RHSA-2026:95222HighCVSS 7.5

Red Hat Security Advisory: Ansible automation portal Red Hat Enterprise Linux Images

Published
November 4, 2026
Last Modified
November 6, 2026

🔗 CVE IDs covered (2)

CVE-2026-90711 →CVE-2026-101916 →

📋 Description

CVE-2026-90711 — proxy-addr: proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet CVE-2026-101916 — grpc-js: grpc-js: Authentication bypass via improper peer certificate validation

🎯 Affected products2

  • Red Hat Ansible Automation Platform 2.2
  • registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:110425ffe8f38c2a2742dd12bc5e983d07a43216197e4c8102caa7079e1aadd5_amd64 as a component of Red Hat Ansible Automation Platform 2.2

✅ Remediation

For more about Ansible Portal Installer Bootc, see References links Workaround: To mitigate this flaw through configuration: 1. Configure trusted proxy definitions using standard IPv4 notation (such as `10.0.0.0/8`) rather than IPv4-mapped IPv6 notation. 2. If IPv4-mapped IPv6 notation is required, set the subnet prefix length to at least 97 to cover the mapped boundary (for example, specify `::ffff:10.0.0.0/104` instead of `::ffff:10.0.0.0/8`). 3. Alternatively, sanitize or strip incoming `X-Forwarded-For` headers at edge load balancers or boundary reverse proxies before passing traffic to backend applications. Warning: Modifying application configuration files requires restarting the Node.js application service, which will temporarily interrupt service availability and active connections.

🔗 References (6)