RHSA-2026:26010HighCVSS 7.8

Red Hat Security Advisory: Cluster Observability Operator 1.5.0

Published
June 15, 2026
Last Modified
August 23, 2026

🔗 CVE IDs covered (4)

CVE-2025-62718 →CVE-2026-32282 →CVE-2026-40895 →CVE-2026-42035 →

📋 Description

CVE-2025-62718 — axios: Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization CVE-2026-32282 — golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root CVE-2026-40895 — follow-redirects: follow-redirects: Information disclosure via cross-domain redirects CVE-2026-42035 — axios: Axios: Arbitrary HTTP header injection via prototype pollution

🎯 Affected products98

  • Cluster Observability Operator 1.5.0
  • registry.redhat.io/cluster-observability-operator/alertmanager-rhel9@sha256:097bfaefd53b1d7122884ccbe73dd8276c9337eac8cb6fdf75814da69307bc0e_arm64 as a component of Cluster Observability Operator 1.5.0
  • registry.redhat.io/cluster-observability-operator/alertmanager-rhel9@sha256:65117310947cf833b22b96da379a25df3a5602ddeedf04c39b50d58fff9961a8_ppc64le as a component of Cluster Observability Operator 1.5.0
  • registry.redhat.io/cluster-observability-operator/alertmanager-rhel9@sha256:cec172ff439b028db99a42b3fc9dc75b49c2d70ace72f65d36c2f417c43e68ce_amd64 as a component of Cluster Observability Operator 1.5.0
  • registry.redhat.io/cluster-observability-operator/alertmanager-rhel9@sha256:f5fa6c37a9823781e4a524248d1da7ad8e573741986bcdd354a4b0d5aaafd04e_s390x as a component of Cluster Observability Operator 1.5.0
  • registry.redhat.io/cluster-observability-operator/cluster-health-analyzer-rhel9@sha256:17b93177ac730c6390a1fe39be4ed181882fa73bf68b00502258e86ab53ac095_ppc64le as a component of Cluster Observability Operator 1.5.0
  • registry.redhat.io/cluster-observability-operator/cluster-health-analyzer-rhel9@sha256:aff10af04157a9a7b8cf9fa389b996fbf7b8a698b21f1a3ef329e9a608fd7957_arm64 as a component of Cluster Observability Operator 1.5.0
  • registry.redhat.io/cluster-observability-operator/cluster-health-analyzer-rhel9@sha256:bebcf03103a79a0b90126abcbc118ec81749f10c945a31905240b58dda508931_amd64 as a component of Cluster Observability Operator 1.5.0
  • registry.redhat.io/cluster-observability-operator/cluster-health-analyzer-rhel9@sha256:e42c7a0dbc8204c876be14daf38d64013abbd65a0d43332e39a2c9f7f7935af1_s390x as a component of Cluster Observability Operator 1.5.0
  • registry.redhat.io/cluster-observability-operator/cluster-observability-operator-bundle@sha256:425b2b4a4052ead84bc74254971b6d8e0f5ecb5ade3adccce576495254de5a84_amd64 as a component of Cluster Observability Operator 1.5.0
  • registry.redhat.io/cluster-observability-operator/cluster-observability-rhel9-operator@sha256:25af99f5848b732f23967c3a80e9afcd0126ce7842d820d3d402ddb272ba7e83_arm64 as a component of Cluster Observability Operator 1.5.0
  • registry.redhat.io/cluster-observability-operator/cluster-observability-rhel9-operator@sha256:a778331822dae612287b037206d9d108fd59b345155af084167c55029ece4161_s390x as a component of Cluster Observability Operator 1.5.0
  • registry.redhat.io/cluster-observability-operator/cluster-observability-rhel9-operator@sha256:cf2fed58420f29531f0016baf3f197b9ebf5065a8afd20f5500ef50cf193d8aa_ppc64le as a component of Cluster Observability Operator 1.5.0
  • registry.redhat.io/cluster-observability-operator/cluster-observability-rhel9-operator@sha256:e6a27484fca53bae05f0888419219c28034326b4e8ccaae69ce27fbcad45f94a_amd64 as a component of Cluster Observability Operator 1.5.0
