Red Hat osbuild-composer Update Addresses Five RHEL 9 Flaws
Tech GuruQuick Answer
RHSA-2026:69293 updates the RHEL 9 image-building service osbuild-composer and its core and worker packages to 165.1-5.el9_8. Keep these components on the supported package set for the installed RHEL stream.
Confirm Scope And Apply The Supported Fix
What to do now: Identify composer servers and workers, schedule the package update around queued builds, and check the service and dependent build clients after the change.
Source check: 2026-10-02 UTC. This notice reflects the primary-source evidence described below, not a completed update or exploitation test. Recheck the advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | RHEL 9 osbuild-composer, osbuild-composer-core, and worker packages |
|---|---|
| Advisory | RHSA-2026:69293 |
| CVEs | CVE-2026-25681, CVE-2026-27136, CVE-2026-41178, CVE-2026-42502, CVE-2026-55677 |
| Authoritative release date | RHSA-2026:69293: 2026-09-21T18:18:10+00:00 (CSAF initial release) |
| Authority revision date | RHSA-2026:69293: 2026-09-21T18:18:10+00:00 (CSAF revision history). CSAF generation timestamps are not advisory revision dates. |
| Affected versions | The osbuild-composer package family in the RHEL 9 repositories covered by RHSA-2026:69293 before 165.1-5.el9_8. |
| Fixed version | osbuild-composer, osbuild-composer-core, and osbuild-composer-worker 165.1-5.el9_8 |
| CVSS base score | 6.1 / 7.5 / 8.1 (CVSS v3.1) |
| CVSS severity | Medium to High |
| Exploitation status | RHSA-2026:69293 does not state that these flaws are being exploited. That is not confirmation that exploitation has not occurred. |
What Changed
The five CVEs concern bundled dependencies: Go HTML-template cross-site scripting, resource exhaustion from oversized OpenTelemetry baggage, and information disclosure through Echo URL decoding. They do not all describe the same attack path or imply that a previously built operating-system image contains this service.
What To Validate Now
- Inventory. Record composer servers, worker hosts, installed package releases, build clients, queued jobs and target export destinations.
- Establish applicability. Match each composer/core/worker installation to the advisory's RHEL repository and architecture; a machine merely consuming a built image is not automatically an osbuild-composer installation.
- Remediate. Apply osbuild-composer, osbuild-composer-core, and osbuild-composer-worker 165.1-5.el9_8 through the supported vendor or project channel, following the current advisory and change-control requirements.
- Validate. Verify composer/core/worker RPM versions and service health, then run an approved representative image build and its normal export or cloud-upload step. Check worker job results and preserve the build and rollback records.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Use the exact supported release stream and repository. Test dependencies, clusters, integrations, and rollback before broad deployment; a CVSS rating or reachable feature is not evidence of exploitation.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
