RHSA-2026:86891 | Vulnetix

RHSA-2026:86891 PUBLISHED CVSS 7.5 HIGH

A flaw was found in Micrometer's StatsD and Logging meter registries. This vulnerability allows a remote attacker to inject line terminators into metric data, such as names or tag values, due to insufficient sanitization of untrusted input. Exploitation can lead to the spoofing of arbitrary metrics, including critical system or business metrics, and the injection of false log entries, potentially impacting monitoring and auditing systems.

Risk Scores

CVSS 3.1

7.5

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected Products

Vendor	Product	Versions
Red Hat	registry.redhat.io/rhoai/odh-mcp-lifecycle-module-operator-rhel9@sha256:6b3b845ea1c20b1718b84145aa5a16b4acd7bf170cd29093f1da65c1c540b57d_amd64 as a component of Red Hat OpenShift AI 3.5	*
Red Hat	registry.redhat.io/rhoai/odh-eval-hub-rhel9@sha256:eb546d3310114b9d384a5c6bf23629ca46202cc7f1d4ca35d43602a3789d1801_ppc64le as a component of Red Hat OpenShift AI 3.5	*
Red Hat	registry.redhat.io/rhoai/odh-autorag-rhel9@sha256:45c7b27fcac23c644784a8053b70d8c1b3ec255081a707cb74e70bf7e034c68d_arm64 as a component of Red Hat OpenShift AI 3.5	*
Red Hat	registry.redhat.io/rhoai/odh-pipelines-components-rhel9@sha256:212f047697c23fa8346543e99ceb827e74d7e935c670dc86f469c9a1641e5f3d_s390x as a component of Red Hat OpenShift AI 3.5	*
Red Hat	registry.redhat.io/rhoai/odh-model-registry-job-async-upload-rhel9@sha256:15c72014572117d4f3d3faab92cb5a3aede8f697059409d94ae6e9f8d10699f4_ppc64le as a component of Red Hat OpenShift AI 3.5	*
Red Hat	registry.redhat.io/rhoai/odh-training-operator-rhel9@sha256:7a81b46414f9951a38ba9f9741a739628604f5c9ba8764f7c03450d2b9a3f364_ppc64le as a component of Red Hat OpenShift AI 3.5	*
Red Hat	registry.redhat.io/rhoai/odh-ta-lmes-job-rhel9@sha256:2aeddd346e9429847ce54efb236ec50f11d1e817e08292d26cd8fd300b0d06b1_s390x as a component of Red Hat OpenShift AI 3.5	*
Red Hat	registry.redhat.io/rhoai/odh-fms-guardrails-orchestrator-rhel9@sha256:14676b485653b7f0bdfc8be62b7f3d112aa2f1817a3dc0eed1dd8a1586b45789_amd64 as a component of Red Hat OpenShift AI 3.5	*
Red Hat	registry.redhat.io/rhoai/odh-workbenches-operator-rhel9@sha256:5a5aedc6f9e8507448ede193329e50dd7aa299d9657ab49f11b0b94eb31d38b1_amd64 as a component of Red Hat OpenShift AI 3.5	*
Red Hat	registry.redhat.io/rhoai/odh-kserve-storage-initializer-rhel9@sha256:fcfa853b473bd6485e33eb212c8d0b033522391fbbb5e4fe44a4f233a494e533_arm64 as a component of Red Hat OpenShift AI 3.5	*
Red Hat	registry.redhat.io/rhoai/odh-ta-lmes-driver-rhel9@sha256:8aa848581512b552570ecb7e79483ebd729e6531ad61e6f9fc2bd4b68f547568_s390x as a component of Red Hat OpenShift AI 3.5	*
Red Hat	registry.redhat.io/rhoai/odh-ml-pipelines-api-server-v2-rhel9@sha256:f35d2e87e9c557ca2f474e61c8e18ffd18b35d3567f0977b83fc21847fe8f52c_arm64 as a component of Red Hat OpenShift AI 3.5	*
Red Hat	registry.redhat.io/rhoai/odh-kserve-localmodel-controller-rhel9@sha256:dac48f8125cb2a188ea2faed8e12a1f9591fe7e2f972cfac8cf0b50f53e16eb5_amd64 as a component of Red Hat OpenShift AI 3.5	*
Red Hat	registry.redhat.io/rhoai/odh-kserve-router-rhel9@sha256:d0803ce76ac0ac3a6e5a86f98c10b718af60396c9c2e50c1ec00b31d5f7e2880_ppc64le as a component of Red Hat OpenShift AI 3.5	*
Red Hat	registry.redhat.io/rhoai/odh-mod-arch-eval-hub-rhel9@sha256:2347078ef1febd9f4ed3a00685f017207f21b146993f773c387acd3fd6aca334_amd64 as a component of Red Hat OpenShift AI 3.5	*
Red Hat	registry.redhat.io/rhoai/odh-built-in-detector-rhel9@sha256:1b9cc7861bc46b4578f08eccaab0781282681f93203956903658b5c84418f52f_arm64 as a component of Red Hat OpenShift AI 3.5	*
Red Hat	registry.redhat.io/rhoai/odh-dashboard-rhel9@sha256:a2df39eb2e0aa929a7c53668eb954584a9bbd70c338cb659ca82805d7b67908d_ppc64le as a component of Red Hat OpenShift AI 3.5	*
Red Hat	registry.redhat.io/rhoai/odh-workbench-jupyter-minimal-cuda-py312-rhel9@sha256:5dd3b9b9932f593e0ac77747750d7b3ae25bd8bc4a9d339d86935f6bee554da3_arm64 as a component of Red Hat OpenShift AI 3.5	*
Red Hat	registry.redhat.io/rhoai/odh-kf-notebook-controller-rhel9@sha256:2a8e6f9d84dea3cc17b0d6f9a04d1f028e62089bbf8f5dda0cc7bd76173ee524_s390x as a component of Red Hat OpenShift AI 3.5	*
Red Hat	registry.redhat.io/rhoai/odh-ml-pipelines-scheduledworkflow-v2-rhel9@sha256:74592ac6071e837f12814b706f0c867e91d1462cfc2ab2bebd086000228b3da7_arm64 as a component of Red Hat OpenShift AI 3.5	*

