RHSA-2026:94074HighCVSS 7.5

Red Hat Security Advisory: Red Hat Web Terminal Operator 1.14.2 release.

Published
November 2, 2026
Last Modified
November 13, 2026

🔗 CVE IDs covered (6)

CVE-2025-22866 →CVE-2025-47907 →CVE-2026-44740 →CVE-2026-56852 →CVE-2026-71556 →CVE-2024-45336 →

📋 Description

CVE-2024-45336 — golang: net/http: net/http: sensitive headers incorrectly sent after cross-domain redirect CVE-2025-22866 — crypto/internal/nistec: golang: Timing sidechannel for P-256 on ppc64le in crypto/internal/nistec CVE-2025-47907 — database/sql: Postgres Scan Race Condition CVE-2026-44740 — github.com/go-git/go-billy: Billy: Denial of Service via crafted input due to insufficient validation CVE-2026-56852 — golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input CVE-2026-71556 — github.com/go-git/go-git/v5: go-git: Arbitrary file read/write via symbolic link resolution

🎯 Affected products5

  • Red Hat Web Terminal 1.14
  • registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:638ea07a1f28df6e0cc91107a42c830df88d02e4b602560ba61565922de18d93_amd64 as a component of Red Hat Web Terminal 1.14
  • registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:fddc16952af6b66623badf12821472b9bc0fd58380e293a9e015daa01ef8dd1f_amd64 as a component of Red Hat Web Terminal 1.14
  • registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:6bcecf2574d7efdfb2e124f6ccf31d8b2e33a1d79c940d69c3e2d006b1e617ed_amd64 as a component of Red Hat Web Terminal 1.14
  • registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:5580468463a8f11fb2fecb7e95abae716e3e10c9cafbc0d591747c0f269bc74e_amd64 as a component of Red Hat Web Terminal 1.14

✅ Remediation

To start using the Web Terminal Operator, install the Web Terminal Operator from OpenShift OperatorHub on OpenShift Container Platform 4.19 or higher. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To mitigate the issue, we suggest upgrading to versions 5.9.0+ or 6.0.0-alpha.1+ Workaround: To reduce the risk of exploitation, do not clone or run worktree operations (checkout, status, add) on Git repositories originating from untrusted or attacker-controllable sources using an affected version of go-git. The issue is resolved by updating to go-git 5.19.2 or 6.0.0-alpha.5 (or later).

🔗 References (17)