Read the docs
TI-2026-48533 Aliases CVE-2026-69153GHSA-fxqj-rqcc-2cmp

Information disclosure in postcss

Priority MEDIUM 61CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Partial Red Hat: 47 fixed, 32 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-200.

Summary

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL. The resulting map’s sources and sourcesContent may then be exposed to the application. This issue is fixed in version 8.5.19.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00451 39th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial postcss (postcss): 8.5.19postcss (npm): 8.5.23Red Hat: 51 advisoriesRed Hat: 47 fixed, 32 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
postcsspostcssbefore 8.5.198.5.19Patch availableCNA
—postcss (npm)before 8.5.238.5.23Patch availableGHSA-fxqj-rqcc-2cmp
  • postcss Vendorpostcss Affected before 8.5.19 Fixed in 8.5.19 Patch available CNA
  • postcss (npm) Vendor— Affected before 8.5.23 Fixed in 8.5.23 Patch available GHSA-fxqj-rqcc-2cmp

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:postcss:postcss:*:*:*:*:*:node.js:*:*before 8.5.23Vulnerablepostcss
  • cpe:2.3:a:postcss:postcss:*:*:*:*:*:node.js:*:* Versions before 8.5.23 Vulnerable ·postcss

Remediation

  • Fix · CNA postcss (postcss) Fixed in 8.5.19
  • Fix · GHSA-fxqj-rqcc-2cmp postcss (npm) Fixed in 8.5.23 Advisory →

