VDB
RHSA-2026:67538
RHSA-2026:67538
PUBLISHED
CVSS 7.099999904632568 HIGH
A flaw was found in golang.org/x/net/html. When arbitrary HTML is parsed and then rendered, it can result in an unexpected HTML tree. This allows an attacker to bypass HTML sanitization mechanisms, leading to Cross-Site Scripting (XSS) attacks in applications. Such attacks can result in information disclosure or arbitrary code execution.
Risk Scores
CVSS 3.1
7.099999904632568
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/rhacm2/acm-cluster-permission-rhel9@sha256:cbce66f9f603cb7f7bb33190022ac95575d82dbaaf4c2790cd8e9b353c4895c8_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.11 | *, * |
| Red Hat | registry.redhat.io/rhacm2/kube-rbac-proxy-rhel9@sha256:19277dc643ed9bea5fc39ec706b2c5adcde899cd53fbd0f56c4cd625efcb05cf_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.11 | *, * |
| Red Hat | registry.redhat.io/rhacm2/acm-must-gather-rhel9@sha256:2f6d13370ad07950e91ed2c17224510f1a6448e9510f2b8ca2ef02a0d1d614ca_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.11 | *, * |
| Red Hat | registry.redhat.io/rhacm2/endpoint-monitoring-rhel9-operator@sha256:c2e75feb57f66ea1b4b00dafc7e91cb51a34810724e4ddfde812010f1bbb6022_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.11 | *, * |
| Red Hat | registry.redhat.io/rhacm2/rbac-query-proxy-rhel9@sha256:5f168124747014f4bb0a6fb61044bfc3dc22d4f3abbda5df50b2bf21845578cb_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.11 | *, * |
| Red Hat | registry.redhat.io/rhacm2/acm-prometheus-rhel9@sha256:e15cd8194de068c5c95f2e1762e1dab4142edac8eb4514fd09f025f6ee943f58_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.11 | *, * |
| Red Hat | registry.redhat.io/rhacm2/acm-governance-policy-framework-addon-rhel9@sha256:6e3e248820e533889930bd55c675d39cf8821903f91e78fd8402b7b8c196db70_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.11 | *, * |
| Red Hat | registry.redhat.io/rhacm2/multicluster-operators-subscription-rhel9@sha256:4a7ad1c5f460301c77f671316d1d198f1ddc72391bfd4b8938c333eb3836ae04_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.11 | *, * |
| Red Hat | registry.redhat.io/rhacm2/insights-metrics-rhel9@sha256:487cb1bb4750c3e905d53792ed1ac6eb2d038bb303f0b62158c45620c2c2f5b6_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.11 | *, * |
| Red Hat | registry.redhat.io/rhacm2/multicloud-integrations-rhel9@sha256:a7a23ee4d90b2326e040fe0b6f6316b7e989b668bb8d6b8e3c027a8584b810d1_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.11 | *, * |
| Red Hat | registry.redhat.io/rhacm2/rbac-query-proxy-rhel9@sha256:cc0b5de30d766a54b761ba587c01fc0ee62b675d459c2cc1d64b774c1b5cfdef_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.11 | *, * |
| Red Hat | registry.redhat.io/rhacm2/multicluster-observability-rhel9-operator@sha256:2c3462ed968d989ea1467133439ea455fa21208dea2141b78106eb8edf947aa4_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.11 | *, * |
| Red Hat | registry.redhat.io/rhacm2/acm-search-indexer-rhel9@sha256:21e5bebaff778a804a56812b7ecd742a0546b8fe9641d4e0b7bd6a2061c79ea0_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.11 | *, * |
| Red Hat | registry.redhat.io/rhacm2/klusterlet-addon-controller-rhel9@sha256:a03c7c8050f2a51d0d62294a9cb147dcf199544d8a7465d6511a9fcb7fa95e74_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.11 | *, * |
| Red Hat | registry.redhat.io/rhacm2/prometheus-alertmanager-rhel9@sha256:99bd594dbebed793a186b01e30f13e7a009e3d7de1b8937ab5eb364bebd0ee99_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.11 | *, * |
| Red Hat | registry.redhat.io/rhacm2/endpoint-monitoring-rhel9-operator@sha256:60955044587eee09e5fe15c112dacf044e3af55f9e8fc114e8f4a01f5b599462_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.11 | *, * |
| Red Hat | registry.redhat.io/rhacm2/acm-search-v2-api-rhel9@sha256:2f90a7255906025ee80225d9c464cb7eb20e58bc0c26683c6a69115ad53e87bb_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.11 | *, * |
| Red Hat | registry.redhat.io/rhacm2/prometheus-rhel9@sha256:035b2a9927ae58df505614e25a9dbdbd548d61148d7c93a40850b22d203db254_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.11 | *, * |
| Red Hat | registry.redhat.io/rhacm2/submariner-addon-rhel9@sha256:8902a6dc4974f58affd5c04ec0874fa2f06fc2db23edbd1aa868c4d1dff5b3ca_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.11 | *, * |
| Red Hat | registry.redhat.io/rhacm2/insights-client-rhel9@sha256:7f72aae971ed53c2b13d06f52de22e5aa09cc60bada516534824f420e40c75ee_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.11 | *, * |
…and 144 more
Timeline
- Sep 15, 2026 CVE Published
- Sep 23, 2026 CVE Updated
- Sep 23, 2026 Distribution Patch
- Sep 23, 2026 Distribution Patch
- Sep 23, 2026 Security Advisory
- Sep 23, 2026 Security Advisory
- Sep 23, 2026 Security Advisory
- Sep 23, 2026 Security Advisory
- Sep 23, 2026 Security Advisory
- Sep 23, 2026 Security Advisory
- Sep 23, 2026 Security Advisory
- Sep 23, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:67538 advisory
- https://access.redhat.com/security/cve/CVE-2026-27136 advisory
- https://access.redhat.com/security/cve/CVE-2026-41178 advisory
- https://access.redhat.com/security/cve/CVE-2026-42151 advisory
- https://access.redhat.com/security/cve/CVE-2026-42154 advisory
- https://access.redhat.com/security/cve/CVE-2026-42502 advisory
- https://access.redhat.com/security/cve/CVE-2026-48586 advisory
- https://access.redhat.com/security/cve/CVE-2026-55969 advisory
- https://access.redhat.com/security/cve/CVE-2026-56852 advisory
- https://access.redhat.com/security/cve/CVE-2026-66780 advisory
- https://access.redhat.com/security/cve/CVE-2026-71556 advisory
- https://access.redhat.com/security/cve/CVE-2026-73646 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://access.redhat.com/security/updates/classification/#important advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_67538.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2480757 issue
- https://www.cve.org/CVERecord?id=CVE-2026-27136 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-27136 advisory
- https://go.dev/cl/781685 advisory
- https://go.dev/issue/79575 advisory
…and 61 more