RHSA-2026:26546HighCVSS 8.8

Red Hat Security Advisory: RHACS 4.9.8 security and bug fix update

Published
June 17, 2026
Last Modified
October 30, 2026

🔗 CVE IDs covered (7)

CVE-2026-39835 →CVE-2026-42502 →CVE-2026-42508 →CVE-2026-46595 →CVE-2026-39821 →CVE-2026-39828 →CVE-2026-39829 →

📋 Description

CVE-2026-39821 — golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing CVE-2026-39828 — golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions CVE-2026-39829 — golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters CVE-2026-39835 — golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate CVE-2026-42502 — golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering CVE-2026-42508 — golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey CVE-2026-46595 — golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authorization bypass due to skipped source-address validation

🎯 Affected products46

  • Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel8@sha256:6972f0c1cbb441f82433e265b3da8cdd8dc6856c56424585ee4ced3fe5c09ae1_amd64 as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel8@sha256:6c3f9482d525f3cee1abf475b2bdd4e1ac69f16a932da849c7dd8ecca97ef175_arm64 as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel8@sha256:a34def9aa384d43a25c7d5e54aae3444f6f7d46fc9700e91a080d537c6c6d87d_ppc64le as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel8@sha256:e7bd6232744fb5b788fd4ed5e28d3770e42c5ce6c01d882bb4b4fc572038ada1_s390x as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-collector-rhel8@sha256:0f88c2913f1904a841a51a80a3e3209f56c80ad74e0b217a32ad99a7cffbb6fb_arm64 as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-collector-rhel8@sha256:24e7b2da3205f2c619394e87375974a532c57900e14aa5e15b2018d9f2caaba1_s390x as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-collector-rhel8@sha256:5ded5b808f00c26f0afc17808b1a5ab5a2877cca6bd90a98375ac253d3abeeca_ppc64le as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-collector-rhel8@sha256:5ec312a6d0e0e911f5187f8dbf6b3045ff70f52c555e181316b983008c00e4c2_amd64 as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8@sha256:1f55e04796f54e86b86ed462745a8fcfb629ec9b31dbc449bc25b61eeaee4be6_amd64 as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8@sha256:211d4b3bdccbf62586c50074588e37d2635b1112a346fc709a0b340e2ec9f134_ppc64le as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8@sha256:84a3a5dd210a654ededb8bcd4c58dd02ed68edf671282c042329c7be2b7dee4d_arm64 as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8@sha256:ea9dd594528c8ba2b5ad7a9bf89546bb4001df09aa8c644a95f060a9637288ed_s390x as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-operator-bundle@sha256:886c4e82016a653f6119c8ba3a58c0ee9884264542d38b7af5ef471d41e381ab_amd64 as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator@sha256:3bf5f7c5328286a88696c6a629da9e5aed809bc84909e1e13cdbb7387e4b6189_ppc64le as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator@sha256:851c0dbbf68220913c9a87e9c7a81622b958321b3feb01adf63343581051b95a_s390x as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator@sha256:9842887f2f6f756fca35bbb44e43e5d9a108fd59e8b6531edac5d33713d40681_amd64 as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator@sha256:9edc0ebaa61a44080ee6d472bd3dcc7e983223ead478fe1b7ca26f3da53d5ebe_arm64 as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8@sha256:2fe9ce9a0255754b9a7fa37a4439a04d5175ede645624fc4d488e5f741f8fb42_s390x as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8@sha256:4beab5787841b5c1a31d5cdf557ed6f9255bbd9567bcbcd95bfb17fe8ceec7c4_amd64 as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8@sha256:bd262d2f59cbca8bb04249d7dd538e3ad9c7373a6b53552a054097e578d86231_ppc64le as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8@sha256:c2945542fefa78e8d76d65ddc1c786338429d2059dbfa8a9d0029c1ec895bbca_arm64 as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:5eb84a8c05c25aa5d9d4e2d195ded7c0080075c8e93de13a1ac11f4f40723449_s390x as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:732beadbc0c0c1358ee6cee0121e88d576641669e8915bbbea49006642618bc8_arm64 as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:c0de0eeefda096ad2c5cc07be1146547a1181166bd9d0fa0027aebc6b0d44c51_amd64 as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:e1718a46c5a65053136d917e1618d745cce876b82d54f81b219d7618aff6cf95_ppc64le as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:288a49cc9c6a73d6a3afdf8fd5d3cc051449aa83085bc303458dabcc6eacc31d_amd64 as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:4dd03edf3099d6908424a5b56369617597335091ed47153066ffd8f65525930c_ppc64le as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:a252b5f2daf717143d7305b90c927b8f6e559de98fa9ad2763d6d5c4db0e6e9c_s390x as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:dc4a0674531b12fd31493d6046da3a6926151abbed9abec01402bc9966df5756_arm64 as a component of Red Hat Advanced Cluster Security 4.9
  • +16 more not shown

✅ Remediation

If you are using an earlier version of RHACS, you are advised to upgrade to the version of RHACS mentioned in the synopsis and release notes in order to take advantage of the enhancements, bug fixes, and/or security patches in the release. Workaround: Upgrade to a fixed golang.org/x/net release that includes the idna correction, via updated golang or dependent package rebuilds. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Applications utilizing `golang.org/x/net/html` should implement robust sanitization of all untrusted HTML input before rendering to prevent the creation of unexpected HTML structures that could facilitate XSS attacks. If an application does not require rendering arbitrary HTML, it should avoid processing such input.

🔗 References (11)