Red Hat 51 advisories

  • RHSA-2026:92650 Released 2026-10-29 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.19.26 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.19 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +17
  • RHSA-2026:92510 Released 2026-10-29 · Red Hat rating Critical
    RHOAI 3.4.6 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-cli-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9 +47
  • RHSA-2026:87410 Released 2026-10-21 · Red Hat rating Critical
    RHOAI 2.25.12 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-caikit-nlp-rhel9, registry.redhat.io/rhoai/odh-codeflare-operator-rhel9 +47
Show 48 more Red Hat advisories
  • RHSA-2026:85846 Released 2026-10-20 · Red Hat rating Important
    Migration Toolkit for Containers (MTC) 1.8.18 security and bug fix update
    • Red Hat Migration Toolkit 1.8 registry.redhat.io/rhmtc/openshift-migration-controller-rhel8, registry.redhat.io/rhmtc/openshift-migration-registry-rhel8, registry.redhat.io/rhmtc/openshift-migration-ui-rhel8 +1
  • RHSA-2026:84734 Released 2026-10-19 · Red Hat rating Critical
    RHOAI 3.4.5 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-ai-gateway-payload-processing-rhel9, registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9 +47
  • RHSA-2026:83598 Released 2026-10-15 · Red Hat rating Important
    RHTAS 1.4.4 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.4 registry.redhat.io/rhtas/certificate-transparency-rhel9, registry.redhat.io/rhtas/fulcio-rhel9, registry.redhat.io/rhtas/rekor-backfill-redis-rhel9 +6
  • RHSA-2026:74511 Released 2026-10-01 · Red Hat rating Important
    Red Hat Quay 3.17.5
    • Red Hat Quay 3.17 registry.redhat.io/quay/quay-rhel9
  • RHSA-2026:70587 Released 2026-10-01 · Red Hat rating Important
    OpenShift Container Platform 4.17.58 bug fix and security update
    • Red Hat OpenShift Container Platform 4.17 registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/cloud-network-config-controller-rhel9 +47
  • RHSA-2026:67936 Released 2026-09-24 · Red Hat rating Important
    OpenShift Container Platform 4.16.71 bug fix and security update
    • Red Hat OpenShift Container Platform 4.16 registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/cloud-network-config-controller-rhel9 +47
  • RHSA-2026:71179 Released 2026-09-23 · Red Hat rating Critical
    Red Hat Ansible Automation Platform 2.6 Container Release Update
    • Red Hat Ansible Automation Platform 2.6 registry.redhat.io/ansible-automation-platform-26/aap-must-gather-rhel9, registry.redhat.io/ansible-automation-platform-26/controller-rhel9, registry.redhat.io/ansible-automation-platform-26/de-minimal-rhel9 +10
  • RHSA-2026:71114 Released 2026-09-23 · Red Hat rating Critical
    Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update
    • Red Hat Ansible Automation Platform 2.5 for RHEL 8 automation-controller-venv-tower-4.6.33-1.el8ap, automation-gateway-proxy-server-2.5.10-8.el8ap, automation-gateway-server-2.5.20260923-1.el8ap +3
    • Red Hat Ansible Automation Platform 2.5 for RHEL 9 automation-controller-venv-tower-4.6.33-1.el9ap, automation-gateway-proxy-server-2.6.17-3.el9ap, automation-gateway-server-2.5.20260923-1.el9ap +3
  • RHSA-2026:71113 Released 2026-09-23 · Red Hat rating Critical
    Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update
    • Red Hat Ansible Automation Platform 2.6 for RHEL 10 python-sqlparse-0.6.0-1.el10ap, python3-sqlparse-0.6.0-1.el10ap, receptor-1.6.8-1.el10ap
    • Red Hat Ansible Automation Platform 2.6 for RHEL 9 automation-controller-4.7.17-1.el9ap, automation-controller-cli-4.7.17-1.el9ap, automation-controller-server-4.7.17-1.el9ap +7
