VDB
RHSA-2026:54392
RHSA-2026:54392
PUBLISHED
CVSS 9.899999618530273 CRITICAL
A flaw was found in the Moby container framework. A race condition occurs during the `docker cp` mount setup, which a malicious container can exploit. This vulnerability allows the container to redirect a bind mount target to an arbitrary path on the host system. Consequently, an attacker could overwrite host files, potentially leading to data corruption or a denial of service.
Risk Scores
CVSS 3.1
9.899999618530273
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:fd4dde219f95e134f6fc6e99dc4e5d6d307c4970784153bb907e94d62277e0ff_s390x as a component of Multicluster Global Hub 1.6.5 | *, * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:a6bd3e7a1398efbdeaab7a57604e1d8c80d7c3263f87efb1d984d4cf70509233_ppc64le as a component of Multicluster Global Hub 1.6.5 | *, * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3683dec0e1995e5f74da731a720f67c74b03fc22f9ee4fde9eae2dfda6e9541b_s390x as a component of Multicluster Global Hub 1.6.5 | *, * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6c999e88b89c35fffdac9526dac83e28225cdbdb78a1b4d868bd401e3460dbe4_s390x as a component of Multicluster Global Hub 1.6.5 | *, * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:4e9983ebd37e06969fbc9ecc7a07dfebea6bf1b1a42b5e28678646f2a0466932_ppc64le as a component of Multicluster Global Hub 1.6.5 | *, * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6c3426e56534f063a26f14fddeaef9a75c2457bc11ffc7324545941925956d6c_amd64 as a component of Multicluster Global Hub 1.6.5 | *, * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:c572fb658b37c4629240e46dcf2512d2e26b314354736c92f610df194f08c840_arm64 as a component of Multicluster Global Hub 1.6.5 | *, * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:538f16143d15752f7a6753667f13e8d7b48efb34d0cff17a9f726a7de220ecf3_s390x as a component of Multicluster Global Hub 1.6.5 | *, * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:56d42c9fe938f916ec83ef7c93fb7e403dae6fe7fbecb5dd88fbf7e2befbcef0_ppc64le as a component of Multicluster Global Hub 1.6.5 | *, * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:5495446e8d0334f94f7f6830c75575ca8b4896309a73b7938565ec785d7fb589_ppc64le as a component of Multicluster Global Hub 1.6.5 | *, * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:7ed372714f1fb64c2136954b842c68a9e17943c9c773b7c68da695a4062c8302_amd64 as a component of Multicluster Global Hub 1.6.5 | *, * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6f2e5f0fdfee2022b20ee0dcc863f2dd7f1c625817f52fe8239ab5ecc79f2733_amd64 as a component of Multicluster Global Hub 1.6.5 | *, * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:54702f0054d14967b4ef2b77ff60f76624d5a3fa3272a51e4ef35d251a1e99bd_amd64 as a component of Multicluster Global Hub 1.6.5 | *, * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:eeb2cf9ee5d4d464d99fa5642aea3f3d68ec5d7483d8c716aa16ade4cc50b63e_ppc64le as a component of Multicluster Global Hub 1.6.5 | *, * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:23351c3eb3f9dd1a76fbea9d18c284027e49ee0226fef279300bf6154269cd6e_arm64 as a component of Multicluster Global Hub 1.6.5 | *, * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:45ee466e62a5c23465c708ef45fe2c382a511d8aab27805b9b59b0a897ea34b8_arm64 as a component of Multicluster Global Hub 1.6.5 | *, * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:577df46c89118e93992b112cfabd1848127d3eec85cddd96dc48410b43528381_s390x as a component of Multicluster Global Hub 1.6.5 | *, * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:7c855d1a21309a5a889c02692b85df0acaf936120a876687f234f97944eb8f86_amd64 as a component of Multicluster Global Hub 1.6.5 | *, * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:c1de0aac6452070560d1481b55530c441c6d3a55c215ee4bca23c7bbdaa91538_arm64 as a component of Multicluster Global Hub 1.6.5 | *, * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:948f18c01dcf6d1525d7eab475bea09396969d8c3269ff5b5f449c6ef78928a5_amd64 as a component of Multicluster Global Hub 1.6.5 | *, * |
…and 1 more
Timeline
- Aug 12, 2026 CVE Published
- Sep 22, 2026 CVE Updated
- Sep 22, 2026 Distribution Patch
- Sep 22, 2026 Distribution Patch
- Sep 22, 2026 Security Advisory
- Sep 22, 2026 Security Advisory
- Sep 22, 2026 Security Advisory
- Sep 22, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:54392 advisory
- https://access.redhat.com/security/cve/CVE-2026-42306 advisory
- https://access.redhat.com/security/cve/CVE-2026-55969 advisory
- https://access.redhat.com/security/cve/CVE-2026-66801 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_54392.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2488484 issue
- https://www.cve.org/CVERecord?id=CVE-2026-42306 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-42306 advisory
- https://github.com/moby/moby/security/advisories/GHSA-rg2x-37c3-w2rh advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2507433 issue
- https://www.cve.org/CVERecord?id=CVE-2026-55969 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-55969 advisory
- http://www.openwall.com/lists/oss-security/2026/07/24/40 advisory
- https://lists.apache.org/thread/7v3jhgwfbmhx42424phydlnzb109g8b9 advisory
- https://lists.apache.org/thread/xmkgd107k795hyrg5kf97mny30sgl5bo advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2508045 issue
- https://www.cve.org/CVERecord?id=CVE-2026-66801 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-66801 advisory