RHSA-2026:83531HighCVSS 7.4

Red Hat Security Advisory: Red Hat Connectivity Link component - rhcl-operator security update

Published
October 15, 2026
Last Modified
October 17, 2026

🔗 CVE IDs covered (1)

CVE-2026-108334 →

📋 Description

CVE-2026-108334 — github.com/kuadrant/kuadrant-operator/internal/wasm: github.com/rh-api-management/rhcl-operator-product-build/kuadrant-operator: kuadrant-operator: Crafted HTTPRoute match values can bypass Gateway policy overrides

🎯 Affected products22

  • Red Hat Connectivity Link 1.4
  • registry.redhat.io/rhcl-1/developer-portal-controller-rhel9@sha256:17d03d77c3de19b64d7c4e14111b2462b1199c80e9466aaa3d3aee0d3aeeb292_arm64 as a component of Red Hat Connectivity Link 1.4
  • registry.redhat.io/rhcl-1/developer-portal-controller-rhel9@sha256:3e34a3d241b6e86155489a31385314ee0550b7caf8b565240c6944a04992abf9_amd64 as a component of Red Hat Connectivity Link 1.4
  • registry.redhat.io/rhcl-1/developer-portal-controller-rhel9@sha256:95fa76e5d27edb149b1ee59d4c54c63a6ddc100dbb5f5f5677357c08734d9b1b_s390x as a component of Red Hat Connectivity Link 1.4
  • registry.redhat.io/rhcl-1/developer-portal-controller-rhel9@sha256:e809522141b9792b946abebe9a3bcbd86036f49073d1559d1606ecae3e6427d2_ppc64le as a component of Red Hat Connectivity Link 1.4
  • registry.redhat.io/rhcl-1/rhcl-console-plugin-rhel9@sha256:036f60748869e8dd40552f7f602c91daadf193d856d502fb3d4c887e1a2c2a25_ppc64le as a component of Red Hat Connectivity Link 1.4
  • registry.redhat.io/rhcl-1/rhcl-console-plugin-rhel9@sha256:0e90150be71939193f3608b752d7de8f9e3ff4a47b4bede87c2094ae22095bff_ppc64le as a component of Red Hat Connectivity Link 1.4
  • registry.redhat.io/rhcl-1/rhcl-console-plugin-rhel9@sha256:0fab8dc4db9782df5aad2322aeeef8779bada270b959a53d894785514f648038_arm64 as a component of Red Hat Connectivity Link 1.4
  • registry.redhat.io/rhcl-1/rhcl-console-plugin-rhel9@sha256:56392cde70e8ea54d021f74e18b2c47eb0c42a4e70912f3e93c68ca9b8773042_amd64 as a component of Red Hat Connectivity Link 1.4
  • registry.redhat.io/rhcl-1/rhcl-console-plugin-rhel9@sha256:83a9f68981ad35914f4ce85d741f66500acf9c088e5bd5d037ed79bf73a82878_arm64 as a component of Red Hat Connectivity Link 1.4
  • registry.redhat.io/rhcl-1/rhcl-console-plugin-rhel9@sha256:99c74cd4d004035d2137d1a2be09773e66b241b4e657054060bf3d53c1a44b37_amd64 as a component of Red Hat Connectivity Link 1.4
  • registry.redhat.io/rhcl-1/rhcl-console-plugin-rhel9@sha256:a86d81367c6b6b5aa437add4c8af7abb06629fbd70e7c99f374b873fdde1063d_s390x as a component of Red Hat Connectivity Link 1.4
  • registry.redhat.io/rhcl-1/rhcl-console-plugin-rhel9@sha256:ae7d66552252a471967affb08b61ca40d868287c2f4fd9b9e33f024c59e74eb8_s390x as a component of Red Hat Connectivity Link 1.4
  • registry.redhat.io/rhcl-1/rhcl-operator-bundle@sha256:5da958ebb5d45bbbb694835cb39dc57240415a0dd205676b4f0f30291a272d5f_amd64 as a component of Red Hat Connectivity Link 1.4
  • registry.redhat.io/rhcl-1/rhcl-rhel9-operator@sha256:12671abafe8122e5fe60a08a84cc7d5e1d75b5f722943eacff3ddf51a9ad52ef_s390x as a component of Red Hat Connectivity Link 1.4
  • registry.redhat.io/rhcl-1/rhcl-rhel9-operator@sha256:2e3eb905055a94390d2db50fc7f70ad52f995ecef38a406863f5c26755a56e2e_amd64 as a component of Red Hat Connectivity Link 1.4
  • registry.redhat.io/rhcl-1/rhcl-rhel9-operator@sha256:68c69fac90d87f765cc305ccba7627ce8c84f9c2a02843492b597be0df1cd503_ppc64le as a component of Red Hat Connectivity Link 1.4
  • registry.redhat.io/rhcl-1/rhcl-rhel9-operator@sha256:84210479b0079c182d67feee8ca2d48de226fc5a592cd7ea0bc286282ffe05c6_arm64 as a component of Red Hat Connectivity Link 1.4
  • registry.redhat.io/rhcl-1/wasm-shim-rhel9@sha256:56ec54c27e4541986cfcdee6c9b15932f2e07d879d59097c1a681e9debe4f511_s390x as a component of Red Hat Connectivity Link 1.4
  • registry.redhat.io/rhcl-1/wasm-shim-rhel9@sha256:647f779ab38a88626d1dd68b234ad332e6539c508c72a6856d75672eaed38e1e_amd64 as a component of Red Hat Connectivity Link 1.4
  • registry.redhat.io/rhcl-1/wasm-shim-rhel9@sha256:6923146e13b5dde51d5123811b8aab2f3fe5186090c3d72cffb414d6ea1e1316_ppc64le as a component of Red Hat Connectivity Link 1.4
  • registry.redhat.io/rhcl-1/wasm-shim-rhel9@sha256:fd6755792999aea425c5af907fc3ede902b605c69ab44f9b8b6403ab2e02a3b8_arm64 as a component of Red Hat Connectivity Link 1.4

✅ Remediation

This release includes a security update for Red Hat Connectivity Link 1.4. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) here: https://access.redhat.com/security/updates/classification/ Red Hat Connectivity Link simplifies, secures, and manages application traffic across hybrid and multicloud environments. Consolidate multiple networking functions into a single integrated platform and extend the Gateway API through policies to apply advanced security and rate limiting across clusters. See the documentation to install Red Hat Connectivity Link at https://docs.redhat.com/en/documentation/red_hat_connectivity_link/latest. Workaround: Until a fixed release is available, restrict HTTPRoute creation and modification for routes attached to the shared Gateway, and review or remove routes with match values that trigger the predicate injection. Where possible, enforce authentication and rate limiting at the backend as additional controls. An admission policy could reject confirmed exploit patterns, but validate it against legitimate routes; Gateway API match values can contain special characters. These measures reduce exposure but do not fix the shim. The backend and admission-policy measures are compensating controls; their effectiveness depends on the deployment and the specific route behavior

🔗 References (4)