Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

Red Hat osbuild-composer may let attackers run code

published 2 months ago

Summary

The osbuild-composer tool used by Red Hat systems can be exploited to execute unauthorized code, potentially compromising the host. Updating to the latest patched version removes this risk. Apply the Red Hat security update as soon as possible to keep your systems safe.

What to do

Update redhat osbuild-composer to version 0:76.1-7.el9_2.
Update redhat osbuild-composer-core to version 0:76.1-7.el9_2.
Update redhat osbuild-composer-core-debuginfo to version 0:76.1-7.el9_2.
Update redhat osbuild-composer-debuginfo to version 0:76.1-7.el9_2.
Update redhat osbuild-composer-debugsource to version 0:76.1-7.el9_2.
Update redhat osbuild-composer-dnf-json to version 0:76.1-7.el9_2.
Update redhat osbuild-composer-tests-debuginfo to version 0:76.1-7.el9_2.
Update redhat osbuild-composer-worker to version 0:76.1-7.el9_2.
Update redhat osbuild-composer-worker-debuginfo to version 0:76.1-7.el9_2.

Affected software

Ecosystem	Vendor	Product	Affected versions
Red Hat:rhel_e4s:9.2::appstream	redhat	osbuild-composer	< 0:76.1-7.el9_2 Fix: upgrade to 0:76.1-7.el9_2
Red Hat:rhel_e4s:9.2::appstream	redhat	osbuild-composer-core	< 0:76.1-7.el9_2 Fix: upgrade to 0:76.1-7.el9_2
Red Hat:rhel_e4s:9.2::appstream	redhat	osbuild-composer-core-debuginfo	< 0:76.1-7.el9_2 Fix: upgrade to 0:76.1-7.el9_2
Red Hat:rhel_e4s:9.2::appstream	redhat	osbuild-composer-debuginfo	< 0:76.1-7.el9_2 Fix: upgrade to 0:76.1-7.el9_2
Red Hat:rhel_e4s:9.2::appstream	redhat	osbuild-composer-debugsource	< 0:76.1-7.el9_2 Fix: upgrade to 0:76.1-7.el9_2
Red Hat:rhel_e4s:9.2::appstream	redhat	osbuild-composer-dnf-json	< 0:76.1-7.el9_2 Fix: upgrade to 0:76.1-7.el9_2
Red Hat:rhel_e4s:9.2::appstream	redhat	osbuild-composer-tests-debuginfo	< 0:76.1-7.el9_2 Fix: upgrade to 0:76.1-7.el9_2
Red Hat:rhel_e4s:9.2::appstream	redhat	osbuild-composer-worker	< 0:76.1-7.el9_2 Fix: upgrade to 0:76.1-7.el9_2
Red Hat:rhel_e4s:9.2::appstream	redhat	osbuild-composer-worker-debuginfo	< 0:76.1-7.el9_2 Fix: upgrade to 0:76.1-7.el9_2

Original advisory text

Red Hat Security Advisory: osbuild-composer security update

References

https://access.redhat.com/errata/RHSA-2026:61245 Vendor Advisory
https://access.redhat.com/security/updates/classification/#important Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2449833 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2480756 Third Party Advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_61245.... Vendor Advisory
https://access.redhat.com/security/cve/CVE-2026-33186 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-33186 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-33186 Vendor Advisory
https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3 Third Party Advisory
https://access.redhat.com/security/cve/CVE-2026-39821 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-39821 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-39821 Vendor Advisory
https://go.dev/cl/767220 Third Party Advisory
https://go.dev/issue/78760 Third Party Advisory
https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8 Third Party Advisory
https://pkg.go.dev/vuln/GO-2026-5026 Vendor Advisory

Fix within

Internet-facing 3 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker full control (estimated)

Severity

9.1 Critical

Timeline

Published31 Aug 2026

Updated3 Sep 2026

First seen3 Sep 2026

Sources

RHSA-2026:61245 · OSV

Track software like this

Free during beta