  • registry.redhat.io/cluster-observability-operator/dashboards-console-plugin-rhel9@sha256:02c77c74157729d28d330d383490923b8b06e9e15e29b10cc6982386eb8ceeb8_s390x as a component of Cluster Observability Operator 1.5.0
  • registry.redhat.io/cluster-observability-operator/dashboards-console-plugin-rhel9@sha256:54b58db8870ee0e6263c6923d9949c23fb0dc8bb73877031b3b6fd1f1c012aac_ppc64le as a component of Cluster Observability Operator 1.5.0
  • registry.redhat.io/cluster-observability-operator/dashboards-console-plugin-rhel9@sha256:63f2b249af7d827611560076c3ccb36e8216bde41688fce42d17f9670ff46f18_amd64 as a component of Cluster Observability Operator 1.5.0
  • registry.redhat.io/cluster-observability-operator/dashboards-console-plugin-rhel9@sha256:f3aca14decdd20b7d1f589821df1a8ee729565f9a3801a0a204c4142a62941a7_arm64 as a component of Cluster Observability Operator 1.5.0
  • registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9@sha256:1d6cd78d5d6b07d7bbcc63a6798b5f39802c777415524f73f2fa9010db9ce980_arm64 as a component of Cluster Observability Operator 1.5.0
  • registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9@sha256:4ed2b5048fc80efe06acb3415bd40f0da935ddfb3c600921587c60fa065efcd6_amd64 as a component of Cluster Observability Operator 1.5.0
  • registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9@sha256:d7e53f157c6e2af042eab07e4624b849e3b637f3ab14a5135f4ffbba0893c724_ppc64le as a component of Cluster Observability Operator 1.5.0
  • registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9@sha256:db824ae172f2a1385a8635bf8eff7a209169d50a8b4edccb5bc222213b84d108_s390x as a component of Cluster Observability Operator 1.5.0
  • registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf5-rhel9@sha256:6058a9956d5c04d81fbb87cdba3099d94dcbb79eb4583dccc81a64d24527f3f8_s390x as a component of Cluster Observability Operator 1.5.0
  • registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf5-rhel9@sha256:9bf36df0753e597f3433e897831221363ee1c8789e73e0183d28d8348fc6d142_amd64 as a component of Cluster Observability Operator 1.5.0
  • registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf5-rhel9@sha256:d2d0fe37fe9aa6984d435e3111f7a4c02598149a8ddb0a1f86bca0d55919f120_arm64 as a component of Cluster Observability Operator 1.5.0
  • registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf5-rhel9@sha256:dea6ac7404cdde73e7dd9328509cefbf0f3bea8d139c4b6b79500c81797673c7_ppc64le as a component of Cluster Observability Operator 1.5.0
  • registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf6-rhel9@sha256:5c1141a046ae9765f0384c4284ef1a4448a5227cbf92e66b9023c845d7d91850_ppc64le as a component of Cluster Observability Operator 1.5.0
  • registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf6-rhel9@sha256:87f1326172dbc57b2a659d4fc77c4cc70bfd69f66ffdd4d42d4bddae564ef2d6_s390x as a component of Cluster Observability Operator 1.5.0
  • registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf6-rhel9@sha256:c4ec48537beee4dfb334d3b7ee5b2ba1ba376fffaf583f0a66230cf83557d47b_amd64 as a component of Cluster Observability Operator 1.5.0
  • registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf6-rhel9@sha256:eefc2a310a09a42c565f7b40277a5fb11eb2c150895e1cb1c88be4aa3582e1c5_arm64 as a component of Cluster Observability Operator 1.5.0
  • +68 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

🔗 References (9)