RHSA-2026:91651CriticalCVSS 10.0

Red Hat Security Advisory: Red Hat Developer Hub 1.9.10 release.

Published
October 28, 2026
Last Modified
November 3, 2026

🔗 CVE IDs covered (32)

CVE-2026-84445 →CVE-2026-92950 →CVE-2026-92957 →CVE-2026-92935 →CVE-2026-92951 →CVE-2026-92958 →CVE-2026-93604 →CVE-2026-92944 →CVE-2026-92948 →CVE-2026-92956 →CVE-2026-92960 →CVE-2026-93603 →CVE-2026-92942 →CVE-2026-92946 →CVE-2026-92955 →CVE-2026-93606 →CVE-2026-47686 →CVE-2026-92934 →CVE-2026-92939 →CVE-2026-92953 →CVE-2026-92954 →CVE-2026-92959 →CVE-2026-111943 →CVE-2026-92941 →CVE-2026-92961 →CVE-2026-93605 →CVE-2026-47683 →CVE-2026-47698 →CVE-2026-92937 →CVE-2026-92938 →CVE-2026-92940 →CVE-2026-92947 →

📋 Description

CVE-2026-47683 — vm2: vm2: Denial of Service due to memory allocation limit bypass CVE-2026-47686 — vm2: vm2: Missing Error.cause Sanitization Enables VM2 Sandbox Escape to RCE CVE-2026-47698 — vm2: vm2: Sandbox Breakout Using Dangerous Host Proto Mutators CVE-2026-84445 — google.golang.org/grpc: gRPC-Go: Denial of Service via malformed RPC requests CVE-2026-92934 — vm2: vm2 before 3.11.8 Sandbox Escape RCE via AggregateError CVE-2026-92935 — vm2: vm2 NodeVM Remote Code Execution via Array-Shaped Require CVE-2026-92937 — vm2: vm2 3.11.6 Remote Code Execution via Promise call/apply CVE-2026-92938 — vm2: vm2 3.11.3 through 3.11.6 Remote Code Execution via node:sqlite CVE-2026-92939 — vm2: vm2 3.11.3 through 3.11.6 Native Code Execution via crypto.setEngine CVE-2026-92940 — vm2: vm2 3.11.3 through 3.11.6 HTTPS Credential Exposure via globalAgent CVE-2026-92941 — vm2: vm2 3.11.3 before 3.11.7 TLS Trust Store Manipulation CVE-2026-92942 — vm2: vm2: Denial of Service via timeout bypass in sandboxed code CVE-2026-92944 — vm2: vm2 3.10.2 through 3.11.6 Sandbox Escape via Promise Protector CVE-2026-92946 — vm2: vm2 before 3.11.7 Remote Code Execution via require.external CVE-2026-92947 — vm2: vm2 before 3.11.7 Memory Disclosure via Buffer Pool CVE-2026-92948 — vm2: vm2 3.9.6 through 3.11.5 Sandbox Escape via node:test CVE-2026-92950 — vm2: vm2 before 3.11.7 Sandbox Escape via CLI require CVE-2026-92951 — vm2: vm2 before 3.11.7 Module Allowlist Bypass via Custom Resolver CVE-2026-92953 — vm2: vm2 3.11.0 through 3.11.7 Prototype Pollution via TypedArray CVE-2026-92954 — vm2: vm2 3.10.0 through 3.11.5 Denial of Service via Host Promise CVE-2026-92955 — vm2: vm2 before 3.11.8 Sandbox Escape via NodeVM CVE-2026-92956 — vm2: vm2 3.10.1 through 3.11.6 Sandbox Escape via WebAssembly.compileStreaming CVE-2026-92957 — vm2: vm2 before 3.11.7 Authentication Bypass via node: Prefix CVE-2026-92958 — vm2: vm2: Sandbox escape via denylist bypass in NodeVM CVE-2026-92959 — vm2: vm2: Asynchronous code execution bypass via Promise thenable assimilation CVE-2026-92960 — vm2: vm2 before 3.11.6 Process-wide State Exposure via os and dns CVE-2026-92961 — vm2: vm2: Denial of Service via memory exhaustion CVE-2026-93603 — vm2: vm2 before 3.12.1 Sandbox Escape RCE via Non-Strict Host Function CVE-2026-93604 — vm2: vm2: Sandbox escape via crypto.setFips() function CVE-2026-93605 — vm2: vm2 NodeVM before 3.12.1 Remote Code Execution via child_process CVE-2026-93606 — vm2: vm2 before 3.12.1 Sandbox Escape via Promise Symbol.species CVE-2026-111943 — crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates

🎯 Affected products4

  • Red Hat Developer Hub 1.9
  • registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:9dffcd643d4a9d3d5cea982ccec08cf50198920d9a08672c7b29994120d3e4fa_amd64 as a component of Red Hat Developer Hub 1.9
  • registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:bbb5c34eb78780efa7168ae8d53a711a121174c5d7b4ec5f1a9187aba6f9e7ab_amd64 as a component of Red Hat Developer Hub 1.9
  • registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:b468b182954d3554b9b8934b65418233502ca24feb0ff66454c5f05e8055e35f_amd64 as a component of Red Hat Developer Hub 1.9

✅ Remediation

For more about Red Hat Developer Hub, see References links Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: This flaw is only reachable when the NodeVM sandbox configuration explicitly allows the node:test built-in and the application runs on Node.js 24 or later. As a workaround, remove node:test from the allowed builtins in the vm2 sandbox configuration (for example, drop it from the require.builtin allowlist), or run the embedding application on a Node.js version where the scheme-only node:test entry is not exposed (the exploit path is not present on Node.js 22). If test functionality must be exposed to sandboxed code, provide a sandbox-local wrapper using vm2's mock or override options that does not expose run(), process isolation, execArgv, or other host process controls. Otherwise, update to a build containing the fix: upstream vm2 is fixed in version 3.11.7, and updates for the affected Red Hat Ansible Automation Platform and Red Hat Developer Hub streams are available through the respective product releases. Workaround: Until the fix is applied, do not expose non-strict host functions to the sandbox. Only inject strict-mode or ES-module functions so a missing this cannot resolve to the host global. Workaround: This issue is fixed in vm2 version 3.12.1. Red Hat will provide updated versions of Developer Hub and Ansible Portal that include the fixed library version. Until updates are available, administrators can reduce the risk of sandbox escape attacks by implementing the following mitigations: 1. Review vm2 sandbox configurations to determine if the 'crypto' builtin is explicitly allowlisted for untrusted guest code (require.builtin: ['crypto']). If crypto access is not required for guest code functionality, remove it from the allowlist. 2. Restrict the sources from which untrusted code is accepted. Only allow code execution from authenticated, trusted users or verified sources. Implement code review processes for any scripts or plugins before they are executed in vm2 sandboxes. 3. Monitor for unexpected changes to the Node.js process FIPS mode. Log calls to crypto.getFips() before and after guest code execution to detect unauthorized FIPS mode modifications. 4. In FIPS-required environments, consider running vm2 sandboxes in separate isolated processes rather than in the same process as critical application components. Process-level isolation provides an additional security boundary beyond vm2's VM isolation. 5. Implement additional access controls and audit logging for any systems that accept and execute user-provided code, scripts, or plugins. 6. Upgrade to vm2 3.12.1 or later as soon as updated packages are available from Red Hat. Workaround: Until the fix is applied, do not configure NodeVM with require.builtin set to ['*'], a star-minus subtract list, or an explicit child_process allow. Use a tight builtin allowlist that excludes child_process. Workaround: Until the fix is applied, do not expose host functions that return host-realm Promise objects to VM/NodeVM. Return only serialized primitives, or keep host work fully outside the sandbox. Workaround: See the security bulletin for a detailed mitigation procedure.

🔗 References (38)