RHSA-2026:86618CriticalCVSS 9.8

Red Hat Security Advisory: New container image: rhceph-9.2

Published
October 21, 2026
Last Modified
October 21, 2026

🔗 CVE IDs covered (54)

CVE-2025-15599 →CVE-2025-50181 →CVE-2026-27904 →CVE-2026-41240 →CVE-2026-42041 →CVE-2025-26791 →CVE-2025-69873 →CVE-2026-0540 →CVE-2026-21441 →CVE-2026-22610 →CVE-2026-25639 →CVE-2026-32141 →CVE-2026-42043 →CVE-2025-12816 →CVE-2025-66030 →CVE-2026-42034 →CVE-2025-30156 →CVE-2025-50182 →CVE-2025-66035 →CVE-2025-66412 →CVE-2026-33896 →CVE-2026-42037 →CVE-2026-42040 →CVE-2026-58224 →CVE-2024-48916 →CVE-2024-55565 →CVE-2025-59343 →CVE-2026-27903 →CVE-2026-33891 →CVE-2026-33894 →CVE-2026-50152 →CVE-2025-58754 →CVE-2026-40175 →CVE-2026-40895 →CVE-2026-41238 →CVE-2026-42033 →CVE-2026-42035 →CVE-2026-42036 →CVE-2026-42039 →CVE-2023-46159 →CVE-2025-62718 →CVE-2026-27970 →CVE-2026-33228 →CVE-2026-33672 →CVE-2026-39865 →CVE-2026-41239 →CVE-2026-41305 →CVE-2024-47866 →CVE-2026-26996 →CVE-2026-33671 →CVE-2026-33895 →CVE-2026-42038 →CVE-2026-42042 →CVE-2026-42044 →

