RHSA-2026:94070HighCVSS 7.5

Red Hat Security Advisory: Red Hat Web Terminal Operator 1.13.2 release.

Published
November 2, 2026
Last Modified
November 13, 2026

🔗 CVE IDs covered (6)

CVE-2026-44740 →CVE-2026-56852 →CVE-2026-71556 →CVE-2024-45336 →CVE-2025-22866 →CVE-2025-47907 →

📋 Description

CVE-2024-45336 — golang: net/http: net/http: sensitive headers incorrectly sent after cross-domain redirect CVE-2025-22866 — crypto/internal/nistec: golang: Timing sidechannel for P-256 on ppc64le in crypto/internal/nistec CVE-2025-47907 — database/sql: Postgres Scan Race Condition CVE-2026-44740 — github.com/go-git/go-billy: Billy: Denial of Service via crafted input due to insufficient validation CVE-2026-56852 — golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input CVE-2026-71556 — github.com/go-git/go-git/v5: go-git: Arbitrary file read/write via symbolic link resolution

🎯 Affected products5

  • Red Hat Web Terminal 1.13
  • registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:11c7addbd03570a7cd57f1c763b5e17b78f3b37eb0a0ed69ea1d1ee36d381eca_amd64 as a component of Red Hat Web Terminal 1.13
  • registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:135301a90c7c6e544f92e8ba52ed2120c73f08c19cf366fc1a49d85d8e3a4c1c_amd64 as a component of Red Hat Web Terminal 1.13
  • registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:def4cb62e1db8656eb43eb20410504560c03f07e1f8487b095d787725487e529_amd64 as a component of Red Hat Web Terminal 1.13
  • registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:fb1de95a0bf1a02dd8d492cfcf390a34ff1a11ced61031b54c460dca76e57aaf_amd64 as a component of Red Hat Web Terminal 1.13

✅ Remediation

To start using the Web Terminal Operator, install the Web Terminal Operator from OpenShift OperatorHub on OpenShift Container Platform 4.18 or higher. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To mitigate the issue, we suggest upgrading to versions 5.9.0+ or 6.0.0-alpha.1+ Workaround: To reduce the risk of exploitation, do not clone or run worktree operations (checkout, status, add) on Git repositories originating from untrusted or attacker-controllable sources using an affected version of go-git. The issue is resolved by updating to go-git 5.19.2 or 6.0.0-alpha.5 (or later).

🔗 References (17)