{"id":"INC-redhat-ytb6wht11437","kind":"incident","aliases":[],"related":[],"title":"Red Hat: Red Hat Connect Major Outage - Investigating","description":"Executive Summary\nA certificate update by the backend team triggered automated system alerts this morning. The Partner Certification Team investigated the alerts and identified the undocumented certificate rotation as the root cause of the incident.\n\n\nDetection & Investigation:\nThe Partner Certification Team detected the issue via automated alerts. The team immediately initiated debugging procedures and successfully isolated the certificate update as the underlying cause.\n\nRecommended Action Items:\n\nImplement a mandatory communication protocol and sign-off process between the platform team and the Partner Certification Team for all future certificate rotations.\n\nReview monitoring systems to ensure certificate mismatches trigger immediate alerts during deployment windows, rather than the following morning.","summary":"Red Hat Connect, the partner certification portal, went down after a backend team rotated a certificate without notice. The incident is an availability outage, and the sources describe no attacker access or data exposure.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Red Hat","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["incident","partner-certification","red-hat-connect","redhat","security","vendor"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"resolved","published_at":"2026-09-25T05:01:31+00:00","first_seen_at":"2026-11-14T01:28:03+00:00","triaged_at":"2026-11-14T01:29:36+00:00","updated_at":"2026-11-14T01:29:36+00:00","category":"vendor","confidence":0.5,"triage":{"at":"2026-11-14T01:29:36Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Red Hat Connect outage caused by undocumented certificate rotation","impact":"low","summary":"Red Hat Connect, the partner certification portal, went down after a backend team rotated a certificate without notice. The incident is an availability outage, and the sources describe no attacker access or data exposure.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["red-hat-connect","partner-certification"],"confidence":0.5,"fix_status":"none","needs_auth":"unknown","worst_case":"Partner certification portal unavailable; no attacker access described","analyst_note":"","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000624,"input_tokens":4682,"output_tokens":312,"severity_before":"high","breached_checked":true},"analyst_status":null,"analyst_note":null,"search":"'access':56B 'action':124C 'alert':72C,81C,106C,159C 'attack':55B 'autom':70C,105C 'avail':48B 'backend':37B,67C 'caus':91C,122C 'certif':18B,31B,41B,63C,77C,86C,99C,117C,143C,148C,155C 'communic':129C 'connect':5A,22B,28B 'data':58B 'debug':111C 'deploy':161C 'describ':53B 'detect':95C,101C 'ensur':154C 'execut':60C 'exposur':59B 'follow':166C 'futur':147C 'hat':2A,4A,14A,21B,27B 'identifi':83C 'immedi':109C,158C 'implement':126C 'inc':10A 'inc-redhat-ytb6wht11437':9A 'incid':15B,45B,94C 'initi':110C 'investig':8A,79C,96C 'isol':115C 'issu':103C 'item':125C 'major':6A 'mandatori':128C 'mismatch':156C 'monitor':151C 'morn':74C,167C 'notic':43B 'outag':7A,49B 'partner':17B,30B,76C,98C,142C 'partner-certif':16B 'platform':138C 'portal':32B 'procedur':112C 'process':135C 'protocol':130C 'rather':163C 'recommend':123C 'red':1A,3A,13A,20B,26B 'red-hat-connect':19B 'redhat':11A,23B 'review':150C 'root':90C 'rotat':39B,87C,149C 'secur':24B 'sign':133C 'sign-off':132C 'sourc':52B 'success':114C 'summari':61C 'system':71C,152C 'team':38B,68C,78C,100C,108C,139C,144C 'trigger':69C,157C 'under':121C 'undocu':85C 'updat':64C,118C 'vendor':25B 'via':104C 'went':33B 'window':162C 'without':42B 'ytb6wht11437':12A","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["hat","redhat"],"ptokens":["hat","red"],"labels":["high","incident","partnercertification","redhat","redhatconnect","security","vendor"],"campaign_type":null,"search_a":"'connect':5A 'hat':2A,4A,14A 'inc':10A 'inc-redhat-ytb6wht11437':9A 'investig':8A 'major':6A 'outag':7A 'red':1A,3A,13A 'redhat':11A 'ytb6wht11437':12A","search_b":"'access':56B 'attack':55B 'avail':48B 'backend':37B 'certif':18B,31B,41B 'connect':22B,28B 'data':58B 'describ':53B 'exposur':59B 'hat':21B,27B 'incid':15B,45B 'notic':43B 'outag':49B 'partner':17B,30B 'partner-certif':16B 'portal':32B 'red':20B,26B 'red-hat-connect':19B 'redhat':23B 'rotat':39B 'secur':24B 'sourc':52B 'team':38B 'vendor':25B 'went':33B 'without':42B","search_c":"'action':124C 'alert':72C,81C,106C,159C 'autom':70C,105C 'backend':67C 'caus':91C,122C 'certif':63C,77C,86C,99C,117C,143C,148C,155C 'communic':129C 'debug':111C 'deploy':161C 'detect':95C,101C 'ensur':154C 'execut':60C 'follow':166C 'futur':147C 'identifi':83C 'immedi':109C,158C 'implement':126C 'incid':94C 'initi':110C 'investig':79C,96C 'isol':115C 'issu':103C 'item':125C 'mandatori':128C 'mismatch':156C 'monitor':151C 'morn':74C,167C 'partner':76C,98C,142C 'platform':138C 'procedur':112C 'process':135C 'protocol':130C 'rather':163C 'recommend':123C 'review':150C 'root':90C 'rotat':87C,149C 'sign':133C 'sign-off':132C 'success':114C 'summari':61C 'system':71C,152C 'team':68C,78C,100C,108C,139C,144C 'trigger':69C,157C 'under':121C 'undocu':85C 'updat':64C,118C 'via':104C 'window':162C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-09-25T05:01:31+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"statuspage","external_id":"redhat:ytb6wht11437","url":"https://stspg.io/knbx6dxc8dtr","severity":"high","published_at":"2026-09-25T05:01:31+00:00","modified_at":"2026-09-25T17:13:17+00:00","first_seen_at":"2026-11-14T01:28:03+00:00","fetched_at":"2026-11-14T02:01:54+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}