Skip to content
OpenAdvisories
Medium RHSA-2026:95611 2 CVEs

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Published Nov 13, 2026 · Updated Nov 13, 2026

Ecosystem: Red Hat

Fixed packages 5

ReleasePackageFixed in
Red Hat · Hardened Images 1 hummingbird:1 podman 5:6.1.4-1.3.hum1
Red Hat · Hardened Images 1 hummingbird:1 podman-docker 5:6.1.4-1.3.hum1
Red Hat · Hardened Images 1 hummingbird:1 podman-machine 5:6.1.4-1.3.hum1
Red Hat · Hardened Images 1 hummingbird:1 podman-remote 5:6.1.4-1.3.hum1
Red Hat · Hardened Images 1 hummingbird:1 podmansh 5:6.1.4-1.3.hum1

Vulnerabilities 2

  • Medium 6.7
    CVE-2026-121522

    Possible panic from Git source resolver

    In BuildKit versions v0.26.0 through v0.34.1, a specific build definition that resolves metadata for the same Git source reference twice can cause the BuildKit daemon to panic and crash, interrupting builds handled by that daemon. The issue is fixed in v0.34.…

    moby BuildKit docker.io docker.io-app Ubuntu
  • Medium 4.5
    CVE-2026-121520

    Malicious client could set xattr value outside of BuildKit state directory

    In BuildKit versions prior to v0.34.1, a malicious client with access to the BuildKit control APIs can submit a build request that sets an extended attribute on a file outside the BuildKit state directory. Extended attributes in the trusted. or security. name…

    moby BuildKit docker.io moby-engine Ubuntu Azure Linux

References

  • report
    https://access.redhat.com/security/cve/CVE-2026-121520
  • report
    https://access.redhat.com/security/cve/CVE-2026-121522
  • article
    https://access.redhat.com/security/updates/classification/
  • article
    https://images.redhat.com/
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_95611.json
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2566567
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-121520
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-121520
  • article
    https://github.com/moby/buildkit/security/advisories/GHSA-w26x-xg27-7qjc
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2566562
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-121522
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-121522
  • article
    https://github.com/moby/buildkit/security/advisories/GHSA-2fqp-xg6f-v7gj