix available: Cluster Observability Operator 1.5 · Red Hat

References

Patch 2

Advisory 1

Other 1

  • TI-2026-23298 OpenTelemetry-Go multi-value `baggage` header extraction causes excessive allocations (remote dos amplification) CVSS 3.1HIGH 7.5
  • TI-2023-25448 DoS vulnerability in otelgrpc (uncontrolled resource consumption) due to unbound cardinality metrics CVSS 3.1HIGH 7.5
  • TI-2026-32829 opentelemetry-cpp: OTLP HTTP exporters read unbounded HTTP response CVSS 3.1MEDIUM 5.3
  • TI-2023-23498 opentelemetry-instrumentation Denial of Service vulnerability due to unbound cardinality metrics CVSS 3.1HIGH 7.5
  • TI-2023-24163 OpenTelemetry-Go Contrib has DoS vulnerability in otelhttp due to unbound cardinality metrics CVSS 3.1HIGH 7.5
  • TI-2026-28762 Untrusted search path in open-telemetry opentelemetry-go CVSS 4.0HIGH 7.3
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences