Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-05-04T19:31:57 fast-uri: fast-uri: Path traversal vulnerability allows bypass of security policies 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CWE-22

A flaw was found in fast-uri. A remote attacker could exploit this vulnerability by providing a specially crafted Uniform Resource Locator (URL) containing percent-encoded path separators and dot segments. Due to incorrect processing, fast-uri would decode these elements before proper normalization, leading to distinct URLs resolving to the same internal path. This could allow an attacker to bypass security policies that rely on path-based comparisons, potentially gaining unauthorized access to resources.

Confidential Compute Attestation Affected openshift-sandboxed-containers/osc-pccs Cryostat 4 Affected cryostat-openshift-console-plugin-npm Network Observability Operator Affected network-observability/network-observability-console-plugin-rhel9 OpenShift Pipelines Affected openshift-pipelines/pipelines-console-plugin-rhel8 OpenShift Pipelines Affected openshift-pipelines/pipelines-console-plugin-rhel9 Red Hat Ansible Automation Platform 2 Will not fix ansible-automation-platform-24/lightspeed-rhel8 Red Hat Ansible Automation Platform 2 Affected ansible-automation-platform-25/lightspeed-rhel8 Red Hat Ansible Automation Platform 2 Affected ansible-automation-platform-26/gateway-rhel9 Red Hat Ansible Automation Platform 2 Affected ansible-automation-platform-26/lightspeed-rhel9 Red Hat Ansible Automation Platform 2 Affected ansible-automation-platform/automation-dashboard-rhel9 Red Hat Ansible Automation Platform 2 Affected ansible-automation-platform-tech-preview/mcp-server-rhel9 Red Hat Ansible Automation Platform 2 Affected automation-gateway Red Hat Ansible Automation Platform 2 Affected automation-platform-ui Red Hat build of Apache Camel - HawtIO 4 Affected io.hawt-project Red Hat Build of Podman Desktop Affected podman-desktop-macos-1-0 Red Hat Build of Podman Desktop Affected podman-desktop-windows-1-0 Red Hat Build of Podman Desktop - Tech Preview Affected rhdesktop/rh-podman-desktop-ext-bootc-rhel10 Red Hat Data Grid 8 Affected org.infinispan-infinispan-console Red Hat Developer Hub Will not fix rhdh/backstage-community-plugin-catalog-backend-module-scaffolder-relation-processor Red Hat Developer Hub Affected rhdh/rhdh-hub-rhel9 Red Hat Discovery 2 Affected discovery/discovery-ui-rhel9 Red Hat Enterprise Linux 10 Affected linux-sgx Red Hat Enterprise Linux 9 Affected linux-sgx Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-dashboard-rhel8 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-dashboard-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-mlflow-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-mod-arch-gen-ai-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-mod-arch-maas-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-mod-arch-model-registry-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-pipeline-runtime-minimal-cpu-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-minimal-cpu-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-minimal-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-minimal-rocm-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9 Red Hat OpenShift Container Platform 4 Affected openshift4/ose-monitoring-plugin-rhel9 Red Hat Openshift Data Foundation 4 Affected odf4/mcg-core-rhel9 Red Hat Openshift Data Foundation 4 Affected odf4/ocs-client-console-rhel9 Red Hat Openshift Data Foundation 4 Affected odf4/odf-console-rhel9 Red Hat Openshift Data Foundation 4 Affected odf4/odf-multicluster-console-rhel9 Red Hat OpenShift Dev Spaces Affected devspaces/dashboard-rhel9 Red Hat Satellite 6 Affected nodejs-compression-webpack-plugin Red Hat Satellite 6 Affected nodejs-mini-css-extract-plugin Red Hat Satellite 6 Affected nodejs-webpack Red Hat Satellite 6 Affected satellite/iop-advisor-frontend-rhel9 streams for Apache Kafka 2 Not affected com.github.streamshub-console streams for Apache Kafka 3 Not affected com.github.streamshub-console https://www.cve.org/CVERecord?id=CVE-2026-6321 https://nvd.nist.gov/vuln/detail/CVE-2026-6321 https://cna.openjsf.org/security-advisories.html https://github.com/fastify/fast-uri/security/advisories/GHSA-q3j6-qgpj-74h6