RHSA-2026:86957HighCVSS 7.5

Red Hat Security Advisory: Red Hat Developer Hub 1.10.6 Plugin Catalog GA plugins release.

Published
October 21, 2026
Last Modified
October 21, 2026

🔗 CVE IDs covered (1)

CVE-2026-90711 →

📋 Description

CVE-2026-90711 — proxy-addr: proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet

🎯 Affected products8

  • Red Hat Developer Hub 1.10
  • registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:fd810ebe5995c4f8d211e145f40ff5f0c327506d598509a50a10a4b9728ca8df_amd64 as a component of Red Hat Developer Hub 1.10
  • registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:880fe5dc9874f8f12610e3b58fc7c8f288d5c5b04d4849c3465adb733ebe9444_amd64 as a component of Red Hat Developer Hub 1.10
  • registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:2bb6a1ac12de81b8b14c21a73ed1efcac20e386d9dd87db5a309905fbf221340_amd64 as a component of Red Hat Developer Hub 1.10
  • registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:1757e2d71a48707d556308d31e84f6fd3d4ae36021c9321c0634c9af7290cbd5_amd64 as a component of Red Hat Developer Hub 1.10
  • registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:bf3335d76864d1a2c069be1cad91d74183ff4ffc1846eca4073b06e09808928a_amd64 as a component of Red Hat Developer Hub 1.10
  • registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:c43d654e0194e7bf5b82e6026b6f16dec9cdc3a18852c2c34090cbdb82f447fc_amd64 as a component of Red Hat Developer Hub 1.10
  • registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:03739daac49291136955c7129296c7e4f5769c7be904a4a5c0286663d5a02cda_amd64 as a component of Red Hat Developer Hub 1.10

✅ Remediation

For more about Red Hat Developer Hub, see References links Workaround: To mitigate this flaw through configuration: 1. Configure trusted proxy definitions using standard IPv4 notation (such as `10.0.0.0/8`) rather than IPv4-mapped IPv6 notation. 2. If IPv4-mapped IPv6 notation is required, set the subnet prefix length to at least 97 to cover the mapped boundary (for example, specify `::ffff:10.0.0.0/104` instead of `::ffff:10.0.0.0/8`). 3. Alternatively, sanitize or strip incoming `X-Forwarded-For` headers at edge load balancers or boundary reverse proxies before passing traffic to backend applications. Warning: Modifying application configuration files requires restarting the Node.js application service, which will temporarily interrupt service availability and active connections.

🔗 References (11)