  • RHSA-2026:70267 Released 2026-09-22 · Red Hat rating Important
    Red Hat Quay 3.14.9
    • Red Hat Quay 3.14 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:68754 Released 2026-09-17 · Red Hat rating Important
    Red Hat OpenShift Dev Spaces 3.30.1 Release.
    • Red Hat OpenShift Dev Spaces 3.30 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/dashboard-rhel9, registry.redhat.io/devspaces/openvsx-rhel9 +2
  • RHSA-2026:65852 Released 2026-09-17 · Red Hat rating Important
    OpenShift Container Platform 4.18.55 bug fix and security update
    • Red Hat OpenShift Container Platform 4.18 registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/ose-apiserver-network-proxy-rhel9, registry.redhat.io/openshift4/ose-azure-cluster-api-controllers-rhel9 +19
  • RHSA-2026:68334 Released 2026-09-16 · Red Hat rating Important
    Red Hat Edge Manager Version 1.1.4 Security Update
    • RHEM 1.1 for RHEL 10 flightctl-1.1.4-1.el10em, flightctl-agent-1.1.4-1.el10em, flightctl-cli-1.1.4-1.el10em
    • RHEM 1.1 for RHEL 9 flightctl-1.1.4-1.el9em, flightctl-agent-1.1.4-1.el9em, flightctl-cli-1.1.4-1.el9em
  • RHSA-2026:67279 Released 2026-09-14 · Red Hat rating Critical
    Red Hat Ansible Automation Platform 2.7 Container Release Update
    • Red Hat Ansible Automation Platform 2.7 registry.redhat.io/ansible-automation-platform-27/controller-rhel9, registry.redhat.io/ansible-automation-platform-27/eda-controller-rhel9, registry.redhat.io/ansible-automation-platform-27/ee-minimal-rhel9 +7
  • RHSA-2026:66523 Released 2026-09-10 · Red Hat rating Important
    Red Hat Quay 3.12.22
    • Red Hat Quay 3.12 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:66084 Released 2026-09-09 · Red Hat rating Important
    Red Hat Quay 3.10.26
    • Red Hat Quay 3.10 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:63047 Released 2026-09-09 · Red Hat rating Important
    OpenShift Container Platform 4.19.46 bug fix and security update
    • Red Hat OpenShift Container Platform 4.19 registry.redhat.io/openshift4/egress-router-cni-rhel9, registry.redhat.io/openshift4/ose-baremetal-cluster-api-controllers-rhel9, registry.redhat.io/openshift4/ose-console-rhel9 +4
  • RHSA-2026:65514 Released 2026-09-08 · Red Hat rating Important
    Red Hat Quay 3.9.26
    • Red Hat Quay 3.9 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:63046 Released 2026-09-08 · Red Hat rating Important
    OpenShift Container Platform 4.21.32 bug fix and security update
    • Red Hat OpenShift Container Platform 4.21 registry.redhat.io/openshift4/ose-agent-installer-ui-rhel9, registry.redhat.io/openshift4/ose-baremetal-installer-rhel9, registry.redhat.io/openshift4/ose-cluster-autoscaler-rhel9-operator +6
  • RHSA-2026:63103 Released 2026-09-08 · Red Hat rating Important
    OpenShift Container Platform 4.20.37 bug fix and security update
    • Red Hat OpenShift Container Platform 4.20 registry.redhat.io/openshift4/ose-agent-installer-ui-rhel9, registry.redhat.io/openshift4/ose-console-rhel9, registry.redhat.io/openshift4/ose-prometheus-rhel9 +1
  • RHSA-2026:63307 Released 2026-09-03 · Red Hat rating Important
    Red Hat Quay 3.15.8
    • Red Hat Quay 3.15 registry.redhat.io/quay/quay-builder-rhel8, registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:62260 Released 2026-09-01 · Red Hat rating Important
    Red Hat OpenShift Dev Spaces 3.30.0 Release.
    • Red Hat OpenShift Dev Spaces 3.30 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/configbump-rhel9, registry.redhat.io/devspaces/dashboard-rhel9 +7
  • RHSA-2026:60441 Released 2026-09-01 · Red Hat rating Important
