RHSA-2026:43038 - Security Advisory

Topic

A new version of Migration Toolkit for Applications (MTA) is now available.

Description

Migration Toolkit for Applications (MTA) accelerates large-scale application modernization efforts across hybrid cloud environments on Red Hat OpenShift.
This solution provides insight throughout the adoption process, at both the portfolio and application levels: inventory, assess, analyze, and manage
applications for faster migration to OpenShift via the user interface.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

Affected Products

• Red Hat Migration Toolkit for Applications

Fixes

• BZ -
• BZ -
• BZ -
• BZ -
• BZ -
• BZ -
• BZ -
• BZ -
• BZ -
• BZ -
• BZ -
• BZ -
• BZ -
• BZ -
• BZ -
• BZ -
• BZ -
• BZ -
• BZ -
• BZ -
• BZ -
• BZ -
• BZ -
• BZ -
• BZ -
• BZ -
• BZ -
• BZ -
• BZ -
• BZ -
• https://redhat.atlassian.net/browse/MTA-2782 - MTA UI - Importing invalid questionnaire shows wrong notification
• https://redhat.atlassian.net/browse/MTA-6211 - Analysis on Gradle application is not raising issues on dependencies
• https://redhat.atlassian.net/browse/MTA-6371 - [Assessment Actions] Action buttons are flickering every few seconds
• https://redhat.atlassian.net/browse/MTA-6478 - (QE and Docs) MTA 8.2.0 Release Activities
• https://redhat.atlassian.net/browse/MTA-6553 - [CLI] Proxy argument doesn't have affect
• https://redhat.atlassian.net/browse/MTA-6597 - Application Migration in MTA 8.2
• https://redhat.atlassian.net/browse/MTA-6722 - Kustomize
• https://redhat.atlassian.net/browse/MTA-6723 - Migrate cluster-level application workload dependencies
• https://redhat.atlassian.net/browse/MTA-6833 - [tackle2-ui#3042] Preparation - migrate components depreacted in PatternFly 5 to newer version
• https://redhat.atlassian.net/browse/MTA-6851 - [tackle2-ui#2172] Upgrade to PatternFly 6
• https://redhat.atlassian.net/browse/MTA-6855 - [tackle2-ui#3044] Improve e2e tests
• https://redhat.atlassian.net/browse/MTA-6857 - [tackle2-ui#2856] Remove unused code
• https://redhat.atlassian.net/browse/MTA-6858 - [tackle2-ui#3111] Jira ticket not reflected in UI
• https://redhat.atlassian.net/browse/MTA-6859 - [tackle2-ui#3131] Migrate single-select typeahead
• https://redhat.atlassian.net/browse/MTA-6861 - [tackle2-ui#3132] Migrate multi-select Select
• https://redhat.atlassian.net/browse/MTA-6872 - [tackle2-ui#3202] Migrate to current OIDC library
• https://redhat.atlassian.net/browse/MTA-6873 - [tackle2-ui#3212] Replace duplicated implementations of the multi select pattern
• https://redhat.atlassian.net/browse/MTA-6882 - [tackle2-ui#3217] Check only for HTML in the negative Jira connection test
• https://redhat.atlassian.net/browse/MTA-6883 - [tackle2-ui#3223] UI | Add pages to manager users and roles.
• https://redhat.atlassian.net/browse/MTA-6895 - [tackle2-ui#3223] UI | Add pages to manager users and roles.
• https://redhat.atlassian.net/browse/MTA-6897 - [tackle2-ui#3224] Inconsistent verification of isues created in Jira
• https://redhat.atlassian.net/browse/MTA-6918 - [tackle2-ui#3247] Automated PF5 to P6 migration
• https://redhat.atlassian.net/browse/MTA-6936 - [tackle2-ui#2840] [QE] Get nightly CI tests passing
• https://redhat.atlassian.net/browse/MTA-6941 - [tackle2-ui#2840] [QE] Get nightly CI tests passing
• https://redhat.atlassian.net/browse/MTA-6957 - [tackle2-ui#2509] Application inventory: Bulk change application source platforms
• https://redhat.atlassian.net/browse/MTA-6984 - [tackle2-ui#3237] UI | Add /oidc proxy route.
• https://redhat.atlassian.net/browse/MTA-6985 - [tackle2-ui#3238] UI | Permissions instead of roles.
• https://redhat.atlassian.net/browse/MTA-6986 - [tackle2-ui#3248] Stabilize newly migrated UI
• https://redhat.atlassian.net/browse/MTA-6988 - [tackle2-ui#3255] Migrate static reports to PatternFly 6
• https://redhat.atlassian.net/browse/MTA-6989 - [tackle2-ui#3258] Adjust art work/UX design after the migration
• https://redhat.atlassian.net/browse/MTA-6990 - [tackle2-ui#3259] Fix Monaco editor double scrollbars
• https://redhat.atlassian.net/browse/MTA-6995 - [tackle2-ui#3262] Revisit and update e2e tests given the new OIDC auth flows
• https://redhat.atlassian.net/browse/MTA-7026 - [tackle2-ui#3287] e2e - update the initial login test and login beforeAll to work with hub oidc provider
• https://redhat.atlassian.net/browse/MTA-7027 - [tackle2-ui#3288] UI | Support token revocation.
