CoreOS Security Update (MINDBREEZE43608)

ID: MINDBREEZE43608 
Affected Components: Mindbreeze InSpire, Mindbreeze InSpire SaaS 
Severity: Critical 
Status: Final 
First published: October 12, 2026 
CVEs: CVE-2026-50195,CVE-2026-53492,CVE-2026-53489,CVE-2026-47262,CVE-2026-54369,CVE-2026-54370,CVE-2026-54371,CVE-2026-44517,CVE-2026-33630,CVE-2026-60002,CVE-2026-59996,GHSA-4q85-33p6-j5g6,GHSA-46fr-jh49-xvhx,GHSA-2hqh-5c36-grrm,CVE-2026-39828,CVE-2026-39829,CVE-2026-39830,CVE-2026-13757,CVE-2026-54411,CVE-2026-55654,CVE-2026-55655,CVE-2026-55653,CVE-2026-27145,FEDORA-2026-230ba36543,CVE-2026-44604,CVE-2026-44605,CVE-2026-52791,FEDORA-2026-864f36550e,CVE-2026-56391,CVE-2026-18938,CVE-2026-68480,FEDORA-2026-d232156d86,FEDORA-2026-c53019ed4f,CVE-2026-64564,CVE-2026-64561 

Summary 

  • acl: Symlink traversal privilege escalation via libacl functions 
  • acl: TOCTOU Symlink Traversal via getfacl/setfacl 
  • attr: Symlink Traversal Privilege Escalation via getfattr and setfattr 
  • buildah: Build breakout using malicious Containerfile and Git Smart HTTP server or GitHub release tar archive 
  • c-ares: Use-after-free / double-free in query-completion handling 
  • containerd: Arbitrary host CRI log file read via symlink following in CRI checkpoint restore 
  • containerd: CRI checkpoint import allows local image tag poisoning 
  • containerd CRI checkpoint restore CDI annotation smuggling 
  • containerd image-triggered runtime DoS via unbounded group parsing 
  • coreutils uniq: Denial of Service and information disclosure via out-of-bounds read with multibyte input
  • fuse-overlayfs: Privilege Escalation Vulnerability via SUID/SGID Bit Preservation
  • golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN
  • kernel: AMD-SN-7061: Safe RET Interrupt Vulnerability
  • kernel: KVM: x86: Check for invalid/obsolete root *after* making MMU pages available
  • kernel: sctp: don't free the ASCONF's own transport in DEL-IP processing
  • linux-pam: Plaintext password recovery via timing discrepancy in pam_userdb module326099
  • moby-engine: golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters
  • moby-engine: golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses
  • moby-engine: golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions
  • openssh: Double free in Red Hat Enterprise Linux versions of OpenSSH DH-GEX client path during FIPS known-group validation leads to client-side denial of service
  • openssh: Heap out-of-bounds read in Red Hat Enterprise Linux versions of OpenSSH GSSAPI indicator cleanup due to missing NULL sentinel termination
  • openssh: Local MITM of X11 forwarding via abstract UNIX socket pre-binding in Red Hat Enterprise Linux OpenSSH client versions
  • OpenSSH: scp may place a file in the parent directory of an intended directory when the copy occurs between two remote destinations
  • OpenSSH: Use-after-free vulnerability during host key re-exchange on the client side
  • p11-kit: Integer overflow in RPC attribute-array length calculation
  • p11-kit: Stack exhaustion via unbounded recursion in RPC attribute parsing
  • rpm: Command injection in rpmuncompress doUntar() via unescaped archive top-level directory name in popen() shell command
  • rpm: heap buffer overflow in NDB slot table parsing
  • seccomp: incorrect 64-bit comparison merge can weaken libseccomp filter
  • seccomp: oversized libseccomp filters can trigger a double free
  • seccomp: oversized libseccomp filters can trigger a heap corruption 

 

Hotfix Information 

Fixed with following versions of Mindbreeze InSpire On-Premises or Mindbreeze InSpire SaaS: 

  • Mindbreeze InSpire 26.6 Release
  • Mindbreeze InSpire SaaS 26.6 Release