RHSA-2026:20938HighCVSS 8.7

Red Hat Security Advisory: RHACS 4.9.7 security and bug fix update

Published
May 26, 2026
Last Modified
September 24, 2026

🔗 CVE IDs covered (18)

CVE-2026-32281 →CVE-2026-40895 →CVE-2026-42033 →CVE-2026-42043 →CVE-2026-44496 →CVE-2026-42044 →CVE-2026-42264 →CVE-2026-44487 →CVE-2026-44495 →CVE-2026-40175 →CVE-2026-42039 →CVE-2026-44486 →CVE-2026-44492 →CVE-2026-44494 →CVE-2025-62718 →CVE-2026-42035 →CVE-2026-42041 →CVE-2026-44488 →

📋 Description

CVE-2025-62718 — axios: Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization CVE-2026-32281 — crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation CVE-2026-40175 — axios: Axios: Remote Code Execution via Prototype Pollution escalation CVE-2026-40895 — follow-redirects: follow-redirects: Information disclosure via cross-domain redirects CVE-2026-42033 — axios: Axios: HTTP Transport Hijacking via Prototype Pollution CVE-2026-42035 — axios: Axios: Arbitrary HTTP header injection via prototype pollution CVE-2026-42039 — axios: Node.js: Axios: Denial of Service via unbounded recursion in toFormData with deeply nested request data CVE-2026-42041 — axios: Axios: Authentication bypass due to prototype pollution of HTTP error handling CVE-2026-42043 — axios: Axios: NO_PROXY bypass via crafted URL CVE-2026-42044 — axios: Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget CVE-2026-42264 — axios: Axios: Prototype pollution allows information disclosure and request manipulation CVE-2026-44486 — axios: Axios: Information disclosure of proxy credentials via HTTP redirects CVE-2026-44487 — axios: Axios: Information disclosure of proxy credentials via redirect flows CVE-2026-44488 — axios: Axios: Denial of Service due to unenforced request and response size limits CVE-2026-44492 — axios: Axios: Proxy bypass via IPv4-mapped IPv6 address non-normalization CVE-2026-44494 — axios: Axios: Man-in-the-Middle (MITM) attack via Prototype Pollution CVE-2026-44495 — axios: Axios: Information disclosure due to prototype pollution vulnerability CVE-2026-44496 — axios: Axios: Client-side Denial of Service via unescaped regex metacharacters in XSRF cookie name

🎯 Affected products46

  • Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel8@sha256:35f6d1d992eea9f67da1adf5418823547cb0dff248a54556d06ec7156fb35e87_amd64 as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel8@sha256:553b8a7333d8106e57f1219d88ec16c3215e888659b4cb0c8c50f3ae87291c6c_arm64 as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel8@sha256:6772545c27997554b7b94a2d6017b80949757254b2ebdaba23667d59010100a6_ppc64le as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel8@sha256:babe2e99270875bb70f7e3c239cb2bd3d425cafd2c794efcd57d23924d9d0012_s390x as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-collector-rhel8@sha256:0f88c2913f1904a841a51a80a3e3209f56c80ad74e0b217a32ad99a7cffbb6fb_arm64 as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-collector-rhel8@sha256:24e7b2da3205f2c619394e87375974a532c57900e14aa5e15b2018d9f2caaba1_s390x as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-collector-rhel8@sha256:5ded5b808f00c26f0afc17808b1a5ab5a2877cca6bd90a98375ac253d3abeeca_ppc64le as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-collector-rhel8@sha256:5ec312a6d0e0e911f5187f8dbf6b3045ff70f52c555e181316b983008c00e4c2_amd64 as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8@sha256:2c05b3567adc67bc468830cdfc66e820f7cbb47ee0b5043a07be7ece7ab57a98_ppc64le as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8@sha256:95c56e8f242a9ec6be3cccd752eb0a37638b7a6c249b4363ed22e55ff659ef82_amd64 as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8@sha256:ad08006151b38330f5134c6c229a4c74361e85f4e4ad6124d41c0178f00d471d_arm64 as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8@sha256:de5929be6c71347b05b69ed72f9fd3c505fa72be437c224a2742240ff4f2cd47_s390x as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-operator-bundle@sha256:57da592df916a6bd9dfe90b2afc9a66b1cfb0da0053e87d0c65ef5c1bdf46969_amd64 as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator@sha256:3ff4a0d936d68e5e93b2eccf3b39271e5e6b510551fbb8c5f772db4bc5735771_amd64 as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator@sha256:8ca64e960ffe42a61f907fcda5e6bb99725c257d90e61360b948c9ccb41511cd_ppc64le as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator@sha256:a0e7621e8d564efbc12c1aaadfbccc30bc4581684970b9730d11ab9fb2a234f1_arm64 as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator@sha256:c1cdc9beb3858a95e559a3432440a85c6b68ab0fd48c52672e645747b1540734_s390x as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8@sha256:58dd6ad9728252d674ae923c43f836a1ba57ef756e995ba9a4c3c4aa79d5c90a_ppc64le as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8@sha256:5b73a668f7c0806f1a0496420f724b98c83540558e976f700fb2836c8339d77e_amd64 as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8@sha256:73fb048efc844d82f8b1b6f5ebd75cfc63b98d5818c815bea6f2af64c8fa8e9a_arm64 as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8@sha256:ec2d1346d211357af9a005e9ce76bbd66f3e57a966850c707e453f40e7c47b99_s390x as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:5eb84a8c05c25aa5d9d4e2d195ded7c0080075c8e93de13a1ac11f4f40723449_s390x as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:732beadbc0c0c1358ee6cee0121e88d576641669e8915bbbea49006642618bc8_arm64 as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:c0de0eeefda096ad2c5cc07be1146547a1181166bd9d0fa0027aebc6b0d44c51_amd64 as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:e1718a46c5a65053136d917e1618d745cce876b82d54f81b219d7618aff6cf95_ppc64le as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:288a49cc9c6a73d6a3afdf8fd5d3cc051449aa83085bc303458dabcc6eacc31d_amd64 as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:4dd03edf3099d6908424a5b56369617597335091ed47153066ffd8f65525930c_ppc64le as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:a252b5f2daf717143d7305b90c927b8f6e559de98fa9ad2763d6d5c4db0e6e9c_s390x as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:dc4a0674531b12fd31493d6046da3a6926151abbed9abec01402bc9966df5756_arm64 as a component of Red Hat Advanced Cluster Security 4.9
  • +16 more not shown

✅ Remediation

If you are using an earlier version of RHACS, you are advised to upgrade to the version of RHACS mentioned in the synopsis and release notes in order to take advantage of the enhancements, bug fixes, and/or security patches in the release. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

🔗 References (22)