Linux · 
Red Hat · Security advisory · August 21, 2026
Red Hat · Security advisory · August 21, 2026RHSA-2026:57590: rh-podman-desktop security update
RHSA-2026:57590, released August 21, 2026, fixes 24 CVEs in rh-podman-desktop (version 1.1.2-1.el10_2). None of them is reported as exploited. Patch Radar priority: Urgent.
Urgent
CVEs closed
24
1 rated Critical
Exploited
0
None reported
Highest CVSS
9.1
Base score, 0 to 10
Highest EPSS
0.0143
73rd percentile
Priority of the 24 CVEs
Patch now 0
Urgent 1
High 22
Routine 1
Fixed package versions
| Product | Release | Fixed in |
|---|---|---|
| rh-podman-desktop | RHEL 10 | 1.1.2-1.el10_2 |
CVEs this fix closes
| Priority | CVE | Title | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|
| Urgent | CVE-2026-45623 | node-postcss: PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstra... | 9.1 | 0.0061 | None reported |
| High | CVE-2026-48779 | rh-podman-desktop: ws is an open source WebSocket client and server for Node.js | 7.5 | 0.0143 | None reported |
| High | CVE-2026-48068 | rh-podman-desktop: @grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon | 7.5 | 0.0088 | None reported |
| High | CVE-2026-45736 | ws: Uninitialized memory disclosure | 7.5 | 0.0075 | None reported |
| High | CVE-2026-13676 | node-ajv: fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs | 7.5 | 0.0069 | None reported |
| High | CVE-2026-12143 | form-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection) | 7.5 | 0.0067 | None reported |
| High | CVE-2026-34986 | osbuild-composer: A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood | 9.1 | 0.0066 | None reported |
| High | CVE-2026-69152 | nodejs-nodemon: The brace-expansion library generates arbitrary strings containing a common prefix and suffix | 8.6 | 0.0065 | None reported |
| High | CVE-2026-14257 | nodejs22: brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion | 8.6 | 0.0064 | None reported |
| High | CVE-2026-59869 | rh-podman-desktop: js-yaml is a JavaScript YAML parser and dumper | 7.5 | 0.0059 | None reported |
| High | CVE-2026-59873 | nodejs: Node.js is a software development platform for building fast and scalable network applications in the JavaScript prog... | 7.5 | 0.0058 | None reported |
| High | CVE-2026-56876 | rh-podman-desktop: extract-zip does not validate symlink targets when extracting zip archives | 8.1 | 0.0053 | None reported |
| High | CVE-2026-42338 | rh-podman-desktop: ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript | 8.1 | 0.0047 | None reported |
| High | CVE-2026-69192 | node-ip-address: ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript | 8.6 | 0.0047 | None reported |
| High | CVE-2026-44705 | tmp: Path Traversal via unsanitized prefix/postfix enables directory escape | 8.2 | 0.0043 | None reported |
| High | CVE-2026-59874 | nodejs: Node.js is a software development platform for building fast and scalable network applications in the JavaScript prog... | 7.5 | 0.0043 | None reported |
| High | CVE-2026-49978 | node-dompurify: DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG | 8.1 | 0.0040 | None reported |
| High | CVE-2026-42570 | rh-podman-desktop: Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for t... | 7.5 | 0.0040 | None reported |
| High | CVE-2026-48801 | rh-podman-desktop: linkify-it is a links recognition library with full Unicode support | 7.5 | 0.0039 | None reported |
| High | CVE-2026-59877 | rh-podman-desktop: protobufjs compiles protobuf definitions into JavaScript (JS) functions | 7.5 | 0.0037 | None reported |
| High | CVE-2026-13149 | nodejs: Node.js is a software development platform for building fast and scalable network applications in the JavaScript prog... | 7.5 | 0.0036 | None reported |
| High | CVE-2026-45740 | rh-podman-desktop: protobufjs compiles protobuf definitions into JavaScript (JS) functions | 7.5 | 0.0026 | None reported |
| High | CVE-2026-9595 | rh-podman-desktop: Impact: When a user-configured proxy on webpack-dev-server has a broad context (e.g | 7.1 | 0.0016 | None reported |
| Routine | CVE-2026-69153 | node-postcss: PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstra... | 5.3 | 0.0045 | None reported |
Showing 1 to 24 of 24
1
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.