RHSA-2026:94073HighCVSS 7.5

Red Hat Security Advisory: Red Hat Web Terminal Operator 1.17.2 release.

Published
November 2, 2026
Last Modified
November 8, 2026

🔗 CVE IDs covered (3)

CVE-2026-44740 →CVE-2026-56852 →CVE-2026-71556 →

📋 Description

CVE-2026-44740 — github.com/go-git/go-billy: Billy: Denial of Service via crafted input due to insufficient validation CVE-2026-56852 — golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input CVE-2026-71556 — github.com/go-git/go-git/v5: go-git: Arbitrary file read/write via symbolic link resolution

🎯 Affected products5

  • Red Hat Web Terminal 1.17
  • registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:ad2e1604e05a84f0a301ea6a6554cb6ef847789bfe635520dbace820fde29f7a_amd64 as a component of Red Hat Web Terminal 1.17
  • registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:ba115046327065f2e34fc660e7f68f2418fecea4a07dd7e0c15ec995e4680664_amd64 as a component of Red Hat Web Terminal 1.17
  • registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:c2ef5b7773324a0bc4fed27e3527c0f197148a787412d2a913e9757e95c2f55e_amd64 as a component of Red Hat Web Terminal 1.17
  • registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:0b7f24a14929daef656fbbdb70e55238924057a9cb52234a5fcca8a287e9d0e3_amd64 as a component of Red Hat Web Terminal 1.17

✅ Remediation

To start using the Web Terminal Operator, install the Web Terminal Operator from OpenShift OperatorHub on OpenShift Container Platform 4.22 or higher. Workaround: To mitigate the issue, we suggest upgrading to versions 5.9.0+ or 6.0.0-alpha.1+ Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To reduce the risk of exploitation, do not clone or run worktree operations (checkout, status, add) on Git repositories originating from untrusted or attacker-controllable sources using an affected version of go-git. The issue is resolved by updating to go-git 5.19.2 or 6.0.0-alpha.5 (or later).

🔗 References (9)