RHSA-2026:92342CriticalCVSS 7.4

Red Hat Security Advisory: RHACS 4.10.11 security and bug fix update

Published
October 29, 2026
Last Modified
October 31, 2026

🔗 CVE IDs covered (2)

CVE-2026-103314 →CVE-2026-114406 →

📋 Description

CVE-2026-103314 — stackrox: stackrox: SAML response replay allows multiple Central authentication tokens CVE-2026-114406 — ca-certificates: Distrust eMudhra intermediate CA certificates due to security concerns

🎯 Affected products48

  • Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel8@sha256:037ad5e36a1375c3436cfaa5b6a0900fb92e456916016a4bbbaf7fd209a1d765_ppc64le as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel8@sha256:0402f8cd31c70470a28dcf5fa000302181d910686485c400c4fd9efa1d3aa7f0_arm64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel8@sha256:a91ad5fa860081bb5b1293f6cf090f0a48f03489e3dcca64f38640e3fe24b2e4_s390x as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel8@sha256:a9d4c1bfa8d3a810e13daf4f5c5e6a0ee6ce2c92da50a580a4db96fbf9ecaeb2_amd64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-collector-rhel8@sha256:15da91a64bd2d1eb1f68e70cad0091e4a517d771db04b18ad427ce2d8bf3fe31_s390x as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-collector-rhel8@sha256:249ffd4e8b6001a2fee583c027f3e0b07de88555608de373fc23148f2235a1f9_ppc64le as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-collector-rhel8@sha256:82ce217fcf6bb27a607e30f4cb2a476f82d1e545f1ec99ea44ffcabc820af7c5_amd64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-collector-rhel8@sha256:896201901b7f9276d3dbdb495a79d3c6b16aaa7de2f1bb87481a357f3c04dbe0_arm64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-fact-rhel8@sha256:a0a692cdfb78c7071f12765d6001519e006a281e3dcee6c08ef3c304e6f7a7f7_amd64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-fact-rhel8@sha256:d4fdfdf2a91ee03354a4d00fe3794657c2573aeda334a481894f90ca250cdbbc_arm64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8@sha256:29b1cecc584eb50bfd900f83cdadfb4fab26ddb71ce906cfb7b32cd7d472bb56_s390x as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8@sha256:989bb75509d534521d65054bedb9df99152f6da31c2394233281a28c19497d2f_arm64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8@sha256:e19763c3e063bb594aa8c3c2ac85cb51eaa58ce11553762e25607d53cc377abd_amd64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8@sha256:e604d2db616261543f0d0c6e3b7e70b6d375077cbbd786c2c53ff4fe81362d53_ppc64le as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-operator-bundle@sha256:f16df060a95b53ab421c709db9714e07dbf4a22888ff405bb72984906313adf3_amd64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator@sha256:297e0e368f2ad7a91acebffe7d0a5865f4444545ff7449076290658cb1579718_ppc64le as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator@sha256:2f28c36bf4e3f9edacd4e68d0d2a2a582d9333f56f717f8a4dc8ded26f0aed3a_arm64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator@sha256:9115a22dbed1249e5971c131dcc50cdd324d44399e699858ee61ffb4f3c5305c_amd64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator@sha256:9c70c119cc5f932d9919af50944a667065c1b3aa73dd9c808169b2a10d82da05_s390x as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8@sha256:0a16c5915ff5019059f8808614eda6d183980ae7ef1e9b3d270bdf85fe908356_s390x as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8@sha256:1991c39b47020ac1ce2df952505f22ffd1abfb559ebd9fb9d9a1aee1bc893043_ppc64le as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8@sha256:27f3ec5502aadd614f01b8b1955fc5dd55ef7a93b250dfda7eb20887013990f3_amd64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8@sha256:bbb8c18f89b6bd22f7ff89a0738b92ad7cdefd7cab49fdb06f3a1c2651f7ac35_arm64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:0833e3eea067416ccaedfa4137449b39ceb2a67bead843ba6933b747b86b6a1f_ppc64le as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:a05d835a25c36321a065fedb18360af120e690bd52c3b0009276dd1b535d1167_amd64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:f1ec40d3f8dd3c6a2b64b932ff9edd115d5ad39022263563d3cddaaffd16ee5c_s390x as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:f89521b51930d367a1e5de80ed0cf96f9610d1d2528e8d134ab6aad15d425e0a_arm64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:4952e09f19ea87fe093e56ed4c2a82ea3e9d88179237a347b930168bd682ad6f_ppc64le as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:adeafd0ad6ad56b45f989516762fd5cde046e80efbf83394b4c090325dfee23b_arm64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10
  • +18 more not shown

✅ Remediation

If you are using an earlier version of RHACS, you are advised to upgrade to the version of RHACS mentioned in the synopsis and release notes in order to take advantage of the enhancements, bug fixes, and/or security patches in the release. Workaround: Until an update is available, restrict network access to the Central SAML ACS endpoint to trusted identity providers and networks, and reduce SAML assertion lifetimes at the identity provider where possible. --- CME Mitigation Guidance (2026-10-20) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure. The highest-value action is to enforce replay tracking on the Central SAML Assertion Consumer Service endpoint to record and reject previously consumed assertion and response identifiers: upgrade to RHACS 4.11.6 (or the fixed Advanced Cluster Security/Rhacs Main Rhel builds), which record and reject previously consumed SAML response and assertion identifiers at the ACS endpoint, closing all 2 injection vectors (SAML response replay, SAML assertion identifier reuse). Until patched, this is only a concern on RHACS Central deployments on Linux with SAML authentication enabled and a reachable ACS endpoint — Deployments that do not use SAML authentication or rely on OIDC ID-token logins are unaffected — so Restrict network access to the Central SAML ACS endpoint to trusted identity providers and networks, and reduce SAML assertion lifetimes at the identity provider. As a compensating measure, Configure host-based firewall rules using firewalld or nftables to restrict reachability to the Central SAML ACS endpoint to authorized identity providers and trusted client subnets and Apply network segmentation via VLANs or subnets to isolate the network path to RHACS Central and restrict reachability to the SAML ACS endpoint. These controls limit blast radius and contain exploitation, but they do not fix the underlying missing SAML replay protection defect — apply the upstream patch to fully remediate. Highest-impact CME: CME-202 Host-Based Firewall (firewalld/nftables) (medium) Workaround: See the security bulletin for a detailed mitigation procedure.

🔗 References (6)