RHSA-2026:81201HighCVSS 7.6

Red Hat Security Advisory: Cost Management Metrics Operator Update

Published
October 12, 2026
Last Modified
October 30, 2026

🔗 CVE IDs covered (14)

CVE-2026-13757 →CVE-2026-14456 →CVE-2026-18382 →CVE-2026-18378 →CVE-2026-18381 →CVE-2026-18798 →CVE-2026-54369 →CVE-2026-54371 →CVE-2026-56392 →CVE-2026-63072 →CVE-2026-63076 →CVE-2026-5435 →CVE-2026-5928 →CVE-2026-6238 →

📋 Description

CVE-2026-5435 — glibc: glibc: Out-of-bounds write via TSIG record processing CVE-2026-5928 — glibc: glibc: Information disclosure or denial of service via ungetwc function with specific wide character encodings CVE-2026-6238 — glibc: glibc: Application crash or uninitialized memory read via crafted DNS response CVE-2026-13757 — p11-kit: Stack exhaustion via unbounded recursion in RPC attribute parsing CVE-2026-14456 — openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server CVE-2026-18378 — project-koku/koku-metrics-operator: koku-metrics-operator: cluster pull-secret token exfiltration via user-controlled api_url (SSRF / confused deputy) CVE-2026-18381 — project-koku/koku-metrics-operator: koku-metrics-operator: operator service-account token exfiltration via user-controlled Prometheus service_address CVE-2026-18382 — project-koku/koku-metrics-operator: koku-metrics-operator: service-account client credentials sent to user-controlled token_url CVE-2026-18798 — openssl: QUIC server may trigger double free when processing INITIAL packet CVE-2026-54369 — acl: Symlink traversal privilege escalation via libacl functions CVE-2026-54371 — attr: attr: Symlink Traversal Privilege Escalation via getfattr and setfattr CVE-2026-56392 — coreutils: GNU coreutils unexpand: Denial of Service via crafted tab stop values CVE-2026-63072 — openssl: heap buffer overflow in CMS key unwrapping CVE-2026-63076 — openssl: invalid pointer dereference in CMP server via crafted protectionAlg

🎯 Affected products6

  • Cost Management 4
  • registry.redhat.io/costmanagement/costmanagement-metrics-operator-bundle@sha256:237da915b912147a7a1fb899b73517234aaf29850fcdf031ea975833329a4b2b_amd64 as a component of Cost Management 4
  • registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:1c33b0f90b5ebd644833283c8bf8618fcc6d4adcf2b88474542b367403970b28_s390x as a component of Cost Management 4
  • registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:2314ac011e3897fa148651caa23507f014e3e55f885fd8af326b417e87aa65af_amd64 as a component of Cost Management 4
  • registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:cb8c639a89d6f3793761d30bb302abed5b862b705fb742f098e0931d75eaadc9_ppc64le as a component of Cost Management 4
  • registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:d7c927c4718907934daf9fb5dd9b02478b491d861d00f5ba0958dddb7dfee8ea_arm64 as a component of Cost Management 4

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://docs.openshift.com/container-platform/latest/operators/admin/olm-upgrading-operators.html Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: The affected functions are deprecated, application-debugging-only interfaces that are not part of the DNS resolver code path. Applications that call ns_printrrf(), ns_printrr(), or fp_nquery() can mitigate this issue by porting away from these interfaces, as recommended upstream, since they are not required for DNS resolution. For applications that cannot be changed, update to the glibc packages containing the fix that were released for the affected Red Hat products. Workaround: This CVE requires same-user access to the p11-kit RPC Unix domain socket (/run/user/<uid>/p11-kit/pkcs11-*). Any process running as the socket-owning user can trigger the crash without further authentication. If p11-kit is managed via systemd --user, ensure `Restart=on-failure` is set in the unit file so that a crash is automatically recovered without manual intervention. Red Hat recommends updating p11-kit to version 0.26.3 or later, which introduces a recursion depth limit in the RPC attribute parsing and fully addresses this flaw. Workaround: Option 1: Rate-limit or Firewall Inbound QUIC (UDP 443) [Goal: Slow or block QUIC Initial packets before they reach the vulnerable listener.] A. Confirm QUIC Exposure - Check if any service is listening on UDP 443: ~~~ $ ss -ulnp | grep ':443' # or $ sudo lsof -iUDP:443 -n -P ~~~ Note: If no service is listening on UDP 443, this CVE does not apply (TCP 443 is unaffected). B. Restrict Access to UDP 443 ( Default-deny UDP 443 and allow only trusted networks:) ~~~ $ sudo firewall-cmd --permanent --remove-service=quic 2>/dev/null $ sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.0.0.0/8" port port="443" protocol="udp" accept' $ sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" port port="443" protocol="udp" drop' $ sudo firewall-cmd --reload ~~~ C. Verify - Confirm the restriction by testing from an external host (the connection should fail or be throttled): ~~~ $ nc -u -v YOUR_HOST 443 ~~~ Option 2: Disable QUIC Server If QUIC/HTTP3 is not required, remove the vulnerable code path entirely and use TLS/TCP instead. Recommended Mitigation Priority Priority : Action 1.Confirm UDP 443 QUIC listener exists and OpenSSL version is in affected range 2.Block or rate-limit UDP 443 at firewall/edge (immediate) 3.Disable QUIC/HTTP3 on the service if not needed 4.Upgrade OpenSSL to fixed release when available 5.Application owners: set SSL_VALUE_QUIC_MAX_PENDING_CONNS if default 256 is too high Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Restrict unprivileged users from creating symlinks in directories that privileged processes operate on with ACL commands. Where possible, use the fs.protected_symlinks sysctl (enabled by default on RHEL 7+), which prevents symlink following in world-writable sticky directories unless the owner of the symlink matches the owner of the target file or directory.

🔗 References (19)