    OpenShift Container Platform 4.22.12 bug fix and security update
    • Red Hat OpenShift Container Platform 4.22 registry.redhat.io/openshift4/egress-router-cni-rhel9, registry.redhat.io/openshift4/ose-agent-installer-ui-rhel9, registry.redhat.io/openshift4/ose-aws-ebs-csi-driver-rhel9-operator +23
  • RHSA-2026:60390 Released 2026-08-26 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.13.11 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.13 registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9, registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9 +23
  • RHSA-2026:60388 Released 2026-08-26 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.14.4 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.14 registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9, registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9 +26
  • RHSA-2026:60387 Released 2026-08-26 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.11.11 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.11 registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9, registry.redhat.io/rhacm2/acm-must-gather-rhel9, registry.redhat.io/rhacm2/acm-prometheus-config-reloader-rhel9 +24
  • RHSA-2026:60386 Released 2026-08-26 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.17.1 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.17 registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9, registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9 +31
  • RHSA-2026:59593 Released 2026-08-25 · Red Hat rating Important
    multicluster engine for Kubernetes v2.17.2 security update
    • multicluster engine for Kubernetes 2.17 registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9, registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9, registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9 +6
  • RHSA-2026:59583 Released 2026-08-25 · Red Hat rating Important
    Kiali 2.27.3 for Red Hat OpenShift Service Mesh 3.4
    • Red Hat OpenShift Service Mesh 3.4 registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9, registry.redhat.io/openshift-service-mesh/kiali-rhel9
  • RHSA-2026:59579 Released 2026-08-25 · Red Hat rating Important
    multicluster engine for Kubernetes v2.6.14 security update
    • multicluster engine for Kubernetes 2.6 registry.redhat.io/multicluster-engine/addon-manager-rhel9, registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9, registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9 +17
  • RHSA-2026:59566 Released 2026-08-25 · Red Hat rating Important
    Kiali 2.22.9 for Red Hat OpenShift Service Mesh 3.3
    • Red Hat OpenShift Service Mesh 3.3 registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9, registry.redhat.io/openshift-service-mesh/kiali-rhel9
  • RHSA-2026:59561 Released 2026-08-25 · Red Hat rating Important
    Kiali 2.11.16 for Red Hat OpenShift Service Mesh 3.1
    • Red Hat OpenShift Service Mesh 3.1 registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9, registry.redhat.io/openshift-service-mesh/kiali-rhel9
  • RHSA-2026:59559 Released 2026-08-25 · Red Hat rating Important
    multicluster engine for Kubernetes v2.9.7 security update
    • multicluster engine for Kubernetes 2.9 registry.redhat.io/multicluster-engine/addon-manager-rhel9, registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9, registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9 +15
  • RHSA-2026:59558 Released 2026-08-25 · Red Hat rating Important
    multicluster engine for Kubernetes v2.8.10 security update