📋 Description

CVE-2023-46159 — ceph: RGW crash upon misconfigured CORS rule CVE-2024-47866 — rgw: RGW DoS attack with empty HTTP header in S3 object copy CVE-2024-48916 — ceph: rhceph-container: Authentication bypass in CEPH RadosGW CVE-2024-55565 — nanoid: nanoid mishandles non-integer values CVE-2025-12816 — node-forge: node-forge: Interpretation conflict vulnerability allows bypassing cryptographic verifications CVE-2025-15599 — DOMPurify: DOMPurify: Cross-site scripting CVE-2025-26791 — dompurify: Mutation XSS in DOMPurify Due to Improper Template Literal Handling CVE-2025-30156 — kernel: ceph: kernel: Ceph: exploit of hardcoded IVECs, in a misuse of AES, resulting in authentication bypass CVE-2025-50181 — urllib3: urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation CVE-2025-50182 — urllib3: urllib3 does not control redirects in browsers and Node.js CVE-2025-58754 — axios: Axios DoS via lack of data size check CVE-2025-59343 — tar-fs: tar-fs symlink validation bypass CVE-2025-62718 — axios: Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization CVE-2025-66030 — node-forge: node-forge: Integer Overflow allows OID-based security bypass CVE-2025-66035 — angular: Angular HTTP Client Has XSRF Token Leakage via Protocol-Relative URLs CVE-2025-66412 — angular: Angular Stored XSS Vulnerability via SVG Animation, SVG URL and MathML Attributes CVE-2025-69873 — ajv: ReDoS via $data reference CVE-2026-0540 — DOMPurify: DOMPurify: Cross-site scripting vulnerability CVE-2026-21441 — urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API) CVE-2026-22610 — angular: Angular: Cross-site scripting vulnerability in Template Compiler CVE-2026-25639 — axios: Axios affected by Denial of Service via proto Key in mergeConfig CVE-2026-26996 — minimatch: minimatch: Denial of Service via specially crafted glob patterns CVE-2026-27903 — minimatch: minimatch: Denial of Service due to unbounded recursive backtracking via crafted glob patterns CVE-2026-27904 — minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions CVE-2026-27970 — @angular/core: Angular: Cross-site scripting via compromised translation files CVE-2026-32141 — flatted: flatted: Unbounded recursion DoS in parse() revive phase CVE-2026-33228 — flatted: Flatted: Prototype pollution vulnerability allows arbitrary code execution via crafted JSON. CVE-2026-33671 — picomatch: Picomatch: Regular Expression Denial of Service via crafted extglob patterns CVE-2026-33672 — picomatch: Picomatch: Data integrity compromised via method injection with crafted POSIX bracket expressions CVE-2026-33891 — node-forge: node-forge: Denial of Service via infinite loop in BigInteger.modInverse() CVE-2026-33894 — node-forge: Forge: Signature Forgery via Weak RSASSA PKCS#1 v1.5 Verification CVE-2026-33895 — node-forge: Forge: Authentication bypass via forged Ed25519 cryptographic signatures CVE-2026-33896 — node-forge: Forge (node-forge): Certificate validation bypass allows unauthorized certificate issuance CVE-2026-39865 — axios: Axios: Denial of Service via HTTP/2 session cleanup logic state corruption CVE-2026-40175 — axios: Axios: Remote Code Execution via Prototype Pollution escalation CVE-2026-40895 — follow-redirects: follow-redirects: Information disclosure via cross-domain redirects CVE-2026-41238 — DOMPurify: DOMPurify: Cross-Site Scripting bypass via prototype pollution CVE-2026-41239 — DOMPurify: Vue 2: DOMPurify: Cross-site scripting due to incomplete sanitization of template expressions CVE-2026-41240 — DOMPurify: DOMPurify: Cross-Site Scripting (XSS) via inconsistent tag sanitization CVE-2026-41305 — postcss: PostCSS: Cross-Site Scripting (XSS) via improper escaping of style closing tags CVE-2026-42033 — axios: Axios: HTTP Transport Hijacking via Prototype Pollution CVE-2026-42034 — axios: Axios: Denial of Service via oversized streamed uploads bypassing body limits CVE-2026-42035 — axios: Axios: Arbitrary HTTP header injection via prototype pollution CVE-2026-42036 — axios: Axios: Denial of Service via unbounded stream consumption when 'responseType: 'stream'' is used CVE-2026-42037 — axios: Node.js: Axios: Information disclosure via CRLF injection in multipart Content-Type header CVE-2026-42038 — axios: Axios: Information disclosure due to no_proxy bypass CVE-2026-42039 — axios: Node.js: Axios: Denial of Service via unbounded recursion in toFormData with deeply nested request data CVE-2026-42040 — axios: Axios: Incorrect null byte handling can lead to data integrity issues CVE-2026-42041 — axios: Axios: Authentication bypass due to prototype pollution of HTTP error handling CVE-2026-42042 — axios: Axios: XSRF token bypass leading to information disclosure CVE-2026-42043 — axios: Axios: NO_PROXY bypass via crafted URL CVE-2026-42044 — axios: Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget CVE-2026-50152 — ceph: ceph: MON subscription handler exposes config-key store to low-privilege CephX users CVE-2026-58224 — samba: CTDB fails to do integrity checking of received packets

