Copyright © 2012 Red Hat, Inc. All rights reserved.
Moderate
2026-07-27T21:21:16
react-router: React Router: Untrusted redirects due to missing protocol validation
6.9
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N
CWE-601
React Router is a router for React. In versions 7.11.0 through 7.17.0, the RSCErrorHandler is missing protocol validation, allowing for redirects from untrusted sources. This issue is a follow up to CVE-2026-53667, and only affects consuming applications if they are using the unstable RSC APIs. This issue has been fixed in version 7.18.0.
A flaw was found in React Router. The RSCErrorHandler component, used in applications leveraging unstable React Server Components (RSC) Application Programming Interfaces (APIs), is missing crucial protocol validation. This vulnerability allows an attacker to redirect users to untrusted external websites. Such redirects can lead to information disclosure or facilitate phishing attacks, potentially exposing sensitive user data.
React Router (npm packages react-router and react-router-dom) versions 7.11.0 through 7.17.0 contain a missing protocol validation flaw in the RSCErrorHandler component. This component is only used by applications that opt in to React Router's unstable React Server Components (RSC) APIs; applications that do not use the RSC APIs are not reachable through this code path. Where the RSC APIs are in use, an attacker can supply a URL that bypasses protocol validation and redirect a victim to an untrusted external site, which can facilitate phishing or information disclosure. This issue is fixed upstream in react-router/react-router-dom 7.18.0.
This flaw is only reachable in Red Hat products that both bundle an affected version of react-router/react-router-dom in a web console or UI component AND make use of the unstable RSC APIs in that component's own code. Simply bundling react-router as a dependency does not by itself make a product exploitable; each console/UI must be independently assessed by its owning component team for RSC API usage.
Red Hat's CVSS score (6.9, AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N) matches the upstream/CVE.org self-assigned score exactly, so no Red Hat-specific re-scoring was applied.
There is no mitigation available other than upgrading to react-router/react-router-dom 7.18.0 or later once the fix is packaged in the affected Red Hat products. Products that do not use React Router's unstable RSC APIs are not affected regardless of the bundled react-router version.
Cryostat 4
Not affected
cryostat-openshift-console-plugin-npm
Cryostat 4
Not affected
grafana-infinity-datasource-npm
Cryostat 4
Not affected
react-router
Exploit Intelligence
Out of support scope
exploit-intelligence-tech-preview/agent-client-rhel9
Gatekeeper 3
Not affected
gatekeeper/gatekeeper-rhel9
Migration Toolkit for Applications 8
Not affected
mta/mta-ui-rhel8
Migration Toolkit for Applications 8
Not affected
mta/mta-ui-rhel9
Migration Toolkit for Containers
Not affected
rhmtc/openshift-migration-ui-rhel8
Migration Toolkit for Virtualization
Not affected
migration-toolkit-virtualization/mtv-console-plugin-rhel9
Multicluster Engine for Kubernetes
Not affected
multicluster-engine/console-mce-rhel9
Network Observability Operator
Not affected
network-observability/network-observability-console-plugin-pf4-rhel9
Network Observability Operator
Not affected
network-observability/network-observability-console-plugin-pf5-rhel9
Network Observability Operator
Fix deferred
network-observability/network-observability-console-plugin-rhel9
Node HealthCheck Operator
Not affected
workload-availability/node-healthcheck-must-gather-rhel9
Node HealthCheck Operator
Not affected
