VDB
RHSA-2026:59153
RHSA-2026:59153
PUBLISHED
CVSS 7.699999809265137 HIGH
A flaw was found in webpack-dev-server. When a user configures a proxy with a broad context, such as '/', and enables WebSocket (ws: true) forwarding, the development server's own Hot Module Replacement (HMR) WebSocket can be intercepted. This interception leads to the leakage of the browser's cookies and Origin header to the proxy target, bypassing the server's Host/Origin validation. Additionally, it can corrupt the HMR socket, resulting in a denial of service for the HMR functionality.
Risk Scores
CVSS 3.1
7.699999809265137
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/ansible-automation-platform-27/gateway-rhel9-operator@sha256:1ad56ef8e29470f8366213e2c0fa3d1cb93be1e43a83644dcf542e4e378fb6c9_arm64 as a component of Red Hat Ansible Automation Platform 2.7 | * |
| Red Hat | registry.redhat.io/ansible-automation-platform-27/de-minimal-rhel9@sha256:9d04f0a9793b0fbc1874b5399d475fa9bbad9dd166eac24ec54bd74c63837b09_arm64 as a component of Red Hat Ansible Automation Platform 2.7 | * |
| Red Hat | registry.redhat.io/ansible-automation-platform-27/mcp-tools-rhel9@sha256:864a8ef39937a5bf069bd7b69a6e02cacc952ba020b4014b6fa29cec4b3860f6_arm64 as a component of Red Hat Ansible Automation Platform 2.7 | * |
| Red Hat | registry.redhat.io/ansible-automation-platform-27/gateway-proxy-rhel9@sha256:cdddbe67aec1c8147dbc2f3aae4b8d2604f970edf368facaeb77c520bfa56b47_amd64 as a component of Red Hat Ansible Automation Platform 2.7 | * |
| Red Hat | registry.redhat.io/ansible-automation-platform-27/gateway-proxy-rhel9@sha256:de1c0e6772ef029e44428937ada2cd97143b1a1dbb67989d32ee007dddc2b549_arm64 as a component of Red Hat Ansible Automation Platform 2.7 | * |
| Red Hat | registry.redhat.io/ansible-automation-platform-27/mcp-server-rhel9@sha256:99088c794069015c77c02fe7e58f51e0f65ad1a87856176b5d1bceba954f1b49_amd64 as a component of Red Hat Ansible Automation Platform 2.7 | * |
| Red Hat | registry.redhat.io/ansible-automation-platform-27/ee-minimal-rhel9@sha256:f45c0f53123e8fcc25bd90c4f8eecc4eaa90091cb632ab39ed964141c2fa081b_arm64 as a component of Red Hat Ansible Automation Platform 2.7 | * |
| Red Hat | registry.redhat.io/ansible-automation-platform-27/platform-resource-runner-rhel9@sha256:193f4e8acaaf1d96ab1c70d12d9403e743f0bfe2a770284c4787589ee6c59c9e_arm64 as a component of Red Hat Ansible Automation Platform 2.7 | * |
| Red Hat | registry.redhat.io/ansible-automation-platform-27/metrics-service-rhel9@sha256:9d1785aaa18ccf19797b64881c1102c3044d1e2c921778ffb67d970f9b67d191_arm64 as a component of Red Hat Ansible Automation Platform 2.7 | * |
| Red Hat | registry.redhat.io/ansible-automation-platform-27/hub-web-rhel9@sha256:6d07709fba0f4ed51d4a8f516d75112b0bd4486b0e5a32b7ac4376372e8e9a63_amd64 as a component of Red Hat Ansible Automation Platform 2.7 | * |
| Red Hat | registry.redhat.io/ansible-automation-platform-27/gateway-rhel9@sha256:5f77e82c4f0edeccfd5e0497aa215b4b0377fd22b84eca75e8d8773bcbc20794_arm64 as a component of Red Hat Ansible Automation Platform 2.7 | * |
| Red Hat | registry.redhat.io/ansible-automation-platform-27/gateway-rhel9-operator@sha256:c6377830acd011a62f538934d5774393016c6b8d4de0276fa0d57b669eefbe29_amd64 as a component of Red Hat Ansible Automation Platform 2.7 | * |
