If a security issue is found you can disclose it confidentially by contacting Red Hat's Product Security team. Details at https://access.redhat.com/security/team/contact