What is RHSA-2026:22959?

RHSA-2026:22959 is a security advisory published by Red Hat Product Security with High severity. Red Hat Security Advisory: Red Hat Web Terminal Operator 1.14.0 release.

Which CVE IDs does RHSA-2026:22959 cover?

RHSA-2026:22959 covers the following CVE IDs: CVE-2026-32280, CVE-2026-33186, CVE-2026-33810. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of RHSA-2026:22959?

RHSA-2026:22959 has a CVSS v3 base score of 9.1, published by Red Hat Product Security.

Which products are affected by RHSA-2026:22959?

RHSA-2026:22959 affects 5 products, including: Red Hat Web Terminal 1.14; registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:aaa925acd7b21f923fe19c7feb91ec96218f873a38263d4a4bcea2e773b06444_amd64 as a component of Red Hat Web Terminal 1.14; registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:b718e8e78ab364206bd889c7b4aba01b0475cb804dc361b54ad99331399587fd_amd64 as a component of Red Hat Web Terminal 1.14; registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:4f71ca0ae28fb645ef2dd66b15f4995cb4411368918c4da28b31d818102fed55_amd64 as a component of Red Hat Web Terminal 1.14; registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:7c5797371cb33199e0a9494bd82da2c4bf05ce045598640af33097fbee2ce90a_amd64 as a component of Red Hat Web Terminal 1.14.

RHSA-2026:22959HighCVSS 9.1

Red Hat Security Advisory: Red Hat Web Terminal Operator 1.14.0 release.

Vendor

Red Hat Product Security

Published

June 3, 2026

Last Modified

October 22, 2026

🔗 CVE IDs covered (3)

CVE-2026-32280 →CVE-2026-33186 →CVE-2026-33810 →

📋 Description

CVE-2026-32280 — crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building CVE-2026-33186 — google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation CVE-2026-33810 — crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application

🎯 Affected products5

Red Hat Web Terminal 1.14
registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:aaa925acd7b21f923fe19c7feb91ec96218f873a38263d4a4bcea2e773b06444_amd64 as a component of Red Hat Web Terminal 1.14
registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:b718e8e78ab364206bd889c7b4aba01b0475cb804dc361b54ad99331399587fd_amd64 as a component of Red Hat Web Terminal 1.14
registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:4f71ca0ae28fb645ef2dd66b15f4995cb4411368918c4da28b31d818102fed55_amd64 as a component of Red Hat Web Terminal 1.14
registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:7c5797371cb33199e0a9494bd82da2c4bf05ce045598640af33097fbee2ce90a_amd64 as a component of Red Hat Web Terminal 1.14

✅ Remediation

To start using the Web Terminal Operator, install the Web Terminal Operator from OpenShift OperatorHub on OpenShift Container Platform 4.19 or higher. Workaround: To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability.

🔗 CVE IDs covered (3)

📋 Description

🎯 Affected products5

✅ Remediation

🔗 References (9)