🎯 Affected products29

  • Red Hat Ceph Storage 9.2
  • registry.redhat.io/rhceph/alloy-rhel10@sha256:418bfcb3127da79a33297b2d48718b1de233c833fe9e4f0bf135974d254ad417_s390x as a component of Red Hat Ceph Storage 9.2
  • registry.redhat.io/rhceph/alloy-rhel10@sha256:b8de881870e89c0559238b5e45ec1a197b819b0d76ad1bbeb36732232bcd9ce3_arm64 as a component of Red Hat Ceph Storage 9.2
  • registry.redhat.io/rhceph/alloy-rhel10@sha256:c44c3c02709d9effcee15e4c444d0933e4dc92200126256bc436a91315d661ce_ppc64le as a component of Red Hat Ceph Storage 9.2
  • registry.redhat.io/rhceph/alloy-rhel10@sha256:e1cbac58bcf8b551d5ea1b47f94798dcc632d81b38908f462e7d3e91771f60a4_amd64 as a component of Red Hat Ceph Storage 9.2
  • registry.redhat.io/rhceph/grafana-rhel10@sha256:0fa88412ee250b79e9af3c426d74d2e838342fda5ebe1b99662ae3368ec2b480_amd64 as a component of Red Hat Ceph Storage 9.2
  • registry.redhat.io/rhceph/grafana-rhel10@sha256:6f01015230f5c2ae3d75b9f0cae11538235e617a22d036dea04f6371769c1299_ppc64le as a component of Red Hat Ceph Storage 9.2
  • registry.redhat.io/rhceph/grafana-rhel10@sha256:bf7e7d9293a49520e6c07b6627cc1165b59d40b92ee15010a82735f8c4443602_s390x as a component of Red Hat Ceph Storage 9.2
  • registry.redhat.io/rhceph/grafana-rhel10@sha256:d5ecc8340af5598131845db29148b24b4a6da344ae9831c7ffd10a2847000208_arm64 as a component of Red Hat Ceph Storage 9.2
  • registry.redhat.io/rhceph/keepalived-rhel10@sha256:215b4d293664a13186f738a02307ad686ecd8c18e3154778cefc5cd48098244a_ppc64le as a component of Red Hat Ceph Storage 9.2
  • registry.redhat.io/rhceph/keepalived-rhel10@sha256:41eb459a0560110c950039d3ea5b34e235d05a06dd4c2f2da7ef14fecc641bdc_s390x as a component of Red Hat Ceph Storage 9.2
  • registry.redhat.io/rhceph/keepalived-rhel10@sha256:6c9d48d718885dfb5ab96e434f2b6cf1006a878c36595020cf57a8b24108affd_arm64 as a component of Red Hat Ceph Storage 9.2
  • registry.redhat.io/rhceph/keepalived-rhel10@sha256:97d8626437b17428366dccb70fc7d8eb22840623b164b491cceb66de07bc2279_amd64 as a component of Red Hat Ceph Storage 9.2
  • registry.redhat.io/rhceph/oauth2-proxy-rhel10@sha256:6028e75c091f45e699c18817ab387fc267566c3a99f35cbc16dd6678eca52b04_amd64 as a component of Red Hat Ceph Storage 9.2
  • registry.redhat.io/rhceph/oauth2-proxy-rhel10@sha256:7ffce56beb357c70924100d89b078786229036577b3fc5682fc9ffe937f9d011_arm64 as a component of Red Hat Ceph Storage 9.2
  • registry.redhat.io/rhceph/oauth2-proxy-rhel10@sha256:ad80f5f61a2f2c3bb39c4d787fba18dc3a3d99ac688b07110b946ff3c8c31bc4_s390x as a component of Red Hat Ceph Storage 9.2
  • registry.redhat.io/rhceph/oauth2-proxy-rhel10@sha256:bde0c68d5c31070466d8708b1e5cdf94587d1a01464ec03d40ebf30f5c7e1b11_ppc64le as a component of Red Hat Ceph Storage 9.2
  • registry.redhat.io/rhceph/rhceph-9-rhel10@sha256:4ea52cbdb1c42b970667045f794a8ad75d8d9df236a2d0e4751519a2c0904b87_amd64 as a component of Red Hat Ceph Storage 9.2
  • registry.redhat.io/rhceph/rhceph-9-rhel10@sha256:8401aa351c60cbb096283b1efaefa0b44012a9487fbee8c8342b77bbdbfb6111_arm64 as a component of Red Hat Ceph Storage 9.2
  • registry.redhat.io/rhceph/rhceph-9-rhel10@sha256:d6d5f168fb70e819659cdc47a64483b6509f3858b36df465e9c44533ab4af56c_ppc64le as a component of Red Hat Ceph Storage 9.2
  • registry.redhat.io/rhceph/rhceph-9-rhel10@sha256:dbaea4a6d152c0a28f467dfc77b01d25aeebc0d0b7bb159c991771ff4a680c0d_s390x as a component of Red Hat Ceph Storage 9.2
  • registry.redhat.io/rhceph/rhceph-haproxy-rhel10@sha256:2dd73def241db73d57cdac5cfc8f7e9b32728de0b86007dd28a4a33d91680d4d_s390x as a component of Red Hat Ceph Storage 9.2
  • registry.redhat.io/rhceph/rhceph-haproxy-rhel10@sha256:6e1f39f8225811070c27db40eba93cc567d44d43184ca10b317abad99ee0b485_amd64 as a component of Red Hat Ceph Storage 9.2
  • registry.redhat.io/rhceph/rhceph-haproxy-rhel10@sha256:8cffd72b960f38ac68d645e4a9bebefb41ea6ec86f6eade0e31e94e54eff9518_ppc64le as a component of Red Hat Ceph Storage 9.2
  • registry.redhat.io/rhceph/rhceph-haproxy-rhel10@sha256:972e07ea652e5c12087fdfa32d1aba063ceb507e7b36ed55f2e54d46c663fce3_arm64 as a component of Red Hat Ceph Storage 9.2
  • registry.redhat.io/rhceph/snmp-notifier-rhel10@sha256:1cb7e79a5c02999ac479fdd43fa2b99c5ad88b7211e7ad8142cdfce833e83e7e_arm64 as a component of Red Hat Ceph Storage 9.2
  • registry.redhat.io/rhceph/snmp-notifier-rhel10@sha256:3bf292a7d44614e5be829d1f3a4daeb2873405bd0886d0802bd32a9aacf6f781_amd64 as a component of Red Hat Ceph Storage 9.2
  • registry.redhat.io/rhceph/snmp-notifier-rhel10@sha256:e5a4422325d975bb20f0ab152279748f6b33ec6b87d6419418917ab25c889e4a_s390x as a component of Red Hat Ceph Storage 9.2
  • registry.redhat.io/rhceph/snmp-notifier-rhel10@sha256:f1b9bb921dd0c71c7c30b5880e9d15ac1f11be1fa1d6fccd8a4728a4df2369be_ppc64le as a component of Red Hat Ceph Storage 9.2