workload-availability/node-healthcheck-operator-bundle
Node HealthCheck Operator
Not affected
workload-availability/node-healthcheck-rhel9-operator
OpenShift Lightspeed
Fix deferred
openshift-lightspeed/lightspeed-agentic-console-rhel9
OpenShift Lightspeed
Not affected
openshift-lightspeed/lightspeed-console-plugin-419-rhel9
OpenShift Lightspeed
Not affected
openshift-lightspeed/lightspeed-console-plugin-pf5-rhel9
OpenShift Lightspeed
Not affected
openshift-lightspeed/lightspeed-console-plugin-rhel9
OpenShift Pipelines
Not affected
openshift-pipelines/pipelines-console-plugin-pf5-rhel9
OpenShift Pipelines
Not affected
openshift-pipelines/pipelines-console-plugin-rhel8
OpenShift Pipelines
Fix deferred
openshift-pipelines/pipelines-console-plugin-rhel9
OpenShift Pipelines
Not affected
openshift-pipelines/pipelines-hub-ui-rhel8
OpenShift Pipelines
Not affected
openshift-pipelines/pipelines-hub-ui-rhel9
OpenShift Service Mesh 3
Not affected
openshift-service-mesh/kiali-operator-bundle
OpenShift Service Mesh 3
Not affected
openshift-service-mesh/kiali-ossmc-rhel9
OpenShift Service Mesh 3
Not affected
openshift-service-mesh/kiali-rhel9
OpenShift Service Mesh 3
Not affected
openshift-service-mesh/kiali-rhel9-operator
Red Hat Advanced Cluster Management for Kubernetes 2
Not affected
rhacm2/console-rhel9
Red Hat Advanced Cluster Security 4
Not affected
advanced-cluster-security/rhacs-main-rhel8
Red Hat Advanced Cluster Security 4
Not affected
advanced-cluster-security/rhacs-main-rhel9
Red Hat AMQ Broker 7
Not affected
react-router
Red Hat Ansible Automation Platform 2
Fix deferred
ansible-automation-platform-26/gateway-rhel9
Red Hat Ansible Automation Platform 2
Fix deferred
ansible-automation-platform-27/gateway-rhel9
Red Hat Ansible Automation Platform 2
Fix deferred
ansible-on-clouds/aoc-azure-aap-installer-rhel9
Red Hat Ansible Automation Platform 2
Not affected
automation-controller
Red Hat Ansible Automation Platform 2
Not affected
automation-eda-controller
Red Hat Ansible Automation Platform 2
Not affected
automation-gateway
Red Hat Ansible Automation Platform 2
Not affected
automation-hub
Red Hat Ansible Automation Platform 2
Not affected
automation-platform-ui
Red Hat Ansible Automation Platform 2
Not affected
python3.11-galaxy-ng
Red Hat Ansible Automation Platform 2
Not affected
python3.12-galaxy-ng
Red Hat Ansible Automation Platform 2
Not affected
python3x-galaxy-ng
Red Hat Ansible Automation Platform 2
Not affected
python-galaxy-ng
Red Hat build of Apache Camel for Spring Boot 4
Not affected
react-router
Red Hat build of Apache Camel - HawtIO 4
Not affected
react-router
Red Hat build of Apicurio Registry 3
Fix deferred
apicurio/apicurio-registry-ui-rhel8
Red Hat Build of Keycloak
Not affected
react-router
Red Hat Build of Podman Desktop
Not affected
rh-podman-desktop.git
Red Hat Ceph Storage 5
Not affected
rhceph/rhceph-5-dashboard-rhel8
Red Hat Ceph Storage 9
Not affected
rhceph/alloy-rhel10
Red Hat Connectivity Link 1
Not affected
rhcl-1/rhcl-console-plugin-rhel9
Red Hat Data Grid 8
Out of support scope
react-router
Red Hat Developer Hub
Not affected
rhdh/rhdh-hub-rhel9
Red Hat Discovery 2
Not affected
discovery/discovery-ui-rhel9
Red Hat Edge Manager 1
Not affected
rhem/flightctl-ui-ocp-rhel10
Red Hat Edge Manager 1
Not affected
rhem/flightctl-ui-ocp-rhel9
Red Hat Edge Manager 1
Not affected
rhem/flightctl-ui-rhel10
Red Hat Edge Manager 1
Not affected
rhem/flightctl-ui-rhel9
Red Hat Enterprise Linux 10
Not affected
grafana
Red Hat Enterprise Linux 10
Not affected
ipa
Red Hat Enterprise Linux 8
Not affected
dotnet5.0-build-reference-packages
Red Hat Enterprise Linux 8
Not affected
pcs
Red Hat Enterprise Linux 9
Not affected
ipa
Red Hat Hardened Images
Not affected
opentelemetry-collector