| Red Hat | registry.redhat.io/ansible-automation-platform-27/gateway-rhel9@sha256:d14006bbb87f890f0da365a84ea28a093d145de0ea4583c7db8eb85bffe4c457_amd64 as a component of Red Hat Ansible Automation Platform 2.7 | * |
| Red Hat | registry.redhat.io/ansible-automation-platform-27/eda-controller-ui-rhel9@sha256:991f94d6b73b1b962074c93a8a75fe967723d721b6dce73bcb89a37664fa3ebb_amd64 as a component of Red Hat Ansible Automation Platform 2.7 | * |
| Red Hat | registry.redhat.io/ansible-automation-platform-27/lightspeed-chatbot-rhel9@sha256:a17434c206faf80292d64451e8c8e6b3e20b0e666e6eb610ed2d04fbd6b23d10_arm64 as a component of Red Hat Ansible Automation Platform 2.7 | * |
| Red Hat | registry.redhat.io/ansible-automation-platform-27/eda-controller-rhel9@sha256:064ffb1056ba4904a013a74f9a3f562a5d98cdd0430a23b969b2315f95b8f0f1_amd64 as a component of Red Hat Ansible Automation Platform 2.7 | * |
| Red Hat | registry.redhat.io/ansible-automation-platform-27/ansible-builder-rhel9@sha256:e56f274e22a999a76f60221325a5e0f73e19b25c70f8be9871cdd6fcd9bc243a_amd64 as a component of Red Hat Ansible Automation Platform 2.7 | * |
| Red Hat | registry.redhat.io/ansible-automation-platform-27/de-supported-rhel9@sha256:c12da193d389ff5997744cb7e3065e2c7412ba2b171d0b2c5587dcaa1680411a_amd64 as a component of Red Hat Ansible Automation Platform 2.7 | * |
| Red Hat | registry.redhat.io/ansible-automation-platform-27/aap-must-gather-rhel9@sha256:65bbd3871114b352e90c1b5bb23aa374863929b3f5627fe91afa75a416ddc481_arm64 as a component of Red Hat Ansible Automation Platform 2.7 | * |
| Red Hat | registry.redhat.io/ansible-automation-platform-27/ee-minimal-rhel9@sha256:6217cc795a40239fa048e902dae52844c7aa4c121b59f6c6c519d4f66dadb98e_arm64 as a component of Red Hat Ansible Automation Platform 2.7 | * |
…and 42 more
Timeline
- Aug 24, 2026 CVE Published
- Aug 25, 2026 CVE Updated
- Aug 25, 2026 Distribution Patch
- Aug 25, 2026 Distribution Patch
- Aug 25, 2026 Security Advisory
- Aug 25, 2026 Security Advisory
- Aug 25, 2026 Security Advisory
- Aug 25, 2026 Security Advisory
- Aug 25, 2026 Security Advisory
- Aug 25, 2026 Security Advisory
- Aug 25, 2026 Security Advisory
- Aug 25, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:59153 advisory
- https://access.redhat.com/security/cve/CVE-2026-12143 advisory
- https://access.redhat.com/security/cve/CVE-2026-15307 advisory
- https://access.redhat.com/security/cve/CVE-2026-27459 advisory
- https://access.redhat.com/security/cve/CVE-2026-39363 advisory
- https://access.redhat.com/security/cve/CVE-2026-44244 advisory
- https://access.redhat.com/security/cve/CVE-2026-44545 advisory
- https://access.redhat.com/security/cve/CVE-2026-44705 advisory
- https://access.redhat.com/security/cve/CVE-2026-46625 advisory
- https://access.redhat.com/security/cve/CVE-2026-59886 advisory
- https://access.redhat.com/security/cve/CVE-2026-69243 advisory
- https://access.redhat.com/security/cve/CVE-2026-69244 advisory
- https://access.redhat.com/security/cve/CVE-2026-71364 advisory
- https://access.redhat.com/security/cve/CVE-2026-71365 advisory
- https://access.redhat.com/security/cve/CVE-2026-71366 advisory
- https://access.redhat.com/security/cve/CVE-2026-9595 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.7/whats_new-async_updates advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_59153.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2488934 issue
…and 85 more