RHSA-2026:68334 - Security Advisory

Topic

Red Hat Edge Manager Version 1.1.4 Security Update

Description

Red Hat Edge Manager (RHEM) provides simple, scalable, and security-focused
management of edge devices and applications. It supports image-mode RHEL and
container workloads that run on Podman/Docker or Kubernetes.

RHEM is now available as a standalone feature, providing greater flexibility for
edge deployments. In addition to the standalone version, RHEM continues to be
offered as a plugin for the following platforms:

Red Hat Advanced Cluster Management (RHACM): Extends fleet management to edge
devices.
Red Hat Ansible Automation Platform (AAP): Integrates edge management with
Ansible automation.

This integration enables organizations to optimize the management and
orchestration of their fleets of edge devices; whether its thousands of
dispersed retail point-of-sale systems or industrial machinery on remote factory
floors.

Value for customers and partners:

• This solution not only helps customers manage thousands of devices but helps

scale operations.

• To manage large-scale deployments, customers need to be able to integrate with

their existing management systems, support remote configuration and over-the-air
updates, and collect telemetry data for advanced analytics.

• Red Hat Edge Manager offers a simple and security-focused lifecycle

management, from onboarding to decommissioning of edge devices.

This complete end-to-end solution empowers organizations to gain the most value
from the fleets of devices that generate data, all from a centralized location.

Security Fixes:

• flightctl: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting (CVE-2026-25681)
• flightctl: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass (CVE-2026-27136)
• flightctl: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (CVE-2026-27145)
• flightctl: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application (CVE-2026-33810)
• flightctl: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818)
• flightctl: Go net/mail: Denial of Service via crafted email inputs (CVE-2026-39820)
• flightctl: golang.org/x/crypto/ssh: Security key bypass due to missing user presence check (CVE-2026-39831)
• flightctl: OpenTelemetry-Go: Denial of Service via oversized baggage headers (CVE-2026-41178)
• flightctl: Moby container framework: Host file overwrite via race condition in docker cp mount setup (CVE-2026-42306)
• flightctl: net/mail: Denial of Service via pathological email address parsing (CVE-2026-42499)
• flightctl: Golang MIME: Denial of Service via maliciously-crafted MIME header (CVE-2026-42504)
• flightctl: Billy: Denial of Service via crafted input due to insufficient validation (CVE-2026-44740)
• flightctl: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs (CVE-2026-46597)
• flightctl: Arc: Information disclosure and Denial of Service via unauthenticated debug endpoints (CVE-2026-48050)
• flightctl: golang.org/x/text: Denial of Service via invalid UTF-8 input (CVE-2026-56852)
• flightctl: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853)
• flightctl: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858)
• flightctl: Go: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859)
• flightctl: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860)
• flightctl: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862)
• flightctl: PostCSS: Information disclosure via crafted sourceMappingURL (CVE-2026-69153)
• flightctl: go-git: Arbitrary file read/write via symbolic link resolution (CVE-2026-71556)
• flightctl: MongoDB Go Driver: Write redirection via unvalidated database name in Client.BulkWrite (CVE-2026-81521)

Solution

See the following documentation for details on how to enable Red Hat Edge
Manager and more:
https://docs.redhat.com/en/documentation/red_hat_edge_manager/1.1

Affected Products

• Red Hat Edge Manager 1.1 for RHEL 10 x86_64
• Red Hat Edge Manager 1.1 for RHEL 10 s390x
• Red Hat Edge Manager 1.1 for RHEL 10 ppc64le
• Red Hat Edge Manager 1.1 for RHEL 10 aarch64
• Red Hat Edge Manager 1.1 for RHEL 9 x86_64
• Red Hat Edge Manager 1.1 for RHEL 9 s390x
• Red Hat Edge Manager 1.1 for RHEL 9 ppc64le
• Red Hat Edge Manager 1.1 for RHEL 9 aarch64

Fixes

• BZ - 2456335 - CVE-2026-33810 crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application
• BZ - 2467809 - CVE-2026-42499 net/mail: golang: net/mail: Denial of Service via pathological email address parsing
• BZ - 2467820 - CVE-2026-39820 net/mail: golang: Go net/mail: Denial of Service via crafted email inputs
• BZ - 2480675 - CVE-2026-39831 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security key bypass due to missing user presence check
• BZ - 2480678 - CVE-2026-46597 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs
• BZ - 2480757 - CVE-2026-27136 golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass
• BZ - 2480761 - CVE-2026-25681 golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting
• BZ - 2483894 - CVE-2026-44740 github.com/go-git/go-billy: Billy: Denial of Service via crafted input due to insufficient validation
• BZ - 2484204 - CVE-2026-42504 mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header
• BZ - 2484207 - CVE-2026-27145 crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries
• BZ - 2484830 - CVE-2026-41178 github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers
• BZ - 2488484 - CVE-2026-42306 github.com/docker/docker: github.com/moby/moby: Moby container framework: Host file overwrite via race condition in docker cp mount setup
• BZ - 2504233 - CVE-2026-56852 golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input
• BZ - 2510719 - CVE-2026-69153 postcss: PostCSS: Information disclosure via crafted sourceMappingURL
• BZ - 2512562 - CVE-2026-71556 github.com/go-git/go-git/v5: go-git: Arbitrary file read/write via symbolic link resolution
• BZ - 2515815 - CVE-2026-33818 encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal
• BZ - 2515820 - CVE-2026-56860 net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution
• BZ - 2515827 - CVE-2026-56853 net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service
• BZ - 2515838 - CVE-2026-56858 html/template: golang: Go html/template: Cross-Site Scripting via pathological input
• BZ - 2515839 - CVE-2026-56862 crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages
• BZ - 2515840 - CVE-2026-56859 encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue

CVEs

• CVE-2026-25681
• CVE-2026-27136
• CVE-2026-27145
• CVE-2026-33810
• CVE-2026-33818
• CVE-2026-39820
• CVE-2026-39831
• CVE-2026-41178
• CVE-2026-42306
• CVE-2026-42499
• CVE-2026-42504
• CVE-2026-44740
• CVE-2026-46597
• CVE-2026-48050
• CVE-2026-56852
• CVE-2026-56853
• CVE-2026-56858
• CVE-2026-56859
• CVE-2026-56860
• CVE-2026-56862
• CVE-2026-69153
• CVE-2026-71556
• CVE-2026-81521

References

• https://access.redhat.com/security/updates/classification/#important