    • multicluster engine for Kubernetes 2.8 registry.redhat.io/multicluster-engine/addon-manager-rhel9, registry.redhat.io/multicluster-engine/backplane-rhel9-operator, registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9 +20
  • RHSA-2026:59554 Released 2026-08-25 · Red Hat rating Important
    Kiali 2.17.13 for Red Hat OpenShift Service Mesh 3.2
    • Red Hat OpenShift Service Mesh 3.2 registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9, registry.redhat.io/openshift-service-mesh/kiali-rhel9
  • RHSA-2026:59548 Released 2026-08-25 · Red Hat rating Important
    Kiali 2.4.22 for Red Hat OpenShift Service Mesh 3.0
    • Red Hat OpenShift Service Mesh 3.0 registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9, registry.redhat.io/openshift-service-mesh/kiali-rhel9
  • RHSA-2026:57590 Released 2026-08-20 · Red Hat rating Important
    rh-podman-desktop security, bug fix, and enhancement update
    • Red Hat Enterprise Linux Extensions Channel (v. 10) rh-podman-desktop-1.1.2-1.el10_2
  • RHSA-2026:57194 Released 2026-08-19 · Red Hat rating Important
    multicluster engine for Kubernetes v2.11.5 security update
    • multicluster engine for Kubernetes 2.11 registry.redhat.io/multicluster-engine/addon-manager-rhel9, registry.redhat.io/multicluster-engine/backplane-rhel9-operator, registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9 +11
  • RHSA-2026:57191 Released 2026-08-19 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.16.3 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.16 registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-prometheus-config-reloader-rhel9, registry.redhat.io/rhacm2/acm-prometheus-rhel9 +15
  • RHSA-2026:56357 Released 2026-08-18 · Red Hat rating Important
    Ansible plug-ins for Red Hat Developer Hub Product Release Update
    • Red Hat Ansible Automation Platform 2.2 registry.redhat.io/ansible-automation-platform/automation-portal
  • RHSA-2026:56338 Released 2026-08-18 · Red Hat rating Important
    Ansible plug-ins for Red Hat Developer Hub Product Release Update
    • Red Hat Ansible Automation Platform 2.1 registry.redhat.io/ansible-automation-platform/automation-portal
  • RHSA-2026:54760 Released 2026-08-13 · Red Hat rating Important
    A Subscription Management tool for finding and reporting Red Hat product usage
    • Red Hat Discovery 2 registry.redhat.io/discovery/discovery-server-rhel9, registry.redhat.io/discovery/discovery-ui-rhel9
  • RHSA-2026:54435 Released 2026-08-12 · Red Hat rating Important
    Streams for Apache Kafka 3.2.1 release and security update
    • Streams for Apache Kafka 3.2.1
  • RHSA-2026:50826 Released 2026-08-05 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images grafana13.1-13.1.1-0.5.2.hum1@aarch64, grafana13.1-13.1.1-0.5.2.hum1@src, grafana13.1-13.1.1-0.5.2.hum1@x86_64
  • RHSA-2026:50290 Released 2026-08-04 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images grafana12.4-12.4.6-0.4.hum1@aarch64, grafana12.4-12.4.6-0.4.hum1@src, grafana12.4-12.4.6-0.4.hum1@x86_64
  • RHSA-2026:50287 Released 2026-08-04 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images prometheus3.13-3.13.2-0.2.hum1@aarch64, prometheus3.13-3.13.2-0.2.hum1@src, prometheus3.13-3.13.2-0.2.hum1@x86_64
  • RHSA-2026:50079 Released 2026-08-04 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images grafana13.1-13.1.1-0.5.1.hum1@aarch64, grafana13.1-13.1.1-0.5.1.hum1@src, grafana13.1-13.1.1-0.5.1.hum1@x86_64
  • RHSA-2026:50070 Released 2026-08-04 · Red Hat rating Moderate
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images prometheus3.5-3.5.5-0.7.hum1@aarch64, prometheus3.5-3.5.5-0.7.hum1@src, prometheus3.5-3.5.5-0.7.hum1@x86_64

