What is RHSA-2026:22961?

RHSA-2026:22961 is a security advisory published by Red Hat Product Security with High severity. Red Hat Security Advisory: Red Hat Web Terminal Operator 1.15.0 release.

Which CVE IDs does RHSA-2026:22961 cover?

RHSA-2026:22961 covers the following CVE IDs: CVE-2026-32280, CVE-2026-33186, CVE-2026-33810. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of RHSA-2026:22961?

RHSA-2026:22961 has a CVSS v3 base score of 9.1, published by Red Hat Product Security.

Which products are affected by RHSA-2026:22961?

RHSA-2026:22961 affects 5 products, including: Red Hat Web Terminal 1.15; registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:5befa6458e607653380dd9eb365716303b7deba759313849213367a3b56d8fcd_amd64 as a component of Red Hat Web Terminal 1.15; registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:0e48134439b90bf039806daf1b4446ea047c0f55638fb273b12493c038aae065_amd64 as a component of Red Hat Web Terminal 1.15; registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:5a1940fa7577523dc3d1e1435e48e496abdcc7303552a418614ec4137f64e040_amd64 as a component of Red Hat Web Terminal 1.15; registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:0cd46a662d9a8ced0bd3145d49c7b02465acb6c3a985d0857f7592a6ee7a95e8_amd64 as a component of Red Hat Web Terminal 1.15.

RHSA-2026:22961HighCVSS 9.1

Red Hat Security Advisory: Red Hat Web Terminal Operator 1.15.0 release.

Vendor

Red Hat Product Security

Published

June 3, 2026

Last Modified

October 20, 2026

🔗 CVE IDs covered (3)

CVE-2026-32280 →CVE-2026-33186 →CVE-2026-33810 →

📋 Description

CVE-2026-32280 — crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building CVE-2026-33186 — google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation CVE-2026-33810 — crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application

🎯 Affected products5

Red Hat Web Terminal 1.15
registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:5befa6458e607653380dd9eb365716303b7deba759313849213367a3b56d8fcd_amd64 as a component of Red Hat Web Terminal 1.15
registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:0e48134439b90bf039806daf1b4446ea047c0f55638fb273b12493c038aae065_amd64 as a component of Red Hat Web Terminal 1.15
registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:5a1940fa7577523dc3d1e1435e48e496abdcc7303552a418614ec4137f64e040_amd64 as a component of Red Hat Web Terminal 1.15
registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:0cd46a662d9a8ced0bd3145d49c7b02465acb6c3a985d0857f7592a6ee7a95e8_amd64 as a component of Red Hat Web Terminal 1.15

✅ Remediation

To start using the Web Terminal Operator, install the Web Terminal Operator from OpenShift OperatorHub on OpenShift Container Platform 4.20 or higher. Workaround: To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability.

🔗 CVE IDs covered (3)

📋 Description

🎯 Affected products5

✅ Remediation

🔗 References (9)