VDB
RHSA-2026:72395
RHSA-2026:72395
PUBLISHED
CVSS 3.299999952316284 LOW
A flaw was found in curl. When an application uses libcurl to make multiple Negotiate-authenticated HTTP or HTTPS requests to the same server with different credentials, libcurl may incorrectly reuse an existing connection. This logical error can cause a subsequent request to be sent using the authentication of a previous user, leading to an authentication bypass.
Risk Scores
CVSS 3.1
3.299999952316284
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/cert-manager/cert-manager-istio-csr-rhel9@sha256:a86de0c8870d4800a1da62dcd35b0f40909c13833ee8fca88fb7b626731576e8_arm64 as a component of Cert Manager support for Red Hat OpenShift release 1.20 | * |
| Red Hat | registry.redhat.io/cert-manager/cert-manager-istio-csr-rhel9@sha256:11d39535560409a0bd51a541f08506048a69b817db68c0e847ccbf73c0feb282_amd64 as a component of Cert Manager support for Red Hat OpenShift release 1.20 | * |
| Red Hat | registry.redhat.io/cert-manager/cert-manager-istio-csr-rhel9@sha256:a075b5bf1a14057655d4b5ab1c36287d834005d8ece1e8f9c08379820bef6bff_ppc64le as a component of Cert Manager support for Red Hat OpenShift release 1.20 | * |
| Red Hat | registry.redhat.io/cert-manager/cert-manager-istio-csr-rhel9@sha256:97a48da1700e1a339a8ea36ece2927b870f12ca5c0aea5234216c7179d66f6f3_s390x as a component of Cert Manager support for Red Hat OpenShift release 1.20 | * |
Timeline
- Sep 28, 2026 CVE Published
- Oct 23, 2026 CVE Updated
- Oct 23, 2026 Distribution Patch
- Oct 23, 2026 Distribution Patch
- Oct 23, 2026 Security Advisory
- Oct 23, 2026 Security Advisory
- Oct 23, 2026 Security Advisory
- Oct 23, 2026 Security Advisory
- Oct 23, 2026 Security Advisory
- Oct 23, 2026 Security Advisory
- Oct 23, 2026 Security Advisory
- Oct 23, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:72395 advisory
- https://access.redhat.com/security/cve/CVE-2025-6170 advisory
- https://access.redhat.com/security/cve/CVE-2026-11822 advisory
- https://access.redhat.com/security/cve/CVE-2026-11824 advisory
- https://access.redhat.com/security/cve/CVE-2026-11979 advisory
- https://access.redhat.com/security/cve/CVE-2026-13757 advisory
- https://access.redhat.com/security/cve/CVE-2026-14164 advisory
- https://access.redhat.com/security/cve/CVE-2026-14456 advisory
- https://access.redhat.com/security/cve/CVE-2026-14457 advisory
- https://access.redhat.com/security/cve/CVE-2026-15588 advisory
- https://access.redhat.com/security/cve/CVE-2026-16118 advisory
- https://access.redhat.com/security/cve/CVE-2026-18798 advisory
- https://access.redhat.com/security/cve/CVE-2026-1965 advisory
- https://access.redhat.com/security/cve/CVE-2026-29181 advisory
- https://access.redhat.com/security/cve/CVE-2026-33186 advisory
- https://access.redhat.com/security/cve/CVE-2026-3783 advisory
- https://access.redhat.com/security/cve/CVE-2026-39883 advisory
- https://access.redhat.com/security/cve/CVE-2026-41989 advisory
- https://access.redhat.com/security/cve/CVE-2026-46600 advisory
- https://access.redhat.com/security/cve/CVE-2026-48864 advisory
…and 324 more