By vendor

Redhat vulnerabilities

Known CVEs affecting Redhat products, prioritized by severity, with SEC.co remediation and detection guidance.

31 published vulnerabilities

• CVE-2026-1784HIGH 8.8

  A flaw in OpenShift's Route resource allows users with low-level cluster access to inject malicious HAProxy configuration through the spec.path field. Because validation of this field is insufficient, an attacker can bypass intended restrictions and alter how traffic is routed, potentially redirecting requests or exposing sensitive data. This is a local privilege escalation risk requiring existing cluster access but delivering high-impact consequences.

• CVE-2026-50256HIGH 7.8

  The X.Org X server and Xwayland contain a buffer overflow vulnerability caused by a mismatch in how the server and its font library handle font alias names. The server reserves a 256-byte buffer for font alias processing, but the underlying libXfont2 library allows names up to 1024 bytes. An attacker can supply a specially crafted font alias name between 257 and 1023 bytes, causing the server to overflow the undersized buffer. This can crash the display server or, if the X server runs with root privileges, potentially enable privilege escalation.

• CVE-2026-50257HIGH 7.8

  A use-after-free vulnerability exists in the X.Org X server and Xwayland that allows an attacker to crash the display server or potentially escalate privileges. The flaw occurs in the miSyncDestroyFence() function when multiple X clients interact with fence synchronization primitives. An attacker would establish a fence trigger, then have a second connection destroy it prematurely, leaving the first client's code trying to reference memory that has been freed. If the X server runs with root privileges—common in many deployments—this could lead to privilege escalation.

• CVE-2026-50258HIGH 7.8

  A flaw in the X.Org X server and Xwayland allows a local user to cause a crash or potentially gain elevated privileges by manipulating keyboard type configurations. The vulnerability stems from incomplete validation of keyboard shift level parameters, enabling a malicious application or user to exceed safe memory boundaries and overflow the server's stack. Because X servers often run with elevated privileges on Linux systems, this issue carries significant risk in shared or untrusted environments.

• CVE-2026-50259HIGH 7.8

  A stack memory overflow vulnerability exists in the X.Org X server and Xwayland that allows a local attacker with limited privileges to crash the display server or potentially gain elevated privileges. The flaw stems from improper bounds checking when processing keyboard mapping configuration, where an attacker can write beyond a fixed-size array on the stack. If the X server runs with root privileges—a common configuration in many Linux environments—this becomes a path to privilege escalation.

• CVE-2026-50260HIGH 7.8

  A use-after-free vulnerability exists in the X.Org X server and Xwayland display servers. An attacker with local access can exploit this by creating multiple synchronized counters through one client connection, then destroying them from a separate connection, causing the server to access memory that has already been freed. This can crash the display server or, if the X server runs with root privileges, potentially allow privilege escalation to system administrator level.

• CVE-2026-50261HIGH 7.8

  A use-after-free memory vulnerability exists in the X.Org X server and Xwayland, specifically in the SyncChangeCounter() function. An attacker with local access can exploit this by setting up multiple sync counters from one client connection and then destroying them from a second connection while modifying the counters. This creates a window where the server attempts to access memory that has already been freed, potentially crashing the display server or—in cases where the X server runs with root privileges—enabling privilege escalation.

• CVE-2026-50264HIGH 7.8

  A memory corruption vulnerability exists in X.Org's X server and Xwayland that allows a local user to write beyond allocated memory boundaries. An attacker can craft a specially crafted request asking for multiple back-left and one front-left DRI2 buffer attachment, causing the server to write data into memory it shouldn't access. This can crash the display server or, if that server runs with elevated privileges, enable privilege escalation. The vulnerability requires local access and user-level permissions to trigger.

• CVE-2026-42965HIGH 7.7

  OpenShift Router contains a flaw that allows users with EndpointSlice write permissions to redirect traffic through the router to cloud metadata endpoints. By crafting a Service backed by an FQDN-based EndpointSlice pointing to a cloud metadata service, an attacker can intercept and read sensitive instance credentials and metadata that should never be exposed. This circumvents existing IP address validation protections designed to block such access.

• CVE-2026-46579HIGH 7.4

  OpenShift Router has a header-spoofing vulnerability that breaks mutual TLS authentication when routes are configured to allow unencrypted HTTP traffic. An attacker can send plain HTTP requests with forged client certificate headers, tricking backend services into accepting them as though they came from legitimate authenticated clients. This bypasses the certificate-based trust model that many organizations rely on for service-to-service security.

