Red Hat Product Security (CVE pages and RHSA errata)
redhat-product-security-cve · A · candidate
https://access.redhat.com/security/cve/cve-2026-123710
Red Hat is CNA for Quay, OpenShift and RHEL products; the Quay CVE pages carry statement, mitigation and fixed builds. | Fetch: `extract <URL>` for https://access.redhat.com/security/cve/<cve-id>; the structured data is at access.redhat.com/hydra/rest/securitydata/cve/<CVE>.json and security.access.redhat.com/data/csaf/v2/vex/<year>/<cve>.json; `extract` drops CVE and fix lists on errata pages, use `url --direct` there. | Added 2026-11-14 as a candidate (promote to active after 3 contributing runs).
Cited in 15 entries
Citation cadence
Citation days per ISO week (28 weeks of coverage span, total 13).
- CVE-2026-123710 and CVE-2026-110697, Red Hat Quay: an anonymous client can install its own registry signing key and read or overwrite every private image (CVSS 3.1 9.8), and a low-privilege account can steal other tenants' robot tokens (9.9); fixed in Quay 3.9.28 to 3.18.3, no fix for Quay 5 or the mirror registry, no exploitation reported2026-11-14
- CVE-2026-119618, Apache HTTP Server 2.4.55 to 2.4.70: a race in mod_http2 assign_headers() corrupts heap memory and leads to remote code execution on servers with HTTP/2 enabled; fixed in 2.4.71, Red Hat calls it unauthenticated and claims public exploit research, no exploitation reported2026-11-12
- CVE-2026-117691, Keycloak SAML HTTP-Redirect signature bypass: a percent-encoded parameter name lets an unauthenticated attacker log in as any federated user; fixed in Keycloak 26.8.22026-11-08
- CVE-2026-98432, Linux kernel IPv4 TCP: a use-after-free in connection setup, present since 4.4, has an Anthropic-built remote root exploit against MPTCP listeners that CloudLinux could not reproduce; Citrix XenServer, XCP-ng, MikroTik, Red Hat, Debian, CIQ, Amazon Linux, Ubuntu's generic kernels for 22.04 to 26.10 and Sophos have fixes, Ubuntu 20.04 and older and some HWE, FIPS, NVIDIA and Azure variant kernels are in progress and WatchGuard and Fortinet have none for their products (CVSS 9.8)2026-10-31
- CVE-2026-109618 / CVE-2026-109619, PHP (PHP2Shell): two unauthenticated remote-code-execution flaws in the runtime, fixed on 2026-10-21 in 8.5.12, 8.4.27, 8.3.36 and 8.2.35, with attack traffic already observed and no upstream release for 8.1 and older (CVSS 4.0 9.2)2026-10-21
- CISA KEV adds three unrelated Linux kernel flaws in one day: kTLS receive-path logic error, AF_ALG race condition, netfilter ebtables SNAT out-of-bounds write2026-09-19
- CVE-2026-18963; Keycloak's password-reset flow can be driven to completion without the verification email being clicked, handing an unauthenticated attacker any account including administrators (CVSS 9.1)2026-08-19
- CVE-2026-16443, Keycloak: importing SAML metadata without key-usage attributes silently disables response signature validation, so an unauthenticated attacker forges a login as any known user2026-08-07
- CVE-2026-46331, Linux kernel "pedit COW": out-of-bounds write in the tc act_pedit module (public weaponised PoC)2026-06-27
- CVE-2026-43503, Linux kernel "DirtyClone": page-cache corruption via XFRM/IPsec skb cloning (working PoC)2026-06-27
- Linux cgroups v1 release_agent container escape (CVE-2022-0492) re-enters active exploitation2026-06-03
- Keycloak 26.6.2 fixes 16 security issues, among them an OIDC login session fixation (CVE-2026-7507) and a WebAuthn execute-actions token replay (CVE-2026-37982)2026-05-21
- CVE-2026-46300, Linux kernel: local privilege escalation via xfrm ESP-in-TCP ("Fragnesia"), listed by CISA as exploited and chained with the PHP2Shell flaws to reach root, PoC public2026-05-15
- CVE-2026-43284 / CVE-2026-43500 Linux Dirty Frag: deterministic page-cache write to root through xfrm-ESP and RxRPC, public exploit, fixes released2026-05-09
- CVE-2026-31431 Copy Fail: Linux kernel AF_ALG page-cache write gives any local user root on mainstream distributions, public exploit, CISA KEV-listed (CVSS 7.8)2026-05-09