RHSA-2026:20889HighCVSS 8.7

Red Hat Security Advisory: RHACS 4.10.3 security and bug fix update

Published
May 26, 2026
Last Modified
July 31, 2026

🔗 CVE IDs covered (19)

CVE-2026-42264 →CVE-2026-44486 →CVE-2026-44494 →CVE-2026-44495 →CVE-2026-25679 →CVE-2026-32280 →CVE-2026-44487 →CVE-2025-62718 →CVE-2026-32281 →CVE-2026-40895 →CVE-2026-42043 →CVE-2026-44488 →CVE-2026-42035 →CVE-2026-42041 →CVE-2026-42044 →CVE-2026-44492 →CVE-2026-44496 →CVE-2026-42033 →CVE-2026-42039 →

📋 Description

CVE-2025-62718 — axios: Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization CVE-2026-25679 — net/url: Incorrect parsing of IPv6 host literals in net/url CVE-2026-32280 — crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building CVE-2026-32281 — crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation CVE-2026-40895 — follow-redirects: follow-redirects: Information disclosure via cross-domain redirects CVE-2026-42033 — axios: Axios: HTTP Transport Hijacking via Prototype Pollution CVE-2026-42035 — axios: Axios: Arbitrary HTTP header injection via prototype pollution CVE-2026-42039 — axios: Node.js: Axios: Denial of Service via unbounded recursion in toFormData with deeply nested request data CVE-2026-42041 — axios: Axios: Authentication bypass due to prototype pollution of HTTP error handling CVE-2026-42043 — axios: Axios: NO_PROXY bypass via crafted URL CVE-2026-42044 — axios: Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget CVE-2026-42264 — axios: Axios: Prototype pollution allows information disclosure and request manipulation CVE-2026-44486 — axios: Axios: Information disclosure of proxy credentials via HTTP redirects CVE-2026-44487 — axios: Axios: Information disclosure of proxy credentials via redirect flows CVE-2026-44488 — axios: Axios: Denial of Service due to unenforced request and response size limits CVE-2026-44492 — axios: Axios: Proxy bypass via IPv4-mapped IPv6 address non-normalization CVE-2026-44494 — axios: Axios: Man-in-the-Middle (MITM) attack via Prototype Pollution CVE-2026-44495 — axios: Axios: Information disclosure due to prototype pollution vulnerability CVE-2026-44496 — axios: Axios: Client-side Denial of Service via unescaped regex metacharacters in XSRF cookie name

🎯 Affected products48

  • Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel8@sha256:04e380e189febad5d8dcbfaa68643963ab8d65d7089d32e30a1276837605e03a_arm64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel8@sha256:10b0b798c4690002c7ffe064b84cf5d0bb6f52045cd15bfe79b15bd68d4fbe8c_s390x as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel8@sha256:444df0b47d23743e19022b4a92e2ee9dd345598fb31f9b947f0bbdab7f59d90e_ppc64le as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel8@sha256:a32574be1c7a5a9ef0aa8b8ce4946ffe4920cb72b402eb17d1ca07c43925faef_amd64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-collector-rhel8@sha256:1563b3a0da76d7b35ecc4c563a8d347e9a558c8043da5c9588ad2f7f943a7ece_s390x as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-collector-rhel8@sha256:56e67cf62ffe4982d358ae06098da48f44175cd63239ebfb711b476404abb31a_amd64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-collector-rhel8@sha256:e077a56adee93c70cc339a83e47805691758c4e187195b0dd1d567133a5b6661_ppc64le as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-collector-rhel8@sha256:fe09f895ec18082b40abbcd7e546bb4bfeceb8dd4d7f1bed85310096333baa1d_arm64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-fact-rhel8@sha256:71e40863edd8c6275921449d977c396bf066e3ce87ad2c0e61f80003202637ab_arm64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-fact-rhel8@sha256:b4789552297c62abde45025c53087f258273431fc4921cab693997bb3aebfaff_amd64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8@sha256:16792cdca53b00c9f3b8a318270fe2970ee8a8b5b7b54a68f3e3c8412f30d802_s390x as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8@sha256:1c803425800df9af39869d7fe6512c954261a24228f017b8751d6fc93ee14d94_ppc64le as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8@sha256:7a45d15348cd7c48aada943ba0e9d6381f845267873d5c81cfaf501de2a3ae5b_arm64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8@sha256:89e70cfaebf46d63cd2c3ddcb4f5b44cfca68d8ec7379a00da7266da7a91f20c_amd64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-operator-bundle@sha256:dbbd62683e39389f91b5937a9d17a414243db53bb901ba7ebe17d24f8c78480e_amd64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator@sha256:4713cf6657eee34d58a329610050db2c3884b635260935ca69099be6bdd62400_arm64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator@sha256:a7a9a2165e13c9be2ccc1bcc157b33f1c3994256baf43f4ac4a76021c0880278_amd64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator@sha256:cde020c47589fd802cda98804da44218f34eec63396efb166a81274617d8acf4_ppc64le as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator@sha256:ceda1bd9270d37f947b4141be2a134767997f5135003b9d1f2007aed21c53a1e_s390x as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8@sha256:0c5bd402788e93b9795dbaa3dd82272339858972059e0e1017bb12a7a5fa52a1_arm64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8@sha256:51c6efd982283db3ffeebc152e58874601f1660ce76700c7110d11bca1d06688_amd64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8@sha256:9ec58aa0b8f1617d0a3e824cadaa8c939dada1f22e98c3a818bd85b0947dd9a5_ppc64le as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8@sha256:a0b8260a0c9b73d802891463c5427d1f3607acd62da928b1e4bd8aa7993649d4_s390x as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:348379199252e9c10cdc6268ce42ce039f12adc6e8e588b8105d2ce1e81ae439_amd64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:423d831317c9019733c1b2191568dd4f00890a4d4e26ada3067b7ba43a2b9b48_arm64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:9609056d08c8aff42326b2dea7733dc89ddfa019466c223bc0dfd22822627416_ppc64le as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:b693c67103bee5f49185b7cb2322ff174954b115938f0696d53a25b43f63f972_s390x as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:7624c0fe4943f89cb8ca709a9d84004ffe4a533498d2bba21a83a811e16da2a9_arm64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:905f591f2e1e2e3dbd17bc8b1f903ae7b5fc8e573f3708eb3a97a70c5dc412dc_s390x as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • +18 more not shown

✅ Remediation

If you are using an earlier version of RHACS, you are advised to upgrade to the version of RHACS mentioned in the synopsis and release notes in order to take advantage of the enhancements, bug fixes, and/or security patches in the release. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

🔗 References (23)