By vendor

Redhat vulnerabilities

Known CVEs affecting Redhat products, prioritized by severity, with SEC.co remediation and detection guidance.

110 published vulnerabilities · page 2 of 2

• CVE-2026-14615MEDIUM 4.3

  A flaw in Keycloak's Fine-Grained Admin Permissions (FGAP) v2 feature allows delegated administrators to view details of child groups they shouldn't have access to. When a delegated admin queries a parent group, the system fails to properly check permissions before revealing information about nested groups—including names, paths, and custom attributes. While this doesn't grant the ability to modify data or crash the system, it represents an unintended information disclosure that could aid attackers in reconnaissance or help malicious insiders map organizational structure.

• CVE-2026-5138MEDIUM 4.3

  Foreman, Red Hat's infrastructure management platform, contains a flaw that allows authenticated users with basic host-editing permissions to bypass authorization controls and view sensitive network configuration data from other organizations and locations. An attacker could extract subnet layouts, IP address ranges, gateway configurations, DNS server details, and VLAN assignments belonging to infrastructure they should not have access to. The vulnerability requires valid credentials and existing permissions to exploit, limiting its immediate blast radius, but it creates a significant cross-tenant data leakage risk in multi-tenant deployments.

• CVE-2026-55653MEDIUM 4.3

  A vulnerability exists in OpenSSH where a malicious SSH server can trigger a double-free memory error in the client during Diffie-Hellman Group Exchange (DH-GEX) parameter validation in FIPS mode. When an SSH client connects to a compromised or attacker-controlled server, the server can send specially crafted DH-GEX parameters that cause the client process to crash, resulting in a denial of service. This affects users and automated systems that initiate SSH connections to untrusted or compromised servers.

• CVE-2026-9791MEDIUM 4.3

  An authenticated user who belongs to a Keycloak organization can request tokens or access APIs in ways that expose organization metadata, even after an administrator has turned off the Organizations feature. This metadata leakage could cause downstream applications (resource servers) to make incorrect access control decisions based on stale or unintended organization information.

• CVE-2026-9798MEDIUM 4.3

  Keycloak's account lockout feature, which temporarily disables accounts after repeated failed login attempts, can be bypassed when an attacker possesses valid client credentials. By using the Client-Initiated Backchannel Authentication (CIBA) flow—a legitimate OAuth 2.0 feature—attackers can circumvent the lockout and continue attempting to authenticate or obtain tokens. This undermines brute-force protection and creates a secondary path for unauthorized access once the attacker has obtained initial client credentials.

• CVE-2026-13218MEDIUM 4.2

  KubeVirt's virt-handler component contains a symlink-following vulnerability in its network cache handling. When virt-handler writes cached network configuration files, it does not validate whether the target path is a symlink. An attacker with access to a virt-launcher container can plant a symlink at the expected cache file location, tricking virt-handler into overwriting an arbitrary file on the host system and changing its ownership. This is a local privilege escalation vector that requires container-level access to exploit but can impact the integrity of host system files.

• CVE-2026-13322LOW 3.8

  A memory exhaustion vulnerability exists in KubeVirt's downward metrics virtio-serial server. When a guest VM has this device enabled, a local attacker can repeatedly write data without line breaks, forcing the virt-handler process to allocate unbounded memory until the process crashes. This requires prior VM access and affects deployments where the downward metrics feature is configured.

• CVE-2026-15041LOW 3.7

  389 Directory Server contains a timing-based information disclosure vulnerability in its PBKDF2-SHA256 password hashing implementation. Instead of using a constant-time comparison function, the server uses standard memcmp() to verify password hashes during LDAP authentication. While an attacker could theoretically measure minute timing differences across many bind attempts to extract partial hash information, the practical difficulty is extremely high due to PBKDF2's intentional computational overhead. This is a low-severity issue affecting authentication security rather than availability or integrity.

• CVE-2026-55654LOW 3.7

  OpenSSH has a flaw in how it cleans up authentication indicators when using GSSAPI (Kerberos-based authentication). The vulnerability is a heap memory read that goes out of bounds because the code expects a NULL terminator in an array that is missing. This causes the SSH daemon to crash when handling authentication in specific Kerberos environments, making the service temporarily unavailable. An attacker on the network can trigger this without authentication credentials, though it requires GSSAPI to be enabled and properly configured.

• CVE-2026-11786LOW 1.9

  A parsing flaw in 389 Directory Server can cause the LDIF (LDAP Data Interchange Format) parser to read past the boundary of allocated memory when it encounters attribute types ending with semicolons during database imports. The defect is detectable only under memory instrumentation tools (such as AddressSanitizer) and does not cause immediate functional failure or crashes under normal operation. This is a low-severity out-of-bounds read affecting local, high-privileged operations.