If a security issue is found you can disclose it confidentially by contacting Red Hat's Product Security team.

Details at https://access.redhat.com/security/team/contact