RHSA-2026:94094HighCVSS 7.5

Red Hat Security Advisory: Red Hat Web Terminal Operator 1.15.3 release.

Published
November 2, 2026
Last Modified
November 12, 2026

🔗 CVE IDs covered (3)

CVE-2026-56852 →CVE-2026-71556 →CVE-2026-44740 →

📋 Description

CVE-2026-44740 — github.com/go-git/go-billy: Billy: Denial of Service via crafted input due to insufficient validation CVE-2026-56852 — golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input CVE-2026-71556 — github.com/go-git/go-git/v5: go-git: Arbitrary file read/write via symbolic link resolution

🎯 Affected products5

  • Red Hat Web Terminal 1.15
  • registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:098feaded858a8c9d656a39701b895e32b18c3e4a66693f9724ad6540c829d7e_amd64 as a component of Red Hat Web Terminal 1.15
  • registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:8be6e12b68ee2c93eac759a0d4c30ed7af1e1a33b3c274fdc426f0e7e37d3a3b_amd64 as a component of Red Hat Web Terminal 1.15
  • registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:67e5fee7bcdab03994518ad25da1a73cc789b361cd3b77a2a25d69c65d21b304_amd64 as a component of Red Hat Web Terminal 1.15
  • registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:28946a9327b2213d4a8b3f811bd05812d9817775e40430992083a62865a9863d_amd64 as a component of Red Hat Web Terminal 1.15

✅ Remediation

To start using the Web Terminal Operator, install the Web Terminal Operator from OpenShift OperatorHub on OpenShift Container Platform 4.20 or higher. Workaround: To mitigate the issue, we suggest upgrading to versions 5.9.0+ or 6.0.0-alpha.1+ Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To reduce the risk of exploitation, do not clone or run worktree operations (checkout, status, add) on Git repositories originating from untrusted or attacker-controllable sources using an affected version of go-git. The issue is resolved by updating to go-git 5.19.2 or 6.0.0-alpha.5 (or later).

🔗 References (9)