#Red Hat
All CosmicBytez Labs articles tagged #Red Hat, across news, security advisories, how-to guides, and projects.
- Security
CVE-2026-75092: Leapp RHEL Upgrade Flaw Lets a Compromised MySQL Account Escalate to Root
A flaw in leapp-repository's scan_mysql actor runs mysqld as root during RHEL 9-to-10 upgrades, letting a compromised mysql account escalate to full root.
- Security
CVE-2026-18922: SASL Auth Flaw Lets Attackers Seize Directory Manager on 389 Directory Server
A stale SASL identity left over from a failed bind can be inherited by a later successful bind, letting attackers gain Directory Manager rights.
- Security
CVE-2026-67567: Critical Privilege Escalation in Multicloud Operators Subscription
A CVSS 9.9 flaw in multicloud-operators-subscription lets tenants bypass security controls via malicious HelmRelease CRs, enabling privileged Helm execution.
- Security
CVE-2026-10059: Multicluster Engine ClusterCurator Token Escalation (CVSS 9.1)
A critical privilege escalation vulnerability in Red Hat's Multicluster Engine for Kubernetes allows a tenant administrator to exploit the ClusterCurator...
- Security
CVE-2026-10090: Red Hat ACM Helm Channel Privilege Escalation (CVSS 9.9)
A critical privilege escalation flaw in Red Hat Advanced Cluster Management for Kubernetes allows a namespace-scoped user to hijack cluster-admin...
- Security
CVE-2026-11807: Critical Authorization Bypass in Event-Driven Ansible WebSocket API
A missing authorization flaw (CVSS 9.6) in Red Hat's Event-Driven Ansible allows any authenticated user to forge WebSocket messages and access plaintext...
- Security
CVE-2026-53469: migration-planner Missing Authorization on Bulk Delete
A critical missing authorization vulnerability (CVSS 9.1) in Red Hat's migration-planner allows any authenticated user to send a DELETE request to...
- Security
CVE-2026-53470: migration-planner IDOR Exposes Cross-Tenant S3 Pre-Signed URLs
A critical improper access control vulnerability (CVSS 9.6) in Red Hat's migration-planner allows an authenticated attacker to bypass ownership checks and...
- Security
CVE-2026-53471: migration-planner JWT Source ID Claim Not Validated in Agent API
A critical improper authentication vulnerability (CVSS 9.6) in Red Hat's migration-planner agent-API middleware allows authenticated agents to update...
- Newsletter
June 3 Digest: AI Ransomware, Netlogon RCE, Miasma Supply Chain
An AI-generated ransomware toolkit automates EDR evasion; Windows Netlogon RCE is actively exploited on domain controllers; the Miasma campaign hits Red Hat…
- News
Miasma Supply Chain Attack Compromises Red Hat npm Packages with Credential-Stealing Worm
A new Mini Shai-Hulud supply chain campaign codenamed Miasma has compromised Red Hat's @redhat-cloud-services npm packages, deploying a self-propagating…
- News
IBM and Red Hat Commit $5 Billion to Secure Open Source Supply Chains Under "Project Lightwell"
IBM and Red Hat unveil Project Lightwell, a $5B commitment to securing open-source supply chains by fixing vulnerabilities without breaking production.