RHSA-2026:94072HighCVSS 7.5

Red Hat Security Advisory: Red Hat Web Terminal Operator 1.11.3 release.

Published
November 2, 2026
Last Modified
November 13, 2026

🔗 CVE IDs covered (6)

CVE-2025-22866 →CVE-2025-47907 →CVE-2026-44740 →CVE-2026-56852 →CVE-2026-71556 →CVE-2024-45336 →

📋 Description

CVE-2024-45336 — golang: net/http: net/http: sensitive headers incorrectly sent after cross-domain redirect CVE-2025-22866 — crypto/internal/nistec: golang: Timing sidechannel for P-256 on ppc64le in crypto/internal/nistec CVE-2025-47907 — database/sql: Postgres Scan Race Condition CVE-2026-44740 — github.com/go-git/go-billy: Billy: Denial of Service via crafted input due to insufficient validation CVE-2026-56852 — golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input CVE-2026-71556 — github.com/go-git/go-git/v5: go-git: Arbitrary file read/write via symbolic link resolution

🎯 Affected products5

  • Red Hat Web Terminal 1.11
  • registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:6fd12374ef32fd040419d32a37ff7730fd76cdedc5e606ed5d8665a804119f70_amd64 as a component of Red Hat Web Terminal 1.11
  • registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:d7043adf089222c1fcdd38eab0aef1189537f99cb42e0b2fb2804aef802871c9_amd64 as a component of Red Hat Web Terminal 1.11
  • registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:6c3937a6fd7ce1013bc70fc646bb2d27841a020b055d8fe53a65844081b39c05_amd64 as a component of Red Hat Web Terminal 1.11
  • registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:9f4930928c532bd00a00cb96a66b49a919e15eecc3b5a2b15ab6e34ea2840203_amd64 as a component of Red Hat Web Terminal 1.11

✅ Remediation

To start using the Web Terminal Operator, install the Web Terminal Operator from OpenShift OperatorHub on OpenShift Container Platform 4.16 or higher. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To mitigate the issue, we suggest upgrading to versions 5.9.0+ or 6.0.0-alpha.1+ Workaround: To reduce the risk of exploitation, do not clone or run worktree operations (checkout, status, add) on Git repositories originating from untrusted or attacker-controllable sources using an affected version of go-git. The issue is resolved by updating to go-git 5.19.2 or 6.0.0-alpha.5 (or later).

🔗 References (17)