RHSA-2026:69917HighCVSS 7.5

Red Hat Security Advisory: OpenShift Source To Image 1.6.4

Published
September 22, 2026
Last Modified
October 5, 2026

🔗 CVE IDs covered (7)

CVE-2026-33818 →CVE-2026-41178 →CVE-2026-56853 →CVE-2026-56860 →CVE-2026-56862 →CVE-2026-75593 →CVE-2026-15789 →

📋 Description

CVE-2026-15789 — buildkit: github.com/moby/buildkit: BuildKit: File escape vulnerability CVE-2026-33818 — encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal CVE-2026-41178 — github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers CVE-2026-56853 — net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service CVE-2026-56860 — net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution CVE-2026-56862 — crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages CVE-2026-75593 — github.com/moby/buildkit: BuildKit: File escape vulnerability allows unauthorized file modification

🎯 Affected products9

  • OpenShift Developer Tools and Services 1.6.4
  • registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:1a13a18c6ce149cb7f35d92b3b9ec387d7f5520e64732640e7b6623ae9b08c76_amd64 as a component of OpenShift Developer Tools and Services 1.6.4
  • registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:9415b7a37f636864f6a8c270889af97f983338cd7fcbf494382032bfff51baa9_ppc64le as a component of OpenShift Developer Tools and Services 1.6.4
  • registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:d805bea3d5bbaa3950e60d71c85949f99ca1a9536181138c08d994d995fbd554_s390x as a component of OpenShift Developer Tools and Services 1.6.4
  • registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:f7ba08425fda74d94390e3dda2fc8135c15eb1a6f4fdeb666f46d7ecb5480cfd_arm64 as a component of OpenShift Developer Tools and Services 1.6.4
  • registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:2ede56781677401ebdfe455a0e36f6a69eadc913adcdc90fddd4b137a420b820_amd64 as a component of OpenShift Developer Tools and Services 1.6.4
  • registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:8ced59d7063806177cbbb79eec99a10a5a9a3501103ffe819c90a6f4c4d0a6bb_arm64 as a component of OpenShift Developer Tools and Services 1.6.4
  • registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:acca1d1e326b4f13608d6f8497e984b2d6ff70b169858b84f33848e0b79dab2a_s390x as a component of OpenShift Developer Tools and Services 1.6.4
  • registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:e7019e87be4a040e668e361641a360be23fabe963070b123689c446499c1731f_ppc64le as a component of OpenShift Developer Tools and Services 1.6.4

✅ Remediation

It is recommended that existing users of OpenShift Source To Image upgrade to v1.6.4 Workaround: Restrict access to the BuildKit control API to only trusted users and services. Implement robust authentication and authorization policies for all clients interacting with the BuildKit daemon to prevent unauthorized access and potential file system escapes.

🔗 References (10)