• CVE-2026-9795HIGH 7.3

  A flaw in Keycloak's Fine-Grained Admin Permissions (FGAPv2) feature allows a limited administrator to bypass security controls and inject high-privilege roles into a client application. When users authenticate to that client, the injected roles appear in their authentication tokens, granting them unauthorized access. An attacker with restricted admin rights can escalate their own permissions or those of other users without triggering standard approval workflows.

• CVE-2026-9802MEDIUM 6.8

  Keycloak contains a vulnerability where refresh tokens can be replayed after revocation under specific conditions. When token revocation is enabled alongside persistent session storage, a server restart can cause the system to lose track of timing information, allowing an attacker who previously captured a user's refresh token to reuse it for unauthorized account access. This is a medium-severity flaw that requires network access and user interaction to exploit.

• CVE-2026-11611MEDIUM 6.5

  A memory leak vulnerability exists in 389 Directory Server's Content Synchronization (sync) feature. When an authenticated user initiates a sync request but stops reading the server's responses without properly closing the connection, the server accumulates data in memory indefinitely, eventually consuming all available resources and crashing the service. The vulnerability also introduces race conditions that can trigger crashes during normal connection cleanup or server shutdown.

• CVE-2026-9792MEDIUM 6.5

  Keycloak's Client Policies feature contains a bypass that weakens its security controls. When administrators configure policies to block the Resource Owner Password Credentials (ROPC) grant flow—a less secure authentication method—the system fails to enforce this restriction under certain conditions. An attacker can exploit this to obtain authentication tokens without proper authorization, potentially accessing sensitive data or impersonating legitimate users. The vulnerability affects how Keycloak validates policy conditions when client type, roles, attributes, or scopes are involved.

• CVE-2026-9796MEDIUM 6.5

  Keycloak has a timing vulnerability that allows an authenticated administrator with `manage-clients` permissions to temporarily escalate themselves to `realm-admin` role during a narrow window when role checks occur. Once granted, this elevated access persists indefinitely—even after the attacker's own admin permissions are removed or the system restarts. This creates a privilege escalation path that is difficult to detect and remediate after the fact.

• CVE-2026-11788MEDIUM 5.9

  A vulnerability exists in 389 Directory Server where the dereference control plugin fails to verify that memory allocation succeeded before proceeding. An attacker on the network can trigger memory exhaustion conditions to crash the LDAP server without providing credentials. The attack requires specific environmental conditions (system memory pressure) to succeed, but no authentication is required.

• CVE-2026-9793MEDIUM 5.9

  Keycloak has a vulnerability in how it handles encrypted OpenID Connect requests. When a JWE-encrypted request object arrives, Keycloak may skip signature verification on the decrypted JSON claims, allowing an attacker to inject unauthorized claims into the OIDC authorization flow. This bypasses a key security control designed to ensure claims haven't been tampered with. The vulnerability is classified as medium severity because while it compromises data integrity, exploitation requires specific conditions and the redirect URI allowlist provides some defense-in-depth protection.

• CVE-2026-50262MEDIUM 5.5

  CVE-2026-50262 is an information disclosure vulnerability in the X.Org X server and Xwayland components. A flawed validation check in the ChangeDrawableAttributes function allows an authenticated local attacker to read beyond the intended buffer boundaries, potentially exposing sensitive data from memory. The vulnerability is limited to information disclosure on standard configurations; a write variant exists but is disabled by default in most deployments.

• CVE-2026-50263MEDIUM 5.5

  CVE-2026-50263 is a use-after-free memory vulnerability in X.Org's X server and Xwayland components that can leak sensitive information from system memory. When a client manipulates window attributes and triggers the screen saver, the CreateSaverWindow() function accesses memory that has already been freed, allowing the attacker to read data that should no longer be accessible. The vulnerability requires local access and low privileges but can expose confidential information without crashing the system.

• CVE-2026-9794MEDIUM 5.3

  Keycloak contains an information disclosure vulnerability in its SAML ECP (Enhanced Client or Proxy) endpoint. An unauthenticated attacker can send specially crafted SOAP requests with different client IDs to the endpoint and observe the error messages returned. By analyzing these responses, an attacker can infer whether a given client uses SAML or another protocol. While this doesn't grant direct access to sensitive data or systems, it reveals organizational configuration details that could inform further reconnaissance or targeted attacks.

• CVE-2026-9803MEDIUM 5.3

  Keycloak's client registration endpoint contains a flaw that allows unauthenticated attackers to crash the service by sending malformed authentication headers. When an attacker sends a specially crafted POST request with a broken 'Authorization: Bearer' header to the client registration endpoint, the server throws an exception and returns an error, effectively taking the service offline temporarily. No data is stolen or modified—this is purely a denial of service issue.

