live wire
▸PLATFORM · Clang 23 bytecode interpreter cuts allocations and expands constant-expression supportRed Hat Developer▸PLATFORM · RHEL becomes first-party on OCI; OpenShift subscriptions reach Oracle MarketplaceRed Hat▸AI · vLLM-Omni merges native MOSS-Image serving with parallelism and offloadvLLM▸AI · vLLM adds System One endpoint for Decision 3.0 multimodal routing models (Oct. 15)vLLM▸SECURITY · Red Hat rates OpenShift AI 3.4.5 update Critical; advisory lists hundreds of CVEsRed Hat Product Security▸SECURITY · Red Hat’s first Security Signals report shifts focus from CVE counts to risk paths (Oct. 15)Red Hat▸PLATFORM · IBM adds non-destructive FlexVolume-to-CSI migration tool for OpenShift object storageIBM Cloud▸vLLM tests agent-built Kimi K3 decode path at up to 1.9× speedup; PR remains openvLLM▸AI · LeaderWorkerSet 1.0 changes rollout defaults for disaggregated AI workloadsKubernetes SIGs▸SECURITY · Red Hat flags active exploitation of kernel flaw affecting OpenShift CoreOS; no fix listedRed Hat Product Security▸AI · Red Hat sets Dec. 9 showcase for AI 3.6 agent governance and model servicesRed Hat▸vLLM 0.32.0 drops Python 3.10, restricts CORS defaults and adds security fixesvLLM▸SECURITY · Red Hat tracks Moderate Hono auth bypass across OpenShift AI, Dev Spaces and AnsibleRed Hat Product Security▸SECURITY · Red Hat Hardened Images fixes Moderate libpng denial-of-service flawRed Hat▸PLATFORM · Clang 23 bytecode interpreter cuts allocations and expands constant-expression supportRed Hat Developer▸PLATFORM · RHEL becomes first-party on OCI; OpenShift subscriptions reach Oracle MarketplaceRed Hat▸AI · vLLM-Omni merges native MOSS-Image serving with parallelism and offloadvLLM▸AI · vLLM adds System One endpoint for Decision 3.0 multimodal routing models (Oct. 15)vLLM▸SECURITY · Red Hat rates OpenShift AI 3.4.5 update Critical; advisory lists hundreds of CVEsRed Hat Product Security▸SECURITY · Red Hat’s first Security Signals report shifts focus from CVE counts to risk paths (Oct. 15)Red Hat▸PLATFORM · IBM adds non-destructive FlexVolume-to-CSI migration tool for OpenShift object storageIBM Cloud▸vLLM tests agent-built Kimi K3 decode path at up to 1.9× speedup; PR remains openvLLM▸AI · LeaderWorkerSet 1.0 changes rollout defaults for disaggregated AI workloadsKubernetes SIGs▸SECURITY · Red Hat flags active exploitation of kernel flaw affecting OpenShift CoreOS; no fix listedRed Hat Product Security▸AI · Red Hat sets Dec. 9 showcase for AI 3.6 agent governance and model servicesRed Hat▸vLLM 0.32.0 drops Python 3.10, restricts CORS defaults and adds security fixesvLLM▸SECURITY · Red Hat tracks Moderate Hono auth bypass across OpenShift AI, Dev Spaces and AnsibleRed Hat Product Security▸SECURITY · Red Hat Hardened Images fixes Moderate libpng denial-of-service flawRed Hat
upstreambeat.ai
releaseIDENTITY

Critical Red Hat IdM update closes credential exposure and privilege-escalation paths

RHSA-2026:70564 updates RHEL 9’s IPA packages for eight FreeIPA vulnerabilities, including an unauthenticated route to administrator credentials.

Critical Red Hat IdM update fixing eight FreeIPA flaws
AI-generated illustration
By The Release Desk· Sep 24, 2026the quick take — two AI hosts go live when you do

Red Hat has issued a Critical security update for the IPA packages that provide Red Hat Identity Management on Red Hat Enterprise Linux 9. RHSA-2026:70564 addresses eight FreeIPA vulnerabilities; Red Hat’s affected-products list includes RHEL 9 and RHEL 9.8 Extended Update Support across x86_64, Arm, IBM Power and IBM Z.

What changed

The advisory’s highest-consequence entries include an unauthenticated LDAP path that can expose administrator credentials, a Kerberos trust flaw that can obtain a ticket-granting service ticket with an impersonated client name, and two separate privilege-escalation or unauthorized-write paths. It also fixes two unauthenticated denial-of-service issues, a crafted-URL cross-site scripting flaw, and an authorization-order issue that can expose environment data or cause denial of service.

The fixed IPA build is 4.13.4-1.el9_8 for the RHEL 9.8 channels listed by Red Hat. The advisory also includes Web UI, token-import and migration hardening changes.

Who is affected

Administrators running Red Hat Identity Management on the affected RHEL 9 channels should treat this as a priority patch. The advisory covers IdM server and client packages, with several issues affecting trust relationships, LDAP authorization controls, migration endpoints or administrative credentials.

What to do

Apply the updated IPA packages through the normal RHEL update process and follow Red Hat’s remediation guidance in the advisory. Because the update changes authentication and identity-management components, operators should use their established change window and validate IdM authentication, Kerberos trust, replication and Web UI access after the update.

sources

Filed by The Release Desk. Corrections: desk@upstreambeat.ai · Our standards →

comments · 0

    Comments are moderated before they appear. Your email is used once to confirm it is you — never shown, never sold. Corrections and questions get an answer from the desk when we have one.

    more from the desk