RHSA-2026:80644CriticalCVSS 9.9

Red Hat Security Advisory: Ansible plug-ins for Red Hat Developer Hub Product Release Update

Published
October 12, 2026
Last Modified
October 22, 2026

🔗 CVE IDs covered (27)

CVE-2026-92938 →CVE-2026-92939 →CVE-2026-92944 →CVE-2026-92948 →CVE-2026-92951 →CVE-2026-92954 →CVE-2026-92956 →CVE-2026-92957 →CVE-2026-92947 →CVE-2026-84961 →CVE-2026-85152 →CVE-2026-92935 →CVE-2026-92946 →CVE-2026-92953 →CVE-2026-92960 →CVE-2026-93603 →CVE-2026-47686 →CVE-2026-92941 →CVE-2026-92950 →CVE-2026-93605 →CVE-2026-93606 →CVE-2026-47698 →CVE-2026-92934 →CVE-2026-92937 →CVE-2026-92940 →CVE-2026-93604 →CVE-2026-101916 →

📋 Description

CVE-2026-47686 — vm2: vm2: Missing Error.cause Sanitization Enables VM2 Sandbox Escape to RCE CVE-2026-47698 — vm2: vm2: Sandbox Breakout Using Dangerous Host Proto Mutators CVE-2026-84961 — undici: undici: TLS certificate validation bypass in BalancedPool via dropped connect options CVE-2026-85152 — undici: undici: Authentication bypass via cross-origin cache poisoning due to missing origin isolation CVE-2026-92934 — vm2: vm2 before 3.11.8 Sandbox Escape RCE via AggregateError CVE-2026-92935 — vm2: vm2 NodeVM Remote Code Execution via Array-Shaped Require CVE-2026-92937 — vm2: vm2 3.11.6 Remote Code Execution via Promise call/apply CVE-2026-92938 — vm2: vm2 3.11.3 through 3.11.6 Remote Code Execution via node:sqlite CVE-2026-92939 — vm2: vm2 3.11.3 through 3.11.6 Native Code Execution via crypto.setEngine CVE-2026-92940 — vm2: vm2 3.11.3 through 3.11.6 HTTPS Credential Exposure via globalAgent CVE-2026-92941 — vm2: vm2 3.11.3 before 3.11.7 TLS Trust Store Manipulation CVE-2026-92944 — vm2: vm2 3.10.2 through 3.11.6 Sandbox Escape via Promise Protector CVE-2026-92946 — vm2: vm2 before 3.11.7 Remote Code Execution via require.external CVE-2026-92947 — vm2: vm2 before 3.11.7 Memory Disclosure via Buffer Pool CVE-2026-92948 — vm2: vm2 3.9.6 through 3.11.5 Sandbox Escape via node:test CVE-2026-92950 — vm2: vm2 before 3.11.7 Sandbox Escape via CLI require CVE-2026-92951 — vm2: vm2 before 3.11.7 Module Allowlist Bypass via Custom Resolver CVE-2026-92953 — vm2: vm2 3.11.0 through 3.11.7 Prototype Pollution via TypedArray CVE-2026-92954 — vm2: vm2 3.10.0 through 3.11.5 Denial of Service via Host Promise CVE-2026-92956 — vm2: vm2 3.10.1 through 3.11.6 Sandbox Escape via WebAssembly.compileStreaming CVE-2026-92957 — vm2: vm2 before 3.11.7 Authentication Bypass via node: Prefix CVE-2026-92960 — vm2: vm2 before 3.11.6 Process-wide State Exposure via os and dns CVE-2026-93603 — vm2: vm2 before 3.12.1 Sandbox Escape RCE via Non-Strict Host Function CVE-2026-93604 — vm2: vm2: Sandbox escape via crypto.setFips() function CVE-2026-93605 — vm2: vm2 NodeVM before 3.12.1 Remote Code Execution via child_process CVE-2026-93606 — vm2: vm2 before 3.12.1 Sandbox Escape via Promise Symbol.species CVE-2026-101916 — grpc-js: grpc-js: Authentication bypass via improper peer certificate validation

🎯 Affected products2

  • Red Hat Ansible Automation Platform 2.2
  • registry.redhat.io/ansible-automation-platform/automation-portal@sha256:cd22d7068dc9cdc475f4cb097b9019f54d5adf51927a3773c483040224018e96_amd64 as a component of Red Hat Ansible Automation Platform 2.2

✅ Remediation

For more about Ansible plugins for Red Hat Developer Hub, see References links Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Applications that do not use BalancedPool, or that use it without a custom function-valued connect/tls option, are not affected and require no action. As a workaround until packages are updated, avoid using BalancedPool for any connection that relies on custom TLS certificate validation (e.g. certificate pinning); use Client, Pool, or Agent instead, which are unaffected. The permanent fix is upgrading undici to 7.29.1 or later (7.x line) or 8.10.2 or later (8.x line). Workaround: Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible to undici 8.10.2 or later. Workaround: This flaw is only reachable when the NodeVM sandbox configuration explicitly allows the node:test built-in and the application runs on Node.js 24 or later. As a workaround, remove node:test from the allowed builtins in the vm2 sandbox configuration (for example, drop it from the require.builtin allowlist), or run the embedding application on a Node.js version where the scheme-only node:test entry is not exposed (the exploit path is not present on Node.js 22). If test functionality must be exposed to sandboxed code, provide a sandbox-local wrapper using vm2's mock or override options that does not expose run(), process isolation, execArgv, or other host process controls. Otherwise, update to a build containing the fix: upstream vm2 is fixed in version 3.11.7, and updates for the affected Red Hat Ansible Automation Platform and Red Hat Developer Hub streams are available through the respective product releases. Workaround: Until the fix is applied, do not expose non-strict host functions to the sandbox. Only inject strict-mode or ES-module functions so a missing this cannot resolve to the host global. Workaround: This issue is fixed in vm2 version 3.12.1. Red Hat will provide updated versions of Developer Hub and Ansible Portal that include the fixed library version. Until updates are available, administrators can reduce the risk of sandbox escape attacks by implementing the following mitigations: 1. Review vm2 sandbox configurations to determine if the 'crypto' builtin is explicitly allowlisted for untrusted guest code (require.builtin: ['crypto']). If crypto access is not required for guest code functionality, remove it from the allowlist. 2. Restrict the sources from which untrusted code is accepted. Only allow code execution from authenticated, trusted users or verified sources. Implement code review processes for any scripts or plugins before they are executed in vm2 sandboxes. 3. Monitor for unexpected changes to the Node.js process FIPS mode. Log calls to crypto.getFips() before and after guest code execution to detect unauthorized FIPS mode modifications. 4. In FIPS-required environments, consider running vm2 sandboxes in separate isolated processes rather than in the same process as critical application components. Process-level isolation provides an additional security boundary beyond vm2's VM isolation. 5. Implement additional access controls and audit logging for any systems that accept and execute user-provided code, scripts, or plugins. 6. Upgrade to vm2 3.12.1 or later as soon as updated packages are available from Red Hat. Workaround: Until the fix is applied, do not configure NodeVM with require.builtin set to ['*'], a star-minus subtract list, or an explicit child_process allow. Use a tight builtin allowlist that excludes child_process. Workaround: Until the fix is applied, do not expose host functions that return host-realm Promise objects to VM/NodeVM. Return only serialized primitives, or keep host work fully outside the sandbox.

🔗 References (31)