…and 354 more

Timeline

Oct 21, 2026 CVE Published
Oct 31, 2026 CVE Updated
Oct 31, 2026 Distribution Patch
Oct 31, 2026 Distribution Patch
Oct 31, 2026 Security Advisory
Oct 31, 2026 Security Advisory
Oct 31, 2026 Security Advisory
Oct 31, 2026 Security Advisory
Oct 31, 2026 Security Advisory
Oct 31, 2026 Security Advisory
Oct 31, 2026 Security Advisory
Oct 31, 2026 Security Advisory

References

https://access.redhat.com/errata/RHSA-2026:86891 advisory
https://access.redhat.com/security/cve/CVE-2024-14029 advisory
https://access.redhat.com/security/cve/CVE-2026-102925 advisory
https://access.redhat.com/security/cve/CVE-2026-102930 advisory
https://access.redhat.com/security/cve/CVE-2026-102937 advisory
https://access.redhat.com/security/cve/CVE-2026-102938 advisory
https://access.redhat.com/security/cve/CVE-2026-102990 advisory
https://access.redhat.com/security/cve/CVE-2026-104851 advisory
https://access.redhat.com/security/cve/CVE-2026-104852 advisory
https://access.redhat.com/security/cve/CVE-2026-104861 advisory
https://access.redhat.com/security/cve/CVE-2026-104873 advisory
https://access.redhat.com/security/cve/CVE-2026-13697 advisory
https://access.redhat.com/security/cve/CVE-2026-15679 advisory
https://access.redhat.com/security/cve/CVE-2026-15789 advisory
https://access.redhat.com/security/cve/CVE-2026-18427 advisory
https://access.redhat.com/security/cve/CVE-2026-19534 advisory
https://access.redhat.com/security/cve/CVE-2026-37237 advisory
https://access.redhat.com/security/cve/CVE-2026-49825 advisory
https://access.redhat.com/security/cve/CVE-2026-49855 advisory
https://access.redhat.com/security/cve/CVE-2026-54284 advisory

…and 607 more

Open in Interactive Console →