RHSA-2026:26547HighCVSS 8.8

Red Hat Security Advisory: RHACS 4.10.4 security and bug fix update

Published
June 17, 2026
Last Modified
October 29, 2026

🔗 CVE IDs covered (7)

CVE-2026-42502 →CVE-2026-42508 →CVE-2026-46595 →CVE-2026-39821 →CVE-2026-39828 →CVE-2026-39829 →CVE-2026-39835 →

📋 Description

CVE-2026-39821 — golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing CVE-2026-39828 — golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions CVE-2026-39829 — golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters CVE-2026-39835 — golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate CVE-2026-42502 — golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering CVE-2026-42508 — golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey CVE-2026-46595 — golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authorization bypass due to skipped source-address validation

🎯 Affected products48

  • Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel8@sha256:3120b9da663ad13dd25bf0a442047aa6e091818ac92e0dfbf0466790aff3a815_ppc64le as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel8@sha256:830fb20771985e278a3f1596ad01dde699ac301fd66a513b3c5d48033ef87677_s390x as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel8@sha256:aa0f7291442d421a05a630f4f1353dd771efee18804378e99bba87bf53807898_arm64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel8@sha256:cc671d793496771a5ab3573787848947b8b38cbf0de653c48d1a59e38d6f540b_amd64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-collector-rhel8@sha256:1563b3a0da76d7b35ecc4c563a8d347e9a558c8043da5c9588ad2f7f943a7ece_s390x as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-collector-rhel8@sha256:56e67cf62ffe4982d358ae06098da48f44175cd63239ebfb711b476404abb31a_amd64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-collector-rhel8@sha256:e077a56adee93c70cc339a83e47805691758c4e187195b0dd1d567133a5b6661_ppc64le as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-collector-rhel8@sha256:fe09f895ec18082b40abbcd7e546bb4bfeceb8dd4d7f1bed85310096333baa1d_arm64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-fact-rhel8@sha256:71e40863edd8c6275921449d977c396bf066e3ce87ad2c0e61f80003202637ab_arm64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-fact-rhel8@sha256:b4789552297c62abde45025c53087f258273431fc4921cab693997bb3aebfaff_amd64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8@sha256:1fa196c12883f368c939e73e29ef164007bea29bc862d1f62ecbd4e88a8e02ee_s390x as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8@sha256:2265ec2ee6b2d7ad99ead7b0027340f943967fa2ad209f5ad047980b50e2c606_amd64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8@sha256:701e03be8af9dcf8c225aedcadd16bc0659ffe23ec144e392d8e5426574aa981_arm64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8@sha256:9b9d13c05147f584ed0f7a011b62bfd7fdc09922cccb4905fd42c135375a7940_ppc64le as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-operator-bundle@sha256:d96aad39e2545948e5aee4c81335acf99a2390502d2f1a9d363445536d46563b_amd64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator@sha256:35da98e6493df539685c846a3cb691efec2fffa7f103e8885ab81304d06188b2_amd64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator@sha256:5288127fdadf1ea1b50a33409d904d92d947d4c05ff04702bcd133eb0725fad2_arm64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator@sha256:c92440378491376cc51bfc0b90dd1eff8a760e541c9b8ffad03814b31e78bc82_s390x as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator@sha256:ff8305c16f5d5b2ed33f31b683f567d2b1e16d030c71e487486f771081e27287_ppc64le as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8@sha256:4f8e6007a0cb0e06bc99b2e4eec712703529b54551c25321ff8a30c069a9fb05_ppc64le as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8@sha256:6274fff88b63efe2ab43679badba678e04bfbeff002196b181ef6dbcf6a64033_amd64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8@sha256:709dcc08b20a072e102b9af927b8dc8dc1e5a18dd32a3e021ed68f35ecac9eb4_arm64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8@sha256:bc44bfd54740ca3c1c9afdd476a75778f17a4cb236b7a94db1fb0579d56a188a_s390x as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:348379199252e9c10cdc6268ce42ce039f12adc6e8e588b8105d2ce1e81ae439_amd64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:423d831317c9019733c1b2191568dd4f00890a4d4e26ada3067b7ba43a2b9b48_arm64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:9609056d08c8aff42326b2dea7733dc89ddfa019466c223bc0dfd22822627416_ppc64le as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:b693c67103bee5f49185b7cb2322ff174954b115938f0696d53a25b43f63f972_s390x as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:7624c0fe4943f89cb8ca709a9d84004ffe4a533498d2bba21a83a811e16da2a9_arm64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:905f591f2e1e2e3dbd17bc8b1f903ae7b5fc8e573f3708eb3a97a70c5dc412dc_s390x as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • +18 more not shown

✅ Remediation

If you are using an earlier version of RHACS, you are advised to upgrade to the version of RHACS mentioned in the synopsis and release notes in order to take advantage of the enhancements, bug fixes, and/or security patches in the release. Workaround: Upgrade to a fixed golang.org/x/net release that includes the idna correction, via updated golang or dependent package rebuilds. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Applications utilizing `golang.org/x/net/html` should implement robust sanitization of all untrusted HTML input before rendering to prevent the creation of unexpected HTML structures that could facilitate XSS attacks. If an application does not require rendering arbitrary HTML, it should avoid processing such input.

🔗 References (11)