✅ Remediation

The container images provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the "podman pull" command. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To mitigate this issue, Red Hat recommends isolating the Ceph messenger protocol to dedicated internal networks with strict access controls, limiting exposure to potential attackers. Administrators should audit and minimize the number of CephX client credentials in circulation and enforce strong credential management to reduce the risk of low-privilege key compromise. Where possible, deploy msgr2 with on-wire encryption to reduce passive sniffing exposure. It is strongly advised to apply vendor-supplied patches as soon as they are released, upgrade to fixed Ceph versions (Tentacle 20.2.4 or later), and rotate all CephX keys to the new AES-256-CTS-HMAC-SHA384-192 cipher type, prioritizing server-side keys. Workaround: By using protocol-relative URLs (URLs starting with //) in HttpClient requests and/or Disabling XSRF token attachment for non-same-origin requests using custom Angular interceptors, this vulnerability can be mitigated. Workaround: You could always manually sanitize user-controlled input or Disable or restrict dynamic SVG/MathML usage where possible in order to mitigate this flaw. Workaround: To mitigate this issue, disable the $data feature if your application does not require it. If $data must be used, implement strict validation of the input fields that are referenced by the pattern keyword to ensure they contain only expected and safe characters. Workaround: This issue can be mitigating by avoiding the usage of dynamic bindings, this can be achieved by not using the Angular template binding `[attr.href]` when handling SVG `<script>` elements. If there's a need of using dynamic bindings, users are advised to validate the input against a strict list of trusted URLs on the server side before serving the values to the template. Workaround: To mitigate this issue, applications using Picomatch should avoid passing untrusted glob patterns for compilation or matching. Implementations can disable extglob support for untrusted patterns by setting `noextglob: true` in Picomatch configurations. Alternatively, reject or sanitize patterns containing nested extglobs or specific extglob quantifiers like `+()` and `*()`. Enforcing strict allowlists for accepted pattern syntax can also reduce exposure. If the application is a service, consider running the matching process in an isolated worker or separate process with time and resource limits, and apply application-level request throttling and input validation for any endpoint that accepts glob patterns. No service restart or reload is typically required for these application-level configuration changes, but verify the specific application's behavior. Workaround: To mitigate this issue, applications should sanitize or reject untrusted glob patterns, particularly those containing POSIX character classes like `[[:...:]]`. Avoid using POSIX bracket expressions if user input is involved. No service restart or reload is typically required for this operational control, but applications should be re-evaluated to ensure proper input handling. Workaround: To mitigate this issue, explicitly include `127.0.0.1` and `[::1]` in the `no_proxy` environment variable or application-specific proxy bypass configuration. This ensures that requests to these loopback addresses correctly bypass the proxy, preventing unintended information disclosure. Workaround: Validate and sanitize user-controlled input to remove null bytes before passing it to URL parameter construction. Standard axios request methods (axios.get, axios.post with a params object) do not use the vulnerable AxiosURLSearchParams helper and are not affected. Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (58)