• CVE-2026-10533MEDIUM 5.0

  A vulnerability in OpenShift Container Platform allows non-privileged users to circumvent resource quota enforcement by creating pods with a never-restart policy. These pods and their associated Kubernetes events are not counted against quota limits, enabling an attacker to flood the cluster's event database (etcd) with activity. The resulting accumulation degrades API server performance across the entire cluster, affecting all users and workloads.

• CVE-2026-11787MEDIUM 5.0

  A vulnerability in Red Hat's 389 Directory Server allows a memory reading flaw when processing LDAP search filters. The issue occurs when the server parses certain filter strings, causing it to read data from memory locations it shouldn't access. This could potentially be exploited by an authenticated user to leak small amounts of sensitive information or disrupt normal filter processing. The vulnerability requires authentication and specific conditions to exploit, making it a moderate-risk issue that warrants patching but not immediate panic.

• CVE-2026-11789MEDIUM 4.9

  389 Directory Server contains a flaw in its SMD5 password storage plugin that causes the LDAP server to crash when processing certain malformed password hashes. An authenticated attacker with high privileges can trigger this crash by submitting a specially crafted password hash shorter than 16 bytes, which causes the plugin to miscalculate memory boundaries and read beyond allocated buffers. The crash results in denial of service but does not leak sensitive data or compromise authentication logic itself.

• CVE-2026-11790MEDIUM 4.9

  389 Directory Server contains a weakness in how it handles password verification when using PBKDF2-SHA256 encryption. An attacker with administrative access can tamper with a user's stored password hash to include an extremely high iteration count. When that user (or an automated system) attempts to authenticate, the server wastes excessive CPU resources recalculating the password hash, effectively freezing responsiveness for legitimate users. This is a denial-of-service attack that requires the attacker to already have administrative privileges to modify password data.

• CVE-2026-11793MEDIUM 4.9

  A stack buffer overflow vulnerability has been identified in 389 Directory Server's password handling code. When parsing specially crafted credentials, the checkPrefix() function in pw.c fails to validate the length of an algorithm identifier before copying it into a fixed 256-byte buffer. An attacker with Directory Manager credentials can exploit this to crash the LDAP server. While the vulnerability could theoretically allow code execution, compiler protections like FORTIFY_SOURCE limit the practical impact to denial of service in most deployments.

• CVE-2026-9801MEDIUM 4.9

  Keycloak has a vulnerability that allows a high-privileged attacker—such as a realm administrator or someone who has compromised an upstream LDAP server—to crash the Keycloak service by sending a specially crafted LDAP password policy response. When triggered during authentication, this causes the Java process to run out of memory and shut down, knocking the service offline for all users on that node. The attack requires either legitimate administrative access to configure a malicious LDAP directory or prior compromise of an existing LDAP backend.

• CVE-2026-11785MEDIUM 4.3

  CVE-2026-11785 is a flaw in 389 Directory Server that leaks partial stack memory addresses to authenticated users through LDAP responses. An attacker with valid LDAP credentials can trigger a type confusion error during SSO token processing, causing the server to inadvertently expose memory layout information. This is a limited disclosure risk—the attacker must already be authenticated, and only partial address information is exposed—but it can provide a foothold for more advanced attacks that rely on defeating address space layout randomization (ASLR).

• CVE-2026-9791MEDIUM 4.3

  An authenticated user who belongs to a Keycloak organization can request tokens or access APIs in ways that expose organization metadata, even after an administrator has turned off the Organizations feature. This metadata leakage could cause downstream applications (resource servers) to make incorrect access control decisions based on stale or unintended organization information.

• CVE-2026-9798MEDIUM 4.3

  Keycloak's account lockout feature, which temporarily disables accounts after repeated failed login attempts, can be bypassed when an attacker possesses valid client credentials. By using the Client-Initiated Backchannel Authentication (CIBA) flow—a legitimate OAuth 2.0 feature—attackers can circumvent the lockout and continue attempting to authenticate or obtain tokens. This undermines brute-force protection and creates a secondary path for unauthorized access once the attacker has obtained initial client credentials.

• CVE-2026-11786LOW 1.9

  A parsing flaw in 389 Directory Server can cause the LDIF (LDAP Data Interchange Format) parser to read past the boundary of allocated memory when it encounters attribute types ending with semicolons during database imports. The defect is detectable only under memory instrumentation tools (such as AddressSanitizer) and does not cause immediate functional failure or crashes under normal operation. This is a low-severity out-of-bounds read affecting local, high-privileged operations.