RHSA-2026:86675HighCVSS 10.0

Red Hat Security Advisory: Ansible plug-ins for Red Hat Developer Hub Product Release Update

Published
October 21, 2026
Last Modified
October 30, 2026

🔗 CVE IDs covered (10)

CVE-2026-93749 →CVE-2026-102282 →CVE-2026-102990 →CVE-2026-77037 →CVE-2026-82333 →CVE-2026-90711 →CVE-2026-106501 →CVE-2026-106503 →CVE-2026-77301 →CVE-2026-92955 →

📋 Description

CVE-2026-77037 — multer: Multer: Denial of Service via file descriptor leak on aborted uploads CVE-2026-77301 — adm-zip: adm-zip: Denial of Service via uncontrolled memory allocation CVE-2026-82333 — multer: Multer: Denial of Service via oversized array index in field names CVE-2026-90711 — proxy-addr: proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet CVE-2026-92955 — vm2: vm2 before 3.11.8 Sandbox Escape via NodeVM CVE-2026-93749 — source-map-js: source-map-js: Denial of Service via malformed indexed source maps CVE-2026-102282 — adm-zip: adm-zip: Privilege escalation via unfiltered permission bits in extracted archives CVE-2026-102990 — basic-ftp: basic-ftp: Denial of Service via crafted Unix directory listings CVE-2026-106501 — @backstage/plugin-scaffolder-backend: Backstage: Sensitive information exposure in Scaffolder CVE-2026-106503 — plugin-scaffolder-backend: plugin-scaffolder-backend: Authorization bypass via scaffolder action inputs

🎯 Affected products2

  • Red Hat Ansible Automation Platform 2.2
  • registry.redhat.io/ansible-automation-platform/automation-portal@sha256:17e885eb8a7c85fb67221a494bb3b5aba3d78c98029c90a1789d8b496240f9b7_amd64 as a component of Red Hat Ansible Automation Platform 2.2

✅ Remediation

For more about Ansible plugins for Red Hat Developer Hub, see References links Workaround: Upgrade to multer 2.3.0 or later, which properly closes the destination write stream on abnormal source termination and defers cleanup until the stream has closed. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Upgrade to multer 2.3.0 or later. For CVE-2026-82333, multer 2.3.0 adds an opt-in fieldArrayIndexLimit option that rejects oversized array indexes - set limits.fieldArrayIndexLimit to the largest array index your application needs. Workaround: To mitigate this flaw through configuration: 1. Configure trusted proxy definitions using standard IPv4 notation (such as `10.0.0.0/8`) rather than IPv4-mapped IPv6 notation. 2. If IPv4-mapped IPv6 notation is required, set the subnet prefix length to at least 97 to cover the mapped boundary (for example, specify `::ffff:10.0.0.0/104` instead of `::ffff:10.0.0.0/8`). 3. Alternatively, sanitize or strip incoming `X-Forwarded-For` headers at edge load balancers or boundary reverse proxies before passing traffic to backend applications. Warning: Modifying application configuration files requires restarting the Node.js application service, which will temporarily interrupt service availability and active connections. Workaround: When extracting archives from untrusted sources with adm-zip, do not enable the keepOriginalPermission option in extractAllTo()/extractEntryTo(); the vulnerable permission-preservation behavior is only invoked when this option is enabled. The upstream project has released a version that filters the setuid/setgid bits from extracted permission metadata, so updating adm-zip to a version that includes this fix, when made available through Red Hat product channels, resolves the issue. Workaround: To reduce the risk associated with this flaw: 1. Restrict template access: Limit permissions to execute Scaffolder templates to trusted users by configuring role-based access control (RBAC) policies in Red Hat Developer Hub or Ansible Automation Platform. 2. Enforce least privilege on integration credentials: Audit and restrict source control provider tokens (such as GitHub, GitLab, or Bitbucket credentials) to the minimum necessary repository scopes and permissions required for legitimate template actions. Caveats: Limiting integration credential permissions may cause templates that require administrative or elevated privileges to fail. Modifying credential secrets or configuration files within the deployment environment will require restarting the application pods for the new settings to take effect.

🔗 References (14)