ESB-2026.5866

=========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2026.5866 Red Hat OpenShift Dev Spaces 3.28.0 Release. 29 May 2026 =========================================================================== AUSCERT Security Bulletin Summary --------------------------------- Product: Red Hat OpenShift Dev Spaces 3.28.0 Publisher: Red Hat Operating System: Red Hat Resolution: Patch/Upgrade CVE Names: CVE-2026-41240 CVE-2026-40975 CVE-2026-1526 CVE-2026-1528 CVE-2026-2229 CVE-2026-29074 CVE-2026-32141 CVE-2026-40972 CVE-2026-40973 CVE-2026-42044 CVE-2026-30827 CVE-2026-34742 CVE-2026-35051 CVE-2026-39858 CVE-2026-40477 CVE-2026-40478 CVE-2026-40611 CVE-2026-33252 CVE-2025-14813 CVE-2026-0636 CVE-2026-1605 CVE-2026-26996 CVE-2026-27904 CVE-2026-32280 CVE-2026-32282 CVE-2026-40912 CVE-2026-5588 CVE-2026-33810 CVE-2026-2327 CVE-2026-40895 CVE-2026-42033 CVE-2026-42035 CVE-2026-42039 CVE-2026-42041 CVE-2026-42043 CVE-2026-1525 CVE-2025-68121 CVE-2026-32305 CVE-2026-31802 Original Bulletin: https://access.redhat.com/errata/RHSA-2026:21772 Comment: CVSS (Max): 8.8 CVE-2026-40611 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) CVSS Source: Red Hat Calculator: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H EPSS (Max): 0.2% (38th) CVE-2026-2229 2026-05-28 - --------------------------BEGIN INCLUDED TEXT-------------------- RHSA-2026:21772 - Security Advisory Issued: 2026-05-28 Updated: 2026-05-28 Synopsis Hat openshift dev spaces 3.28.0 release. Type/Severity Security Advisory: Important Topic Red Hat OpenShift Dev Spaces 3.28.0 has been released. Description Red Hat OpenShift Dev Spaces provides a cloud developer workspace server and a browser-based IDE built for teams and organizations. Dev Spaces runs in OpenShift and is well-suited for container-based development. The 3.28 release is based on Eclipse Che 7.117 and uses the DevWorkspace engine to provide support for workspaces based on devfile v2.1 and v2.2. Users still using the v1 standard should migrate as soon as possible. https://devfile.io/docs/2.2.0/migrating-to-devfile-v2 Dev Spaces supports OpenShift EUS releases v4.16 and higher. Users are expected to update to supported OpenShift releases in order to continue to get Dev Spaces updates. https://access.redhat.com/support/policy/updates/openshift#crw Solution Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Fixes (none) CVEs o CVE-2025-14813 o CVE-2025-68121 o CVE-2026-0636 o CVE-2026-1525 o CVE-2026-1526 o CVE-2026-1528 o CVE-2026-1605 o CVE-2026-2229 o CVE-2026-2327 o CVE-2026-26996 o CVE-2026-27904 o CVE-2026-29074 o CVE-2026-30827 o CVE-2026-31802 o CVE-2026-32141 o CVE-2026-32280 o CVE-2026-32282 o CVE-2026-32305 o CVE-2026-33252 o CVE-2026-33810 o CVE-2026-34742 o CVE-2026-35051 o CVE-2026-39858 o CVE-2026-40477 o CVE-2026-40478 o CVE-2026-40611 o CVE-2026-40895 o CVE-2026-40912 o CVE-2026-40972 o CVE-2026-40973 o CVE-2026-40975 o CVE-2026-41240 o CVE-2026-42033 o CVE-2026-42035 o CVE-2026-42039 o CVE-2026-42041 o CVE-2026-42043 o CVE-2026-42044 o CVE-2026-5588 References o https://access.redhat.com/documentation/en-us/red_hat_openshift_dev_spaces/ 3.28/html/administration_guide/installing-devspaces o https://access.redhat.com/security/updates/classification/ - --------------------------END INCLUDED TEXT---------------------- You have received this e-mail bulletin as a result of your organisation's registration with AUSCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AUSCERT's members. As AUSCERT did not write the document quoted above, AUSCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AUSCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: https://portal.auscert.org.au/bulletins/ =========================================================================== AUSCERT The University of Queensland, Brisbane QLD 4072 Australia e: auscert@auscert.org.au t: +61 (0)7 3365 4417 Allies in Cyber Security ===========================================================================