Red Hat Hardened Images
Not affected
opentelemetry-collector-contrib
Red Hat Hardened Images
Not affected
prometheus3.13
Red Hat Hardened Images
Not affected
prometheus3.5
Red Hat JBoss Enterprise Application Platform 8
Not affected
react-router
Red Hat JBoss Enterprise Application Platform Expansion Pack
Not affected
react-router
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-dashboard-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-mlflow-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-mod-arch-automl-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-mod-arch-autorag-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-mod-arch-eval-hub-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-mod-arch-gen-ai-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-mod-arch-maas-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-mod-arch-mlflow-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-mod-arch-model-registry-rhel9
Red Hat OpenShift Container Platform 4
Not affected
openshift4/ose-agent-installer-ui-rhel9
Red Hat OpenShift Container Platform 4
Not affected
openshift4/ose-console
Red Hat OpenShift Container Platform 4
Fix deferred
openshift4/ose-console-rhel9
Red Hat OpenShift Container Platform 4
Not affected
openshift4/ose-monitoring-plugin-rhel8
Red Hat OpenShift Container Platform 4
Fix deferred
openshift4/ose-monitoring-plugin-rhel9
Red Hat Openshift Data Foundation 4
Not affected
odf4/ocs-client-console-rhel9
Red Hat Openshift Data Foundation 4
Not affected
odf4/odf-console-rhel9
Red Hat Openshift Data Foundation 4
Not affected
odf4/odf-multicluster-console-rhel9
Red Hat OpenShift Dev Spaces
Not affected
devspaces/dashboard-rhel9
Red Hat OpenShift Dev Spaces
Not affected
devspaces/openvsx-rhel9
Red Hat OpenShift distributed tracing 3
Not affected
rhosdt/tempo-jaeger-query-rhel9
Red Hat OpenShift GitOps
Not affected
openshift-gitops-1/argocd-rhel8
Red Hat OpenShift GitOps
Not affected
openshift-gitops-1/argocd-rhel9
Red Hat OpenShift GitOps
Not affected
openshift-gitops-1/console-plugin-rhel8
Red Hat OpenShift GitOps
Not affected
openshift-gitops-1/console-plugin-rhel9
Red Hat OpenShift Virtualization 4
Not affected
container-native-virtualization/kubevirt-console-plugin
Red Hat OpenShift Virtualization 4
Not affected
container-native-virtualization/kubevirt-console-plugin-rhel9
Red Hat Quay 3
Out of support scope
quay/quay-rhel8
Red Hat Quay 3
Fix deferred
quay/quay-rhel9
Red Hat Satellite 6
Not affected
nodejs-react-router
Red Hat Satellite 6
Not affected
nodejs-react-router-dom
Red Hat Satellite 6
Not affected
satellite/iop-advisor-frontend-rhel9
Red Hat Satellite 6
Not affected
satellite/iop-host-inventory-frontend-rhel9
Red Hat Satellite 6
Not affected
satellite/iop-vulnerability-frontend-rhel9
Red Hat Single Sign-On 7
Not affected
react-router
Red Hat Trusted Artifact Signer
Not affected
rhtas/rhtas-console-ui-rhel9
Red Hat Trusted Profile Analyzer
Not affected
rhtpa/rhtpa-trustification-service-rhel9
Red Hat Trusted Profile Analyzer
Fix deferred
rhtpa/rhtpa-rhel10
Secrets Management Console for Red Hat OpenShift
Out of support scope
external-secrets-management/console-plugin-rhel9
Self-service automation portal 2
Not affected
ansible-automation-platform/automation-portal
https://www.cve.org/CVERecord?id=CVE-2026-53667
https://nvd.nist.gov/vuln/detail/CVE-2026-53667
https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7180
https://github.com/remix-run/react-router/commit/ce596e823f0d7b883a433af1d5a839a8b9fe0242
https://github.com/remix-run/react-router/pull/15177
https://github.com/remix-run/react-router/releases/tag/react-router@7.18.0
https://github.com/remix-run/react-router/security/advisories/GHSA-h8fp-f39c-q6mh