Moderate Security Update for Resource Agents: Addressing Information Disclosure Vulnerability
Summary
ALSA-2026:47126: Moderate: resource-agents security update. Affects resource-agents versions < 4.9.0-54.el8_10.36.alma.1. Fixed in 4.9.0-54.el8_10.36.alma.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The resource-agents package is essential for managing high-availability (HA) environments, providing scripts that interface with various services through Pacemaker and RGManager service managers. This package is critical for ensuring that services remain operational and accessible, even in the event of failures. However, it has been found to contain a vulnerability that could lead to information disclosure.
Vulnerability Detail
The vulnerability identified as CVE-2026-44431 in the urllib3 library allows for information disclosure via cross-origin redirects that can inadvertently forward sensitive headers. This could potentially expose sensitive information to unauthorized parties, leading to security breaches and data leaks. The issue arises from improper handling of redirects, which can be exploited by attackers to gain access to confidential data.
How To Fix
Minimum fixed version
4.9.0-54.el8_10.36.alma.1
This is the first release that contains the fix.
sudo dnf update resource-agentsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit the exposure of sensitive headers by configuring their applications to avoid cross-origin redirects or by implementing stricter CORS policies. However, this is not a permanent fix and updating the package is strongly recommended.
Conclusion
The resource-agents package has a moderate security vulnerability that requires immediate attention. By updating to the latest patched version, users can protect their systems from potential information disclosure risks. It is essential to stay informed about vulnerabilities and utilize tools like Vulert for ongoing monitoring.
See every vulnerability recorded for resource-agents →
FAQ
CVE-2026-44431 is a vulnerability in the urllib3 library that allows for information disclosure through cross-origin redirects.
This vulnerability can lead to unauthorized access to sensitive information, potentially compromising the security of your system.
If immediate updates are not possible, consider implementing stricter CORS policies and limiting the exposure of sensitive headers as a temporary workaround.
More details can be found on the CVE page associated with CVE-2026-44431, which provides insights into the impact and technical aspects of the vulnerability.
Vulert allows you to monitor and alert in real-time for open-source vulnerabilities using just a manifest file like package-lock.json. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
Related vulnerabilities
Recent vulnerabilities recorded for resource-agents.
