VDB
RHSA-2026:60388
RHSA-2026:60388
PUBLISHED
CVSS 6.800000190734863 MEDIUM
A flaw was found in the `ip-address` library. This library, used for parsing and manipulating IPv4 and IPv6 addresses in JavaScript, is vulnerable to Server-Side Request Forgery (SSRF) due to incorrect classification of IPv4-mapped/NAT64 IPv6 addresses. An attacker could exploit this misclassification to bypass network restrictions and potentially access or manipulate internal resources. This vulnerability can be exploited on any dual-stack host for IPv4-mapped addresses, and for NAT64, it requires a NAT64/DNS64 gateway in the deployment network.
Risk Scores
CVSS 3.1
6.800000190734863
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/rhacm2/acm-governance-policy-framework-addon-rhel9@sha256:d57a10da0075ce7c66ea5a65ba6b7debaa6de28f79e4553be33a137577b41b13_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.14 | * |
| Red Hat | registry.redhat.io/rhacm2/cluster-backup-rhel9-operator@sha256:04fe2d4880d42890325ff697c84bd413218a9fd7f316c4dd195eb307ee2ae859_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.14 | * |
| Red Hat | registry.redhat.io/rhacm2/cluster-backup-rhel9-operator@sha256:3ffb54a51d08d77a3340914bac096cb31dc71145f681a9bcd311f1c38e4256a1_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.14 | * |
| Red Hat | registry.redhat.io/rhacm2/governance-policy-propagator-rhel9@sha256:4245edf22e5b327a45ec79ab34e4a607593d4778d79d32ba50c5cee9730bfa77_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.14 | * |
| Red Hat | registry.redhat.io/rhacm2/thanos-rhel9@sha256:ea3d86e0a61f92685d3bd2471caf11b253eaee5cface1fffb1796bcf7aeb64d0_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.14 | * |
| Red Hat | registry.redhat.io/rhacm2/multicluster-operators-application-rhel9@sha256:e29117d8232c0ad309d701ecddeb25a55764b8a82def9f3cb6b7713f94ac359d_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.14 | * |
| Red Hat | registry.redhat.io/rhacm2/node-exporter-rhel9@sha256:a0a0442f83f3f7a69ab5c6a1cbefd131011470105b8e68cb603de1299c438a07_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.14 | * |
| Red Hat | registry.redhat.io/rhacm2/endpoint-monitoring-rhel9-operator@sha256:57d52ccb15eefca43e8fdd70d082a1c291f7eceb2017caa6bb8333b86520ab52_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.14 | * |
| Red Hat | registry.redhat.io/rhacm2/acm-siteconfig-rhel9@sha256:b25e2a2522efa2bce4eb6bf581fed5dacd99b6b6121dde5693d2819e53acf631_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.14 | * |
| Red Hat | registry.redhat.io/rhacm2/node-exporter-rhel9@sha256:94e60a9cd4573fffa4de36eb76f96dfe7a0175cf437b47e9020cc39c7dd6e277_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.14 | * |
| Red Hat | registry.redhat.io/rhacm2/acm-search-v2-api-rhel9@sha256:0e053b448d320b4cfedf182323a1beb2423b512fe98a2edb1383488d4ec40fcd_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.14 | * |
| Red Hat | registry.redhat.io/rhacm2/observatorium-rhel9-operator@sha256:be23d21573486c179d3fdfa3d497d440d191613d4fef991dd393942c9ba19dab_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.14 | * |
| Red Hat | registry.redhat.io/rhacm2/config-policy-controller-rhel9@sha256:5d8af66bb273c3b1b7b0aebc5e534bb1c22a4fd1a81f1096de7cb9a922b1eef2_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.14 | * |
| Red Hat | registry.redhat.io/rhacm2/multicluster-operators-subscription-rhel9@sha256:9e45059a2c2b1ced8c089294a8191021472ab93bb726033c18fe5a0a4caa5a6d_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.14 | *, *, * |
| Red Hat | registry.redhat.io/rhacm2/insights-metrics-rhel9@sha256:b27857cd0ccaa5584e3ad1bdc87f2087eb17db6e693006960fd5f7e038d1e229_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.14 | * |
| Red Hat | registry.redhat.io/rhacm2/thanos-rhel9@sha256:c9cb057aaed44f8d26d5074ee808dc63c3b9791ccae552a78c835784a3bac1ef_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.14 | * |
| Red Hat | registry.redhat.io/rhacm2/memcached-exporter-rhel9@sha256:2282c491f0d40650a8951261e59f7ba928491cab0ecdf9019e4d9f9b54dd522b_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.14 | * |
| Red Hat | registry.redhat.io/rhacm2/console-rhel9@sha256:7a09fd1d65f706e0e9ab1403dc8600abfa528225e816ef3814f0877f64f7f8e5_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.14 | * |
| Red Hat | registry.redhat.io/rhacm2/prometheus-rhel9@sha256:5b3e0efb149b15eca43cb37674d1d170eeb79b0af2f3ede8b0a58aa16db417c4_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.14 | * |
| Red Hat | registry.redhat.io/rhacm2/cluster-backup-rhel9-operator@sha256:ffa6981a04f2439051744797f933da5221f7a96c46998188014e90b999a3ffd3_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.14 | * |
…and 160 more
Timeline
- Aug 26, 2026 CVE Published
- Sep 1, 2026 Security Advisory
- Sep 9, 2026 Security Advisory
- Oct 9, 2026 CVE Updated
- Oct 9, 2026 Distribution Patch
- Oct 9, 2026 Distribution Patch
- Oct 9, 2026 Security Advisory
- Oct 9, 2026 Security Advisory
- Oct 9, 2026 Security Advisory
- Oct 9, 2026 Security Advisory
- Oct 9, 2026 Security Advisory
- Oct 9, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:60388 advisory
- https://access.redhat.com/security/cve/CVE-2026-10090 advisory
- https://access.redhat.com/security/cve/CVE-2026-12143 advisory
- https://access.redhat.com/security/cve/CVE-2026-14362 advisory
- https://access.redhat.com/security/cve/CVE-2026-18874 advisory
- https://access.redhat.com/security/cve/CVE-2026-25681 advisory
- https://access.redhat.com/security/cve/CVE-2026-27136 advisory
- https://access.redhat.com/security/cve/CVE-2026-27145 advisory
- https://access.redhat.com/security/cve/CVE-2026-33815 advisory
- https://access.redhat.com/security/cve/CVE-2026-41178 advisory
- https://access.redhat.com/security/cve/CVE-2026-42151 advisory
- https://access.redhat.com/security/cve/CVE-2026-42502 advisory
- https://access.redhat.com/security/cve/CVE-2026-44740 advisory
- https://access.redhat.com/security/cve/CVE-2026-45623 advisory
- https://access.redhat.com/security/cve/CVE-2026-46600 advisory
- https://access.redhat.com/security/cve/CVE-2026-47219 advisory
- https://access.redhat.com/security/cve/CVE-2026-53488 advisory
- https://access.redhat.com/security/cve/CVE-2026-54272 advisory
- https://access.redhat.com/security/cve/CVE-2026-56852 advisory
- https://access.redhat.com/security/cve/CVE-2026-59869 advisory
…and 305 more