CVE-2026-42010

Assessment

Why it matters

EPSS is 1.1%; technical severity is CVSS 9.8.

A flaw was found in gnutls. Servers configured with RSA-PSK (Rivest–Shamir–Adleman – Pre-Shared Key) wrongfully matched usernames containing a NUL character with truncated usernames. A remote attacker could exploit this by sending a specially crafted username, leading to an authentication bypass. This vulnerability allows an attacker to gain unauthorized access by circumventing the authentication process.

Who should care

• Teams operating Gnutls, Enterprise Linux, Hardened Images +1 more
• Vulnerability and exposure management teams
• Security operations teams monitoring exploitation activity

Response plan

What I would do

1. Confirm whether Gnutls, Enterprise Linux, Hardened Images +1 more is present in the environment.
2. Identify affected versions and establish whether vulnerable services are exposed or reachable.
3. Red Hat Security advisory CVE-2026-42010
4. Review relevant security telemetry for evidence of attempted or successful exploitation.
5. Document the remediation decision and track it to verified completion.

Technical details

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-170

Affected versions

GNU Gnutls (Version -); Redhat Enterprise Linux (Version 6.0 | Version 7.0 | Version 8.0 | Version 9.0); Redhat Hardened Images (Version -); Redhat Openshift Container Platform (Version 4.0)

Fixed versions

No explicit fixed version is currently recorded.

Published

7 May 2026

Attack vector

Network

Privileges required

None

User interaction

None

Signal timeline

1. 7 May 2026CVE published
2. 20 Aug 2026Latest EPSS score: 1.1%
3. 19 Aug 2026 · 13:52 UTCSignal calculated at 15

External references

• Gnutls Technical reference Security New ↗