CVE-2026-42010 is an authentication bypass in GnuTLS, scored CVSS 7.1 (high) in the record. Servers set up for RSA-PSK matched a username containing a NUL character to a truncated username. The setup is uncommon. Install your vendor's gnutls update and check the GnuTLS advisory.
What's affected
The record names GnuTLS and lists Red Hat Enterprise Linux, Red Hat Hardened Images and OpenShift Container Platform as affected products. It gives no upstream version range. Red Hat lists errata for its products, and the upstream notice is GNUTLS-SA-2026-04-29-4 on gnutls.org.
Only servers explicitly configured for RSA-PSK (RSA with a pre-shared key) are affected. Red Hat says that setup is uncommon and not enabled by default, and that certificate based deployments are not affected.
How to check if you're exposed
- Find the installed package version.
rpm -q gnutls
dpkg -l | grep -i gnutls
- Compare it with your vendor's errata. Red Hat references RHSA-2026:13274 and several later errata in the record.
- Search the configuration of services that use GnuTLS for RSA-PSK in their priority or cipher settings.
grep -rIn "RSA-PSK" /etc 2>/dev/null
If nothing enables RSA-PSK, this flaw is not reachable on that server.
What to do now
- Update gnutls through your distribution or vendor channel.
- Restart services that load the library, or reboot, so the new code is used.
- If you cannot update yet and do not need RSA-PSK, remove it from the server's allowed key exchanges.
- Check container images, which may carry their own copy of gnutls.
Why it matters
The weaknesses are CWE-170, improper null termination, and CWE-626, a null byte interaction error. The username is handled as a string with a length, but a later comparison treats the NUL as the end, so two different names can look the same. An attacker who sends a crafted username can be matched to an account whose name is the shorter text.
Red Hat rates it Important and notes the NVD scored it at 9.8 while its own score is 7.1. The KEV flag is false, and I found no report of exploitation in the wild.
Quick check
Do certificate based TLS servers need action?
Red Hat says deployments using standard certificate based authentication are unaffected. Still install the update as part of normal patching.
Sources
Last reviewed: 19 October 2026.
