RHSA-2026:10158HighCVSS 9.6

Red Hat Security Advisory: Red Hat OpenShift Builds 1.7.2

Published
April 23, 2026
Last Modified
July 27, 2026

🔗 CVE IDs covered (6)

CVE-2025-68121 →CVE-2026-25679 →CVE-2026-27137 →CVE-2026-33186 →CVE-2026-33211 →CVE-2026-33810 →

📋 Description

CVE-2025-68121 — crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption CVE-2026-25679 — net/url: Incorrect parsing of IPv6 host literals in net/url CVE-2026-27137 — crypto/x509: Incorrect enforcement of email constraints in crypto/x509 CVE-2026-33186 — google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation CVE-2026-33211 — Tekton Pipelines: github.com/tektoncd/pipeline: Tekton Pipelines: Information disclosure via path traversal in git resolver CVE-2026-33810 — crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application

🎯 Affected products38

  • Red Hat OpenShift Builds 1.7.4
  • registry.redhat.io/openshift-builds/openshift-builds-controller-rhel9@sha256:5008dcb0428a0837b9abd827963e7008c8e16af8cfcbd432421286fca63fe714_amd64 as a component of Red Hat OpenShift Builds 1.7.4
  • registry.redhat.io/openshift-builds/openshift-builds-controller-rhel9@sha256:5856cba3fe26ab7f756ba93e06caa6e522336ff36ff4c515132a8d35c85a2f64_s390x as a component of Red Hat OpenShift Builds 1.7.4
  • registry.redhat.io/openshift-builds/openshift-builds-controller-rhel9@sha256:6ddf185f2714d45fab92c831bf32673da55c7a43dbcf1bd22090b203791e03b2_ppc64le as a component of Red Hat OpenShift Builds 1.7.4
  • registry.redhat.io/openshift-builds/openshift-builds-controller-rhel9@sha256:eb32b129ea6a10b4aada4313ff11b04c33b99877eea9a5e567245d361d69f140_arm64 as a component of Red Hat OpenShift Builds 1.7.4
  • registry.redhat.io/openshift-builds/openshift-builds-git-cloner-rhel9@sha256:165f6085028f3859f6ede9176d413274ee1a457b72cd9c437795146c20b0722c_amd64 as a component of Red Hat OpenShift Builds 1.7.4
  • registry.redhat.io/openshift-builds/openshift-builds-git-cloner-rhel9@sha256:7a39f26f51bcbb4ef395208db01e2b0ee8b1fe9b15b3701c9c35d8f636f790d9_arm64 as a component of Red Hat OpenShift Builds 1.7.4
  • registry.redhat.io/openshift-builds/openshift-builds-git-cloner-rhel9@sha256:a4d609ff22b610b625a74fffd22883d5debe93c2e0c6ae2bcbbfd8f5f6b2cf12_s390x as a component of Red Hat OpenShift Builds 1.7.4
  • registry.redhat.io/openshift-builds/openshift-builds-git-cloner-rhel9@sha256:ec02f5f031fefd5a610b69a81be5350f96e54511e2d2c619e8b9fe8f193297b6_ppc64le as a component of Red Hat OpenShift Builds 1.7.4
  • registry.redhat.io/openshift-builds/openshift-builds-image-bundler-rhel9@sha256:0070df2a8c7882ae021000c498ead96b19f1bd6819e46657d5898cb71e6ec506_arm64 as a component of Red Hat OpenShift Builds 1.7.4
  • registry.redhat.io/openshift-builds/openshift-builds-image-bundler-rhel9@sha256:4b578a8ef1579d7168b7f0a1b7cebe66213003f8225a86cfdd4c9f24a5e2d871_ppc64le as a component of Red Hat OpenShift Builds 1.7.4
  • registry.redhat.io/openshift-builds/openshift-builds-image-bundler-rhel9@sha256:8d6371a5fe374e3bc5c19a930ea712d266fab13a722768204b128bc71e928c97_s390x as a component of Red Hat OpenShift Builds 1.7.4
  • registry.redhat.io/openshift-builds/openshift-builds-image-bundler-rhel9@sha256:985b19d79b3e54fc8b99b9b0239b74dcf6d0102d3ff0cd5363ae4627069d2ee1_amd64 as a component of Red Hat OpenShift Builds 1.7.4
  • registry.redhat.io/openshift-builds/openshift-builds-image-processing-rhel9@sha256:2a0a6ea6465a6d165f072ef782a1825cc16ecfb2f8c58d5ec58c1d40d02e5208_arm64 as a component of Red Hat OpenShift Builds 1.7.4
  • registry.redhat.io/openshift-builds/openshift-builds-image-processing-rhel9@sha256:679b470190ff7a7fc04e283884be4f24d1b0c475d0730fb718f2f45c60551b61_s390x as a component of Red Hat OpenShift Builds 1.7.4
  • registry.redhat.io/openshift-builds/openshift-builds-image-processing-rhel9@sha256:9734d0dc0367884e128837b7d02038a3b4136c4865ed3dc90902801393e178b4_ppc64le as a component of Red Hat OpenShift Builds 1.7.4
  • registry.redhat.io/openshift-builds/openshift-builds-image-processing-rhel9@sha256:f5f35702e424cd4e9b768c59d44928844b2d09fbb98d368ae7b54b7ec0771d13_amd64 as a component of Red Hat OpenShift Builds 1.7.4
  • registry.redhat.io/openshift-builds/openshift-builds-operator-bundle@sha256:093834bac2e2f7f01968ef542b9bcbf5fbe530c9f0dd86521825797abb4a33a2_amd64 as a component of Red Hat OpenShift Builds 1.7.4
  • registry.redhat.io/openshift-builds/openshift-builds-rhel9-operator@sha256:190edd3effb60c56c885fc964d3eb48076293e1e43d745c4615ed00ef7daa145_ppc64le as a component of Red Hat OpenShift Builds 1.7.4
  • registry.redhat.io/openshift-builds/openshift-builds-rhel9-operator@sha256:382be8775c61942123adac2acec9f48085ebf7fd2b286c20e36a33ea6462baa7_arm64 as a component of Red Hat OpenShift Builds 1.7.4
  • registry.redhat.io/openshift-builds/openshift-builds-rhel9-operator@sha256:5e83175abaef1e3046bac94621a86e036317833c740cdd6d235f1133a1388dd3_amd64 as a component of Red Hat OpenShift Builds 1.7.4
  • registry.redhat.io/openshift-builds/openshift-builds-rhel9-operator@sha256:7173a298b07cbde3cd9ff12ca25f26ccf79b9ff8cfcb35a001c9f8c0b0291436_s390x as a component of Red Hat OpenShift Builds 1.7.4
  • registry.redhat.io/openshift-builds/openshift-builds-shared-resource-rhel9@sha256:16cf5e33f297c027686d3ba9c6cbb01dba7a39299e2765fe4eaacc892b32f0d1_amd64 as a component of Red Hat OpenShift Builds 1.7.4
  • registry.redhat.io/openshift-builds/openshift-builds-shared-resource-rhel9@sha256:4715242f98234d2018f8317d9a57f63ff23b4d63be96491d55af2a2ef4572261_arm64 as a component of Red Hat OpenShift Builds 1.7.4
  • registry.redhat.io/openshift-builds/openshift-builds-shared-resource-rhel9@sha256:678c8d38900d994c4aa2e23669b7901747028690a4c5e4ba9aced4cbfe22b248_ppc64le as a component of Red Hat OpenShift Builds 1.7.4
  • registry.redhat.io/openshift-builds/openshift-builds-shared-resource-rhel9@sha256:b39a2930e310d432a840798f03f7e55b8da42ff16ccda31790f85558d2be2537_s390x as a component of Red Hat OpenShift Builds 1.7.4
  • registry.redhat.io/openshift-builds/openshift-builds-shared-resource-webhook-rhel9@sha256:1d01e27a3cdea6c99a985b877e29629d1c1fb00203f4a90c45db6df7a602e2cc_s390x as a component of Red Hat OpenShift Builds 1.7.4
  • registry.redhat.io/openshift-builds/openshift-builds-shared-resource-webhook-rhel9@sha256:88b38ad10068e0574d2e5934849b98429c69305633b42aa4d19822ede2a6e10d_ppc64le as a component of Red Hat OpenShift Builds 1.7.4
  • registry.redhat.io/openshift-builds/openshift-builds-shared-resource-webhook-rhel9@sha256:b020334c46f2d7276ba0c3aa8be7951254b197b2da310f0c22d2e16681a6a265_arm64 as a component of Red Hat OpenShift Builds 1.7.4
  • registry.redhat.io/openshift-builds/openshift-builds-shared-resource-webhook-rhel9@sha256:f2c222424cd66659ebea6787b6934c2d01d9eeb4f7db03ebfa16ab7b65aeb5b2_amd64 as a component of Red Hat OpenShift Builds 1.7.4
  • +8 more not shown

✅ Remediation

It is recommended that existing users of Red Hat OpenShift Builds 1.7.1 upgrades to to 1.7.2 Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability. Workaround: To mitigate this vulnerability, restrict the creation of ResolutionRequests to trusted users and service accounts. Implement strict Role-Based Access Control (RBAC) policies to limit which tenants can create TaskRuns or PipelineRuns that utilize the Tekton Pipelines git resolver. This reduces the exposure by preventing unauthorized access to the resolver pod's filesystem.

🔗 References (10)