• https://redhat.atlassian.net/browse/MTA-7056 - [tackle2-ui#3336] Update e2e tests to create users from OIDC APIs
• https://redhat.atlassian.net/browse/MTA-7057 - [tackle2-ui#3337] Update e2e tests to create users from OIDC UI
• https://redhat.atlassian.net/browse/MTA-7058 - [tackle2-ui#3338] e2e - Manually test patternfly 6 UI for any misalignment and any UI issues
• https://redhat.atlassian.net/browse/MTA-7059 - [tackle2-ui#3339] [BUG] Login loop with hub oidc on fresh install
• https://redhat.atlassian.net/browse/MTA-7063 - [tackle2-ui#3343] Add the remaining tests of architect.test.ts for OIDC changes.
• https://redhat.atlassian.net/browse/MTA-7085 - [tackle2-ui#3349] User cannot edit their own user resource.
• https://redhat.atlassian.net/browse/MTA-7086 - [tackle2-ui#3350] :bug: Token scopes array parsed as string.
• https://redhat.atlassian.net/browse/MTA-7094 - [tackle2-ui#3359] The scopes column for api-key tokens seems odd.
• https://redhat.atlassian.net/browse/MTA-7101 - [tackle2-ui#3366] [BUG] No confirmation dialog shown when deleting a user
• https://redhat.atlassian.net/browse/MTA-7138 - [tackle2-ui#3397] Add login pages.
• https://redhat.atlassian.net/browse/MTA-7177 - [tackle2-ui#3428] Use tokens/:id/revoke
• https://redhat.atlassian.net/browse/MTA-7219 - [tackle2-ui#3425] [BUG] Success notification is shown twice on editing a role.
• https://redhat.atlassian.net/browse/MTA-7220 - [tackle2-ui#3445] Adjust scope handling from `/permissions` to `/auth/scopes`
• https://redhat.atlassian.net/browse/MTA-7241 - [tackle2-ui#3445] Adjust scope handling from `/permissions` to `/auth/scopes`
• https://redhat.atlassian.net/browse/MTA-7336 - [tackle2-ui#3129] Migrate PF4 tables
• https://redhat.atlassian.net/browse/MTA-7337 - [tackle2-ui#3130] Migrate single-select non-typeahead Select
• https://redhat.atlassian.net/browse/MTA-7338 - [tackle2-ui#3133] Migrate e2e Select tests to use test IDs
• https://redhat.atlassian.net/browse/MTA-7339 - [tackle2-ui#3134] Enforce no new linting warnings
• https://redhat.atlassian.net/browse/MTA-7340 - [tackle2-ui#3135] Increase the number of e2e tests run on PRs
• https://redhat.atlassian.net/browse/MTA-7341 - [tackle2-ui#3141] Skip all tests marked with bugs in Nightly runs
• https://redhat.atlassian.net/browse/MTA-7342 - [tackle2-ui#3142] Enable slack notification for Nightly runs
• https://redhat.atlassian.net/browse/MTA-7343 - [tackle2-ui#3143] Move all analysis tests to Koncur
• https://redhat.atlassian.net/browse/MTA-7345 - [tackle2-ui#3200] Identify filters by IDs based on categoryKey
• https://redhat.atlassian.net/browse/MTA-7346 - [tackle2-ui#3207] [BUG] Take assessment button flickers
• https://redhat.atlassian.net/browse/MTA-7349 - [tackle2-ui#3302] Include offline_access scope to OIDC client request.
• https://redhat.atlassian.net/browse/MTA-7351 - [tackle2-ui#3354] Fix CI failures due to auth token
• https://redhat.atlassian.net/browse/MTA-7353 - [tackle2-ui#3405] /auth proxy route missing.
• https://redhat.atlassian.net/browse/MTA-7355 - [tackle2-ui#3425] [BUG] Success notification is shown twice on editing a role.
• https://redhat.atlassian.net/browse/MTA-7361 - Enabling insecure Maven repositories doesn't work in UI flow
• https://redhat.atlassian.net/browse/MTA-7381 - [tackle2-ui#3461] :seedling: Configure explicit permissions for workflows
• https://redhat.atlassian.net/browse/MTA-7398 - MTA CLI introduces reorganized commands and subcommands for improved usability
• https://redhat.atlassian.net/browse/MTA-7399 - Hub OIDC provider for built-in authentication and authorization
• https://redhat.atlassian.net/browse/MTA-7400 - C# analyzer provider uses .NET Compiler Platform SDK (Roslyn APIs) for enhanced analysis

CVEs

• CVE-2026-13676
• CVE-2026-25681
• CVE-2026-27136
• CVE-2026-28684
• CVE-2026-33079
• CVE-2026-33811
• CVE-2026-34993
• CVE-2026-35397
• CVE-2026-39820
• CVE-2026-39821
• CVE-2026-40110
• CVE-2026-40171
• CVE-2026-42266
• CVE-2026-42499
• CVE-2026-42504
• CVE-2026-42557
• CVE-2026-42561
• CVE-2026-44431
• CVE-2026-44432
• CVE-2026-44727
• CVE-2026-44843
• CVE-2026-45292
• CVE-2026-48526
• CVE-2026-48710
• CVE-2026-48746
• CVE-2026-48990
• CVE-2026-5422
• CVE-2026-54283
• CVE-2026-59939
• CVE-2026-6322

References

• https://access.redhat.com/security/updates/classification/
• https://developers.redhat.com/products/mta/overview
• https://docs.redhat.com/en/documentation/migration_toolkit_for_applications/