CVE-2026-19278: falha de média gravidade em Red Hat Advanced Cluster Security 4
Stackrox: stackrox: privilege escalation via unanchored regular expressions in auth m2m role mappings
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.8epss 0.3%
A flaw was found in StackRox/RHACS Central's Auth Machine-to-Machine (M2M) token exchange. When an administrator configures M2M role mappings, the system uses unanchored regular expressions for matching claim values. This allows an attacker with a valid OpenID Connect (OIDC) token, whose claim value is a superstring of a configured pattern, to gain unauthorized access to roles they were not intended to receive. This can lead to privilege escalation within the system.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Produtos afetados
Red Hat · Red Hat Advanced Cluster Security 4CVEs relacionadas — Red Hat Advanced Cluster Security 4
No mesmo produto, das mais perigosas para as menos.
CVE-2024-11831MEDIUMNpm-serialize-javascript: cross-site scripting (xss) in serialize-javascriptEPSS 1.1%CVE-2024-0406MEDIUMMholt/archiver: path traversal vulnerabilityEPSS 0.9%CVE-2025-8556LOWGithub.com/cloudflare/circl: circl-fourq: missing and wrong validation can lead to incorrect resultsEPSS 0.6%CVE-2026-9165HIGHStackrox: stackrox: unbounded graphql query depth allows authenticated denial of serviceEPSS 0.5%CVE-2025-11065MEDIUMGithub.com/go-viper/mapstructure/v2: go-viper's mapstructure may leak sensitive information in logs in github.com/go-viper/mapstructureEPSS 0.5%CVE-2026-19519MEDIUMClaircore: claircore: denial of service via unchecked type assertion in rpm header parserEPSS 0.4%