VDB
RHSA-2026:56855
RHSA-2026:56855
PUBLISHED
CVSS 7.5 HIGH
A flaw was found in the crypto/tls component. This vulnerability occurs during Transport Layer Security (TLS) session resumption when certificate authority (CA) settings are modified between the initial and resumed handshakes. An attacker could exploit this to bypass certificate validation, allowing a client or server to establish a connection that should have been rejected. This could lead to an authentication bypass under specific conditions.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/openshift4/ose-dpu-cni-rhel9@sha256:8ab730075537c515aa9b59b20544a50257e52fa02c93f424b81b3e55ecee0c8b_arm64 as a component of Red Hat OpenShift Container Platform 4.16 | * |
| Red Hat | registry.redhat.io/openshift4/ose-secrets-store-csi-driver-rhel9-operator@sha256:2ac1ce0a493f50fc343261c37e7bcb0ea083cab54ec1c1c73455a92846dbe3f0_arm64 as a component of Red Hat OpenShift Container Platform 4.16 | * |
| Red Hat | registry.redhat.io/openshift4/ose-dpu-rhel9-operator@sha256:8c710e76d6ff0ce19655369089c0d6e23ce77cb7e138642bfdb43b82b2a70e8d_ppc64le as a component of Red Hat OpenShift Container Platform 4.16 | * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-nfd-rhel9-operator@sha256:1bcae64f54179735c4b6b4eb8e71b071884856a68cad61acc3488696e1cc61fa_ppc64le as a component of Red Hat OpenShift Container Platform 4.16 | * |
| Red Hat | registry.redhat.io/openshift4/ose-smb-csi-driver-rhel9-operator@sha256:83577af4e42f7033d3adc390aab63fd8302c162a9a8223ac31d9faf8929accfd_ppc64le as a component of Red Hat OpenShift Container Platform 4.16 | * |
| Red Hat | registry.redhat.io/openshift4/ose-local-storage-rhel9-operator@sha256:d6443d1371eee85896ca89d74b4c985d47f14477e0a05601db3ad277f4a90f33_ppc64le as a component of Red Hat OpenShift Container Platform 4.16 | * |
| Red Hat | registry.redhat.io/openshift4/metallb-rhel9@sha256:c5d847e41b88f9208a623b1ce5f461f40584a261204e0d3f25e6c26d412871d5_ppc64le as a component of Red Hat OpenShift Container Platform 4.16 | * |
| Red Hat | registry.redhat.io/openshift4/ose-helm-rhel9-operator@sha256:bc64bb1f61f2dcf79860879f1fdaa1391b4e218bef04704446575eac8c7072b2_amd64 as a component of Red Hat OpenShift Container Platform 4.16 | * |
| Red Hat | registry.redhat.io/openshift4/ingress-node-firewall-rhel9@sha256:6bcc7a931c90d26f91e56c7430579d754199aa1352befe3b5ebf14181ec16cd0_s390x as a component of Red Hat OpenShift Container Platform 4.16 | * |
| Red Hat | registry.redhat.io/openshift4/ose-operator-sdk-rhel9@sha256:d10ba993cf81099646ee84dd0d2b6fdcfd9165b2e5bfd3a4c49f767778520c61_s390x as a component of Red Hat OpenShift Container Platform 4.16 | * |
| Red Hat | registry.redhat.io/openshift4/ose-egress-router-rhel9@sha256:6ee9ed9a161c18ce2a11fe7d6c48966645d5dcb0974c0366d4ee65f6e06a3d57_s390x as a component of Red Hat OpenShift Container Platform 4.16 | * |
| Red Hat | registry.redhat.io/openshift4/ose-egress-http-proxy-rhel9@sha256:7da4b1f223179367ec9b574b2da72477806a6fb5ff1e65b9f149e296186191ff_s390x as a component of Red Hat OpenShift Container Platform 4.16 | * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-capacity-rhel9@sha256:00f9dcaa18162540d9c0cfe157f7c19b8c775b2cc6acd5360f3622426dcac1bc_arm64 as a component of Red Hat OpenShift Container Platform 4.16 | * |
| Red Hat | registry.redhat.io/openshift4/ose-kubernetes-nmstate-handler-rhel9@sha256:c324984ea865800454f4b600764974aa31ab1b72008544b906ae84c26d906a37_s390x as a component of Red Hat OpenShift Container Platform 4.16 | * |
| Red Hat | registry.redhat.io/openshift4/ose-gcp-filestore-csi-driver-rhel9-operator@sha256:abe1456006761764b2c39b4b37ec02f440ca6e27259098807ba17070f0313627_ppc64le as a component of Red Hat OpenShift Container Platform 4.16 | * |
| Red Hat | registry.redhat.io/openshift4/ose-secrets-store-csi-driver-rhel9@sha256:bb63a59f72452c91c7aa65029f3a927203c7c0d5b491421a05b49813d1fe0e8c_amd64 as a component of Red Hat OpenShift Container Platform 4.16 | * |
| Red Hat | registry.redhat.io/openshift4/ose-gcp-filestore-csi-driver-rhel9-operator@sha256:976e6c6e797a93c1bffadb874beef8cc429bd54ac22840089b25394dde57f376_arm64 as a component of Red Hat OpenShift Container Platform 4.16 | * |
| Red Hat | registry.redhat.io/openshift4/ose-vertical-pod-autoscaler-rhel9-operator@sha256:173ee98a6319faabfac84b160e3c82ce7deefd61fb226a27985a2f660c0297e7_arm64 as a component of Red Hat OpenShift Container Platform 4.16 | * |
| Red Hat | registry.redhat.io/openshift4/ose-sriov-network-config-daemon-rhel9@sha256:f38c604aa062b9b33e9210b572255392e668e7e26cbd55c716bb3a7066ddabbf_ppc64le as a component of Red Hat OpenShift Container Platform 4.16 | * |
| Red Hat | registry.redhat.io/openshift4/ose-local-storage-rhel9-operator@sha256:0ce32373e6290b8693d03ea8e7125490c6531e392806047c6eca4e19d2b3681f_arm64 as a component of Red Hat OpenShift Container Platform 4.16 | * |
…and 173 more
Timeline
- Aug 26, 2026 CVE Published
- Sep 12, 2026 CVE Updated
- Sep 12, 2026 Distribution Patch
- Sep 12, 2026 Distribution Patch
- Sep 12, 2026 Security Advisory
- Sep 12, 2026 Security Advisory
- Sep 12, 2026 Security Advisory
- Sep 12, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:56855 advisory
- https://access.redhat.com/security/cve/CVE-2025-68121 advisory
- https://access.redhat.com/security/cve/CVE-2026-32280 advisory
- https://access.redhat.com/security/cve/CVE-2026-33811 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_56855.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2437111 issue
- https://www.cve.org/CVERecord?id=CVE-2025-68121 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-68121 advisory
- https://go.dev/cl/737700 advisory
- https://go.dev/issue/77217 advisory
- https://groups.google.com/g/golang-announce/c/K09ubi9FQFk advisory
- https://pkg.go.dev/vuln/GO-2026-4337 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2456339 issue
- https://www.cve.org/CVERecord?id=CVE-2026-32280 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-32280 advisory
- https://go.dev/cl/758320 advisory
- https://go.dev/issue/78282 advisory
- https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU advisory
- https://pkg.go.dev/vuln/GO-2026-4947 advisory
…and 7 more