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Cryostat 4AffectedNo fix yet: Fix deferred
Gatekeeper 3AffectedNo fix yet: Fix deferred
Node HealthCheck OperatorAffectedNo fix yet
OpenShift LightspeedAffectedNo fix yet: Fix deferred
OpenShift PipelinesAffectedNo fix yet: Fix deferred
OpenShift Service Mesh 3AffectedNo fix yet: Fix deferred
Red Hat 3scale API Management Platform 2AffectedNo fix yet: Fix deferred
Red Hat AMQ Broker 7AffectedNo fix yet
Red Hat Advanced Cluster Management for Kubernetes 2AffectedNo fix yet: Fix deferred
Red Hat Ansible Automation Platform 2AffectedNo fix yet: Fix deferred
Red Hat Build of KeycloakAffectedNo fix yet: Fix deferred
Red Hat Build of Podman DesktopAffectedNo fix yet: Fix deferred
Red Hat Connectivity Link 1AffectedNo fix yet: Fix deferred
Red Hat Data Grid 8AffectedNo fix yet: Fix deferred
Red Hat Developer Hub 1AffectedNo fix yet
Red Hat Enterprise Linux 10AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 7AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 8AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 9AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux AI (RHEL AI) 3AffectedNo fix yet
Red Hat Hardened ImagesAffectedNo fix yet: Fix deferred
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet
Red Hat OpenShift Container Platform 4AffectedNo fix yet: Fix deferred
Red Hat OpenShift Container Platform 5AffectedNo fix yet: Fix deferred
Red Hat OpenShift Virtualization 4AffectedNo fix yet: Fix deferred
Red Hat Openshift Data Foundation 4AffectedNo fix yet: Fix deferred
Red Hat Satellite 6AffectedNo fix yet: Fix deferred
Red Hat Single Sign-On 7AffectedNo fix planned: Will not fix
Red Hat Trusted Artifact SignerAffectedNo fix yet
Red Hat build of Apache Camel - HawtIO 4AffectedNo fix yet: Fix deferred
Red Hat build of Apache Camel for Spring Boot 4AffectedNo fix yet: Fix deferred
Secrets Management Console for Red Hat OpenShiftAffectedNo fix yet: Fix deferred
RHEM 1.1 for RHEL 10Fixed RHSA-2026:68334
RHEM 1.1 for RHEL 9Fixed RHSA-2026:68334
Red Hat Advanced Cluster Management for Kubernetes 2.11Fixed RHSA-2026:60387
Red Hat Advanced Cluster Management for Kubernetes 2.13Fixed RHSA-2026:60390
Red Hat Advanced Cluster Management for Kubernetes 2.14Fixed RHSA-2026:60388
Red Hat Advanced Cluster Management for Kubernetes 2.16Fixed RHSA-2026:57191
Red Hat Advanced Cluster Management for Kubernetes 2.17Fixed RHSA-2026:60386
Red Hat Ansible Automation Platform 2.1Fixed RHSA-2026:56338
Red Hat Ansible Automation Platform 2.2Fixed RHSA-2026:56357
Red Hat Ansible Automation Platform 2.5 for RHEL 8Fixed RHSA-2026:71114
Red Hat Ansible Automation Platform 2.5 for RHEL 9Fixed RHSA-2026:71114
Red Hat Ansible Automation Platform 2.6Fixed RHSA-2026:71179
Red Hat Ansible Automation Platform 2.6 for RHEL 9Fixed RHSA-2026:71113
Red Hat Ansible Automation Platform 2.7Fixed RHSA-2026:67279
Red Hat Discovery 2Fixed RHSA-2026:54760
Red Hat Enterprise Linux Extensions Channel (v. 10)Fixed RHSA-2026:57590
Red Hat Hardened ImagesFixed RHSA-2026:50070, RHSA-2026:50079, RHSA-2026:50287, RHSA-2026:50290, RHSA-2026:50826
Red Hat Migration Toolkit 1.8Fixed RHSA-2026:85846
Red Hat OpenShift AI 2.25Fixed RHSA-2026:87410
Red Hat OpenShift AI 3.4Fixed RHSA-2026:84734, RHSA-2026:92510
Red Hat OpenShift Container Platform 4.16Fixed RHSA-2026:67936
Red Hat OpenShift Container Platform 4.17Fixed RHSA-2026:70587
Red Hat OpenShift Container Platform 4.18Fixed RHSA-2026:65852
Red Hat OpenShift Container Platform 4.19Fixed RHSA-2026:63047
Red Hat OpenShift Container Platform 4.20Fixed RHSA-2026:63103
Red Hat OpenShift Container Platform 4.21Fixed RHSA-2026:63046
Red Hat OpenShift Container Platform 4.22Fixed RHSA-2026:60441
Red Hat OpenShift Dev Spaces 3.30Fixed RHSA-2026:62260, RHSA-2026:68754
Red Hat OpenShift Service Mesh 3.0Fixed RHSA-2026:59548
Red Hat OpenShift Service Mesh 3.1Fixed RHSA-2026:59561
Red Hat OpenShift Service Mesh 3.2Fixed RHSA-2026:59554
Red Hat OpenShift Service Mesh 3.3Fixed RHSA-2026:59566
Red Hat OpenShift Service Mesh 3.4Fixed RHSA-2026:59583
