RHSA-2026:95261CriticalCVSS 9.1

Red Hat Security Advisory: RHTAS 1.5.1 - Release of Model Transparency 1.0.6

Published
November 4, 2026
Last Modified
November 13, 2026

🔗 CVE IDs covered (8)

CVE-2026-114605 →CVE-2026-119194 →CVE-2026-119195 →CVE-2026-119196 →CVE-2026-102268 →CVE-2026-102271 →CVE-2026-102272 →CVE-2026-102273 →

📋 Description

CVE-2026-102268 — pyjwt: PyJWT: Authentication bypass via improper public key validation CVE-2026-102271 — pyjwt: PyJWT: Authentication bypass via acceptance of DER public keys as HMAC secrets CVE-2026-102272 — pyjwt: pyjwt: Token forgery via improper Unicode byte-order mark handling CVE-2026-102273 — pyjwt: pyjwt: Token forgery via acceptance of public JWK containers as HMAC secrets CVE-2026-114605 — dnspython: dnspython: Denial of Service via excessive DNS compression pointer traversal CVE-2026-119194 — pyasn1: pyasn1: Denial of Service via hash collisions in schemaless decoding CVE-2026-119195 — pyasn1: pyasn1: Denial of Service via quadratic processing of fragmented ASN.1 data CVE-2026-119196 — pyasn1: pyasn1: Denial of Service via constructed bit string decoding

🎯 Affected products3

  • Red Hat Trusted Artifact Signer 1.5
  • registry.redhat.io/rhtas/model-transparency-rhel9@sha256:ebbfa676b90c7a6190b7498b4add8f0ef4a585f9d91ba2e85d3973d9f5788653_amd64 as a component of Red Hat Trusted Artifact Signer 1.5
  • registry.redhat.io/rhtas/model-transparency-rhel9@sha256:fcf6f9e17002b714a3925fb6e012a96d4bd4607560bf02449c430106a8166702_arm64 as a component of Red Hat Trusted Artifact Signer 1.5

✅ Remediation

The Model Transparency CLI Image is a containerized command-line tool for signing and verifying AI/ML workloads against a private Red Hat Trusted Artifact Signer (RHTAS) instance. It lets teams create signatures and attestations for model artifacts and validate them at build or deploy time using enterprise trust material (e.g., Fulcio/Rekor). For details on using the Model Transparency CLI image, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.5 You can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.5/html-single/release_notes/index Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

🔗 References (13)