Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.7
Red Hat Grype packages may accept altered container images
published 1 month ago
Summary
The Grype tool provided in Red Hat's hardened images can be tricked into trusting malicious container images, potentially exposing systems to hidden threats. This issue affects any environment that uses Grype for scanning container contents. Update to the latest Grype packages from Red Hat as soon as possible to ensure proper validation of image data.
What to do
- Update redhat grype to version 0:0.118.0-0.2.hum1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Red Hat:hummingbird:1 | redhat | grype |
< 0:0.118.0-0.2.hum1 Fix: upgrade to 0:0.118.0-0.2.hum1
|
Original advisory text
Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
References
- https://access.redhat.com/errata/RHSA-2026:68255 Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2026-88922 Third Party Advisory
- https://access.redhat.com/security/updates/classification/ Third Party Advisory
- https://images.redhat.com/ Third Party Advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_68255.... Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2534192 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-88922 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-88922 Vendor Advisory
- https://discuss.hashicorp.com/t/hcsec-2026-39-go-getter-vulnerable-to-a-privileg... Third Party Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Timeline
Published22 Sep 2026
Updated23 Sep 2026
First seen23 Sep 2026
Sources
RHSA-2026:68255 · OSV
Track software like this
Free during beta