Red Hat Openshift Data Foundation 4.19Fixed RHSA-2026:92650
Red Hat Quay 3.10Fixed RHSA-2026:66084
Red Hat Quay 3.12Fixed RHSA-2026:66523
Red Hat Quay 3.14Fixed RHSA-2026:70267
Red Hat Quay 3.15Fixed RHSA-2026:63307
Red Hat Quay 3.17Fixed RHSA-2026:74511
Red Hat Quay 3.9Fixed RHSA-2026:65514
Red Hat Trusted Artifact Signer 1.4Fixed RHSA-2026:83598
Streams for Apache Kafka 3.2.1Fixed RHSA-2026:54435
multicluster engine for Kubernetes 2.11Fixed RHSA-2026:57194
multicluster engine for Kubernetes 2.17Fixed RHSA-2026:59593
multicluster engine for Kubernetes 2.6Fixed RHSA-2026:59579
multicluster engine for Kubernetes 2.8Fixed RHSA-2026:59558
multicluster engine for Kubernetes 2.9Fixed RHSA-2026:59559
Not affected: 44 products
  • RHEM 1.1 for RHEL 10
  • RHEM 1.1 for RHEL 9
  • Red Hat Advanced Cluster Management for Kubernetes 2.11
  • Red Hat Advanced Cluster Management for Kubernetes 2.13
  • Red Hat Advanced Cluster Management for Kubernetes 2.14
  • Red Hat Advanced Cluster Management for Kubernetes 2.16
  • Red Hat Advanced Cluster Management for Kubernetes 2.17
  • Red Hat Ansible Automation Platform 2.5 for RHEL 8
  • Red Hat Ansible Automation Platform 2.5 for RHEL 9
  • Red Hat Ansible Automation Platform 2.6
  • Red Hat Ansible Automation Platform 2.6 for RHEL 10
  • Red Hat Ansible Automation Platform 2.6 for RHEL 9
  • Red Hat Ansible Automation Platform 2.7
  • Red Hat Discovery 2
  • Red Hat JBoss Enterprise Application Platform 7
  • Red Hat JBoss Enterprise Application Platform 8
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat Migration Toolkit 1.8
  • Red Hat OpenShift AI 2.25
  • Red Hat OpenShift AI 3.4
  • Red Hat OpenShift Container Platform 4.16
  • Red Hat OpenShift Container Platform 4.17
  • Red Hat OpenShift Container Platform 4.18
  • Red Hat OpenShift Container Platform 4.19
  • Red Hat OpenShift Container Platform 4.20
  • Red Hat OpenShift Container Platform 4.21
  • Red Hat OpenShift Container Platform 4.22
  • Red Hat OpenShift Dev Spaces 3.30
  • Red Hat OpenShift Service Mesh 3.4
  • Red Hat Openshift Data Foundation 4.19
  • Red Hat Quay 3.10
  • Red Hat Quay 3.12
  • Red Hat Quay 3.14
  • Red Hat Quay 3.15
  • Red Hat Quay 3.17
  • Red Hat Quay 3.9
  • Red Hat Trusted Artifact Signer 1.4
  • Red Hat build of Apicurio Registry 3
  • multicluster engine for Kubernetes 2.11
  • multicluster engine for Kubernetes 2.17
  • multicluster engine for Kubernetes 2.6
  • multicluster engine for Kubernetes 2.8
  • multicluster engine for Kubernetes 2.9
  • streams for Apache Kafka 2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-69153
  2. 2026-10-03 Alias added: GHSA-fxqj-rqcc-2cmp
  3. 2026-10-16 Fix available: RHSA-2026:83598 · Red Hat
  4. 2026-10-16 Fix available: Red Hat Trusted Artifact Signer 1.4 · Red Hat
  5. 2026-10-20 Fix available: RHSA-2026:85846 · Red Hat
  6. 2026-10-20 Fix available: RHSA-2026:84734 · Red Hat
  7. 2026-10-20 Fix available: Red Hat OpenShift AI 3.4 · Red Hat
  8. 2026-10-21 Fix available: Red Hat Migration Toolkit 1.8 · Red Hat
  9. 2026-10-22 Fix available: RHSA-2026:87410 · Red Hat
  10. 2026-10-23 Fix available: Red Hat OpenShift AI 2.25 · Red Hat
  11. 2026-10-27 Affected versions changed · Red Hat
  12. 2026-10-30 Fix available: RHSA-2026:92510 · Red Hat
  13. 2026-10-30 Affected versions changed · Red Hat
  14. 2026-10-30 Affected versions changed · Red Hat
  15. 2026-10-31 Fix available: RHSA-2026:92650 · Red Hat
  16. 2026-10-31 Fix available: Red Hat Openshift Data Foundation 4.19 · Red Hat
  17. 2026-11-03 Affected versions changed · Red Hat

References

Exploit 1

Patch 1

Other 2

  • TI-2026-33367 PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments CVSS 3.1CRITICAL 9.1
  • TI-2021-06075 Regular expression denial of service (ReDoS) in postcss CVSS 3.1HIGH 7.5
  • TI-2023-23794 An issue was discovered in PostCSS before 8.4.31. CVSS 3.1MEDIUM 5.3
  • TI-2021-06061 Regular expression denial of service (ReDoS) in postcss CVSS 3.1MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences