RHSA-2026:94071HighCVSS 7.5

Red Hat Security Advisory: Red Hat Web Terminal Operator 1.16.3 release.

Published
November 2, 2026
Last Modified
November 12, 2026

🔗 CVE IDs covered (3)

CVE-2026-44740 →CVE-2026-56852 →CVE-2026-71556 →

📋 Description

CVE-2026-44740 — github.com/go-git/go-billy: Billy: Denial of Service via crafted input due to insufficient validation CVE-2026-56852 — golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input CVE-2026-71556 — github.com/go-git/go-git/v5: go-git: Arbitrary file read/write via symbolic link resolution

🎯 Affected products5

  • Red Hat Web Terminal 1.16
  • registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:e6fa38c197ad3b148b56e8a686e7fb6d062f0a3e15cc6a4d50f593c628acd60e_amd64 as a component of Red Hat Web Terminal 1.16
  • registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:2410f24457d83a33c1ab49047ef50763a661a49d7a76d3e5432aaaf1f49069aa_amd64 as a component of Red Hat Web Terminal 1.16
  • registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:5b3e6ccda0bee467ccb3f27cf79436d587eb15e94caa51ec1220f6de75057569_amd64 as a component of Red Hat Web Terminal 1.16
  • registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:82a2d74f96fee61e60a4ea90b56502032d05527cf0f498ebf81b91048cab8d95_amd64 as a component of Red Hat Web Terminal 1.16

✅ Remediation

To start using the Web Terminal Operator, install the Web Terminal Operator from OpenShift OperatorHub on OpenShift Container Platform 4.21 or higher. Workaround: To mitigate the issue, we suggest upgrading to versions 5.9.0+ or 6.0.0-alpha.1+ Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To reduce the risk of exploitation, do not clone or run worktree operations (checkout, status, add) on Git repositories originating from untrusted or attacker-controllable sources using an affected version of go-git. The issue is resolved by updating to go-git 5.19.2 or 6.0.0-alpha.5 (or later).

🔗 References (9)