RHSA-2026:94632HighCVSS 7.5

Red Hat Security Advisory: Red Hat Edge Manager Version 1.2.2 Security Update

Published
November 3, 2026
Last Modified
November 3, 2026

🔗 CVE IDs covered (2)

CVE-2026-84445 →CVE-2026-92615 →

📋 Description

CVE-2026-84445 — google.golang.org/grpc: gRPC-Go: Denial of Service via malformed RPC requests CVE-2026-92615 — flightctl: flightctl: Package-global go-git HTTPS transport mutated per-repo -- cross-tenant TLS-config bleed

🎯 Affected products38

  • RHEM 1.2 for RHEL 10
  • RHEM 1.2 for RHEL 9
  • flightctl-0:1.2.2-1.el10.src as a component of RHEM 1.2 for RHEL 10
  • flightctl-0:1.2.2-1.el9.src as a component of RHEM 1.2 for RHEL 9
  • flightctl-agent-0:1.2.2-1.el10.aarch64 as a component of RHEM 1.2 for RHEL 10
  • flightctl-agent-0:1.2.2-1.el10.ppc64le as a component of RHEM 1.2 for RHEL 10
  • flightctl-agent-0:1.2.2-1.el10.s390x as a component of RHEM 1.2 for RHEL 10
  • flightctl-agent-0:1.2.2-1.el10.x86_64 as a component of RHEM 1.2 for RHEL 10
  • flightctl-agent-0:1.2.2-1.el9.aarch64 as a component of RHEM 1.2 for RHEL 9
  • flightctl-agent-0:1.2.2-1.el9.ppc64le as a component of RHEM 1.2 for RHEL 9
  • flightctl-agent-0:1.2.2-1.el9.s390x as a component of RHEM 1.2 for RHEL 9
  • flightctl-agent-0:1.2.2-1.el9.x86_64 as a component of RHEM 1.2 for RHEL 9
  • flightctl-cli-0:1.2.2-1.el10.aarch64 as a component of RHEM 1.2 for RHEL 10
  • flightctl-cli-0:1.2.2-1.el10.ppc64le as a component of RHEM 1.2 for RHEL 10
  • flightctl-cli-0:1.2.2-1.el10.s390x as a component of RHEM 1.2 for RHEL 10
  • flightctl-cli-0:1.2.2-1.el10.x86_64 as a component of RHEM 1.2 for RHEL 10
  • flightctl-cli-0:1.2.2-1.el9.aarch64 as a component of RHEM 1.2 for RHEL 9
  • flightctl-cli-0:1.2.2-1.el9.ppc64le as a component of RHEM 1.2 for RHEL 9
  • flightctl-cli-0:1.2.2-1.el9.s390x as a component of RHEM 1.2 for RHEL 9
  • flightctl-cli-0:1.2.2-1.el9.x86_64 as a component of RHEM 1.2 for RHEL 9
  • flightctl-observability-0:1.2.2-1.el10.aarch64 as a component of RHEM 1.2 for RHEL 10
  • flightctl-observability-0:1.2.2-1.el10.ppc64le as a component of RHEM 1.2 for RHEL 10
  • flightctl-observability-0:1.2.2-1.el10.s390x as a component of RHEM 1.2 for RHEL 10
  • flightctl-observability-0:1.2.2-1.el10.x86_64 as a component of RHEM 1.2 for RHEL 10
  • flightctl-observability-0:1.2.2-1.el9.aarch64 as a component of RHEM 1.2 for RHEL 9
  • flightctl-observability-0:1.2.2-1.el9.ppc64le as a component of RHEM 1.2 for RHEL 9
  • flightctl-observability-0:1.2.2-1.el9.s390x as a component of RHEM 1.2 for RHEL 9
  • flightctl-observability-0:1.2.2-1.el9.x86_64 as a component of RHEM 1.2 for RHEL 9
  • flightctl-selinux-0:1.2.2-1.el10.noarch as a component of RHEM 1.2 for RHEL 10
  • flightctl-selinux-0:1.2.2-1.el9.noarch as a component of RHEM 1.2 for RHEL 9
  • +8 more not shown

✅ Remediation

See the following documentation for details on how to enable Red Hat Edge Manager and more: https://docs.redhat.com/en/documentation/red_hat_edge_manager/1.2 Workaround: There is no application-level workaround that fully eliminates this race condition without a code change. The following deployment-level measures reduce exposure in multi-tenant environments: - Avoid mTLS client certificates for git repositories: If tenant Repository resources do not supply client TLS certificates (httpConfig.tls.clientCertificate), the most sensitive data (client private key material) is absent from the global transport and cannot leak. - Avoid skipServerVerification: Do not set httpConfig.skipServerVerification: true on any Repository resource. This prevents a tenant's InsecureSkipVerify=true from propagating to other tenants' clones, which would otherwise allow an on-path attacker to serve malicious configuration.

🔗 References (5)