VDB
RHSA-2026:50357
RHSA-2026:50357
PUBLISHED
CVSS 7.199999809265137 HIGH
A flaw was found in webpack-dev-server. When a user configures a proxy with a broad context, such as '/', and enables WebSocket (ws: true) forwarding, the development server's own Hot Module Replacement (HMR) WebSocket can be intercepted. This interception leads to the leakage of the browser's cookies and Origin header to the proxy target, bypassing the server's Host/Origin validation. Additionally, it can corrupt the HMR socket, resulting in a denial of service for the HMR functionality.
Risk Scores
CVSS 3.1
7.199999809265137
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/ansible-automation-platform-25/hub-web-rhel8@sha256:8395b9fd0c90ac3c8f1d5738234e6460948e1813b6fcd98325580a9aad426900_arm64 as a component of Red Hat Ansible Automation Platform 2.5 | * |
| Red Hat | registry.redhat.io/ansible-automation-platform-25/hub-rhel8-operator@sha256:b22535c9d39ce034f663ecb621a4512187991db1234843591cdcbed5db64e7c3_ppc64le as a component of Red Hat Ansible Automation Platform 2.5 | * |
| Red Hat | registry.redhat.io/ansible-automation-platform-25/ansible-python-base-rhel8@sha256:b2f58d067e34cf34c848dc49b91224d020e6d04803b1fb835cccaafb02607c67_ppc64le as a component of Red Hat Ansible Automation Platform 2.5 | * |
| Red Hat | registry.redhat.io/ansible-automation-platform-25/ansible-python-toolkit-rhel8@sha256:8c60b69a90a5de910c48e8fdc90eec5caf9dce2ca0cf4e19d6c945dae262ecba_amd64 as a component of Red Hat Ansible Automation Platform 2.5 | * |
| Red Hat | registry.redhat.io/ansible-automation-platform-25/ee-supported-rhel8@sha256:a864c9400ccb0728cb5ec7e78fbd01ce00e8d7fd6d4f8bf0fbc22e36ac156805_ppc64le as a component of Red Hat Ansible Automation Platform 2.5 | * |
| Red Hat | registry.redhat.io/ansible-automation-platform-25/ee-minimal-rhel8@sha256:1c6b9137409fc49ab3f0011d8a131447a8ab74d4392dfbd7dbadaefa339f155e_amd64 as a component of Red Hat Ansible Automation Platform 2.5 | * |
| Red Hat | registry.redhat.io/ansible-automation-platform-25/aap-must-gather-rhel8@sha256:b0fb268976bdff53726713cbcf17cf3e3b00b9e9aa85cd58760bae5012ac188c_amd64 as a component of Red Hat Ansible Automation Platform 2.5 | * |
| Red Hat | registry.redhat.io/ansible-automation-platform-25/aap-must-gather-rhel8@sha256:04a3b51ccd209001d37be817db54e8be8d492962e7285d1a9aa37c3ec029127a_arm64 as a component of Red Hat Ansible Automation Platform 2.5 | * |
| Red Hat | registry.redhat.io/ansible-automation-platform-25/ansible-builder-rhel8@sha256:1137dd3357ca693226837112bc8470cb507da06cc278a1bfb9d0931888908bb6_arm64 as a component of Red Hat Ansible Automation Platform 2.5 | * |
| Red Hat | registry.redhat.io/ansible-automation-platform-25/de-minimal-rhel8@sha256:3168867fb72b22e494194947c09e73d913f7b35241cb179f7d8f9fb70c63bdde_s390x as a component of Red Hat Ansible Automation Platform 2.5 | * |
| Red Hat | registry.redhat.io/ansible-automation-platform-25/controller-rhel8@sha256:d14575c03dae9d86c1dee02e7a4782df3ec2c22f867c58f9ec7f12c30f198127_amd64 as a component of Red Hat Ansible Automation Platform 2.5 | * |
| Red Hat | registry.redhat.io/ansible-automation-platform-25/gateway-proxy-rhel8@sha256:49480a28b52887c3f4fe94608e962bdb76663e27d94a9d705bc29f5c711f98d7_amd64 as a component of Red Hat Ansible Automation Platform 2.5 | * |
