Loading story…
Red Hat released multiple Important security advisories for rhc-worker-playbook on Red Hat Enterprise Linux 10, updating the yggdrasil worker that receives Ansible playbooks and executes them on the local host. The fixes were issued across RHEL 10.0, 10.1, and 10.2 channels and covered several architectures, including x86_64, aarch64, ppc64le, and s390x. Early updates shipped rhc-worker-playbook version 0.2.3-4 for RHEL 10.0 and 10.1 to remediate CVE-2026-27137 in Go's crypto/x509, involving incorrect email constraint enforcement, and CVE-2026-25679 in Go's net/url, involving incorrect parsing of IPv6 host literals.
A subsequent advisory updated rhc-worker-playbook to version 0.2.3-5.el10_1 to fix CVE-2026-32282, where Go's Root.Chmod could follow symlinks outside the intended root, and CVE-2026-32283, a denial-of-service condition in Go crypto/tls triggered by repeated TLS 1.3 key update messages. Red Hat later rolled these fixes into rhc-worker-playbook-0.2.7-3.el10_2 for RHEL 10.2 and also addressed CVE-2025-61726, a memory exhaustion issue, consolidating five Go-component vulnerabilities in the latest package set.
See real exploitation activity before you spend the cycle.
6 events from the most recent confirmed update back to the earliest known activity.
On 2026-05-19, Red Hat published Important advisory RHSA-2026:19132 for rhc-worker-playbook on Red Hat Enterprise Linux 10. The update to version 0.2.7-3.el10_2 fixes five vulnerabilities: CVE-2025-61726, CVE-2026-27137, CVE-2026-25679, CVE-2026-32282, and CVE-2026-32283.
On 2026-04-29, Red Hat published Important advisory RHSA-2026:11863 for rhc-worker-playbook on Red Hat Enterprise Linux 10. The update to version 0.2.3-5.el10_1 addresses CVE-2026-32282 and CVE-2026-32283.
On 2026-04-27, Red Hat published Important advisory RHSA-2026:10929 for rhc-worker-playbook on Red Hat Enterprise Linux 10.0 support channels. The update to version 0.2.3-4.el10_0 fixes the same two vulnerabilities, CVE-2026-27137 and CVE-2026-25679, for multiple architectures.
On 2026-04-23, Red Hat published Important advisory RHSA-2026:10169 for rhc-worker-playbook on Red Hat Enterprise Linux 10. The update to version 0.2.3-4.el10_1 fixes CVE-2026-27137 and CVE-2026-25679.
On 2026-03-09, Red Hat published Important advisory RHSA-2026:3971 for rhc-worker-playbook on Red Hat Enterprise Linux 10. The update to version 0.2.3-3.el10_1 fixes CVE-2025-61729, CVE-2025-61726, and CVE-2025-68121 across multiple architectures and support channels.
On 2026-03-09, Red Hat published Important advisory RHSA-2026:3970 for rhc-worker-playbook on Red Hat Enterprise Linux 10.0 support channels. The update to version 0.2.3-3.el10_0 fixes CVE-2025-61729, CVE-2025-61726, and CVE-2025-68121 across multiple architectures.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
6 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released a broad set of **Important** security advisories for `rhc`, `image-builder`, and `delve` across Red Hat Enterprise Linux 7, 8, 9, and 10 channels to fix Go-related vulnerabilities tracked as `CVE-2025-61729`, `CVE-2025-61726`, and, in many newer builds, `CVE-2025-68121`. The affected software includes `rhc`, which connects systems to Red Hat hosted management services, `image-builder`, which creates customized OS artifacts, and `delve`, the Go debugger. Updated packages were issued for multiple architectures including `x86_64`, `aarch64`, `ppc64le`, and `s390x`, spanning standard releases as well as Extended Update Support, SAP, Telecommunications, AUS, AMQCS, and Extended Life Cycle channels. The most prominent flaw, `CVE-2025-61729`, is rated **Important** by Red Hat with a CVSS 7.5 score and affects Go's `crypto/x509` handling through unbounded string concatenation in `HostnameError.Error()`, allowing a crafted certificate to trigger excessive resource consumption and denial of service; Red Hat maps it to **CWE-1050**. The related fixes also address `CVE-2025-61726`, a memory exhaustion issue in Go `net/url` query parsing, and `CVE-2025-68121`, which can cause unexpected TLS session resumption or incorrect certificate validation during session resumption. Red Hat said the vulnerabilities were remediated through package updates such as `rhc` 0.2.x/0.3.x, `image-builder` 31-3/31-4, and `delve` 1.25.2 and 1.26.1 builds across affected RHEL product lines.
Aug 20, 2026
Red Hat released multiple **Important** security advisories to patch Go-related vulnerabilities across several Red Hat Enterprise Linux products, including `gvisor-tap-vsock`, `git-lfs`, `rhc`, HawtIO in the Red Hat build of Apache Camel, and the `container-tools:rhel8` module. The updates primarily address **CVE-2025-61729**, a denial-of-service flaw in Go's `crypto/x509` package that can be triggered by a crafted certificate during hostname verification, and **CVE-2025-61726**, a memory exhaustion issue in Go `net/url` query parsing. Some advisories also include fixes for **CVE-2026-25679** in `net/url`, **CVE-2024-24785** in `html/template`, and **CVE-2025-65637** in `logrus`. The underlying Go flaw tracked as **GO-2025-4155** affects `HostnameError.Error()` in `crypto/x509`, where unbounded hostname printing and repeated string concatenation can cause quadratic runtime and excessive resource consumption. Go maintainers fixed the issue in **Go 1.24.11** and **Go 1.25.5** by limiting printed hosts and replacing repeated concatenation with `strings.Builder`, and Red Hat has now shipped corresponding package updates across affected RHEL 8 and RHEL 9 channels and architectures, including updated builds such as `gvisor-tap-vsock 0.7.3-5.el9_4.3`, `git-lfs 2.13.3-3.el8_4.4`, and `rhc 0.2.1-12.el9_0`.
Aug 20, 2026
Red Hat released a broad set of **Important** security updates for Go and Go-based packages across **RHEL 8, 9, and 10**, fixing multiple vulnerabilities that include build-time arbitrary code execution, denial of service, memory corruption, certificate validation failures, and a symlink-following flaw. Core `golang` and `go-toolset:rhel8` updates moved affected platforms to fixed Go builds such as **1.25.9** variants, addressing CVEs including `CVE-2026-27140`, `CVE-2026-27143`, `CVE-2026-27144`, `CVE-2026-32280`, `CVE-2026-32282`, and `CVE-2026-32283`. Red Hat said `CVE-2026-27140` could allow **arbitrary code execution during builds** through malicious SWIG filenames containing `cgo`, a flaw it scored **CVSS 9.0**. The fixes also cascaded into Red Hat packages that embed or depend on Go components, including **osbuild-composer**, **go-fdo-client**, **go-fdo-server**, **yggdrasil**, **delve**, **gvisor-tap-vsock**, and **golang-github-openprinting-ipp-usb**. Several advisories specifically remediated Go `crypto/x509` and `crypto/tls` issues tied to certificate chain validation and building (`CVE-2026-32280`, `CVE-2026-32281`, `CVE-2026-32283`), `net/url` parsing flaws such as `CVE-2026-25679`, and the `internal/syscall/unix` `Root.Chmod` symlink issue (`CVE-2026-32282`). Updated packages were published across standard, Extended Update Support, Advanced Update Support, SAP, and Extended Life Cycle channels for x86_64, aarch64, ppc64le, and s390x systems.
Aug 20, 2026