| Red Hat | registry.redhat.io/ansible-automation-platform-25/platform-resource-rhel8-operator@sha256:de376c9b05b433e6dafa35b2d3e772aea9098638bb057478077cc4ace9fe8ad2_s390x as a component of Red Hat Ansible Automation Platform 2.5 | * |
| Red Hat | registry.redhat.io/ansible-automation-platform-25/eda-controller-rhel8@sha256:2dbb35224d5a8dda51ae2e1fe84244eb229f919f3e76425ae0b461dcd02174d1_ppc64le as a component of Red Hat Ansible Automation Platform 2.5 | * |
| Red Hat | registry.redhat.io/ansible-automation-platform-25/ansible-python-base-rhel8@sha256:242f1d3c6b75153386a6fdd6939f0058f71e6095b41f321436241ad62831fbb8_arm64 as a component of Red Hat Ansible Automation Platform 2.5 | * |
| Red Hat | registry.redhat.io/ansible-automation-platform-25/ansible-dev-tools-rhel8@sha256:800132c135f380343666e3169f74b2b937f4861451378de74ebb8f215e2e3fd8_ppc64le as a component of Red Hat Ansible Automation Platform 2.5 | * |
| Red Hat | registry.redhat.io/ansible-automation-platform-25/ansible-builder-rhel8@sha256:397a4371bfc793cbaf02e5a10631f01f50afcfb0978513f52d6f05b116b0faf5_ppc64le as a component of Red Hat Ansible Automation Platform 2.5 | * |
| Red Hat | registry.redhat.io/ansible-automation-platform-25/gateway-rhel8-operator@sha256:e613dd6122f0c1ed26babbf99c21f356e79906d6c98101969297f25adf6db311_amd64 as a component of Red Hat Ansible Automation Platform 2.5 | * |
| Red Hat | registry.redhat.io/ansible-automation-platform-25/de-minimal-rhel8@sha256:e5561b438b42e308e1811b3662d70802346adec16e2f2e482c70697badfb31bd_ppc64le as a component of Red Hat Ansible Automation Platform 2.5 | * |
| Red Hat | registry.redhat.io/ansible-automation-platform-25/receptor-rhel8@sha256:78f526022bbb7f7445d783630a235192e3df09d962e4fcd7d8fd525e7ae393e6_amd64 as a component of Red Hat Ansible Automation Platform 2.5 | * |
…and 82 more
Timeline
- Aug 4, 2026 CVE Published
- Aug 25, 2026 CVE Updated
- Aug 25, 2026 Distribution Patch
- Aug 25, 2026 Distribution Patch
- Aug 25, 2026 Security Advisory
- Aug 25, 2026 Security Advisory
- Aug 25, 2026 Security Advisory
- Aug 25, 2026 Security Advisory
- Aug 25, 2026 Security Advisory
- Aug 25, 2026 Security Advisory
- Aug 25, 2026 Security Advisory
- Aug 25, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:50357 advisory
- https://access.redhat.com/security/cve/CVE-2026-11332 advisory
- https://access.redhat.com/security/cve/CVE-2026-13149 advisory
- https://access.redhat.com/security/cve/CVE-2026-34993 advisory
- https://access.redhat.com/security/cve/CVE-2026-44545 advisory
- https://access.redhat.com/security/cve/CVE-2026-55379 advisory
- https://access.redhat.com/security/cve/CVE-2026-59869 advisory
- https://access.redhat.com/security/cve/CVE-2026-59939 advisory
- https://access.redhat.com/security/cve/CVE-2026-9595 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.5/html/release_notes/patch_releases advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_50357.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2488934 issue
- https://www.cve.org/CVERecord?id=CVE-2026-9595 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-9595 advisory
- https://cna.openjsf.org/security-advisories.html advisory
- https://github.com/facebook/create-react-app/pull/7444 advisory
- https://github.com/vuejs/vue-cli/commit/72ba7505aff2a8314e82aa5082379a77504a1fcb advisory
- https://github.com/webpack/webpack-dev-server/pull/4316 advisory
- https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-mx8g-39q3-5c79 advisory
…and 38 more