VDB
RHSA-2026:54577
RHSA-2026:54577
PUBLISHED
CVSS 9.899999618530273 CRITICAL
A flaw was found in the Moby container framework. A race condition occurs during the `docker cp` mount setup, which a malicious container can exploit. This vulnerability allows the container to redirect a bind mount target to an arbitrary path on the host system. Consequently, an attacker could overwrite host files, potentially leading to data corruption or a denial of service.
Risk Scores
CVSS 3.1
9.899999618530273
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:ffa96130ce94a9d9f51cabce8e2e6eac64f01034b596cc7d2b90d33713496ccf_ppc64le as a component of Multicluster Global Hub 1.5.7 | * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:bfca5230561f1901c2208ee6242831ea0b8f185c51166c8a2cfa9ac749be38bc_amd64 as a component of Red Hat multicluster global hub 1.5.3 | * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:b780e75db2833550d5618c44d63cc374a4a38c8d327e514ef2aa2c8ce8badb95_amd64 as a component of Multicluster Global Hub 1.5.7 | * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:54fa72b965dba7dad60263362a95515ca41ca5c5d62621690c025a99a7977a77_s390x as a component of Multicluster Global Hub 1.5.7 | * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:8716b6b65ed359d7bf25e08bc66190f8910d23513af3020fb5c5b01ce0dcfefc_arm64 as a component of Red Hat multicluster global hub 1.5.3 | * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:d379244d0bab3d63bd6790b3a8a0cb1a4ce2aad42494ee8fd9a1990f283d01c3_s390x as a component of Red Hat multicluster global hub 1.5.3 | * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d7557d40a63a755904852baa59c6106cbe16ce0e8cbc1ce5986fc50152094315_s390x as a component of Multicluster Global Hub 1.5.7 | * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6065e223ba12401f3bd6058f921dd3535e05e331c3ae1dd32452c1bc91d6cc76_ppc64le as a component of Multicluster Global Hub 1.5.7 | * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:8716b6b65ed359d7bf25e08bc66190f8910d23513af3020fb5c5b01ce0dcfefc_arm64 as a component of Multicluster Global Hub 1.5.7 | * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ed25546c40b9e986a77981c9a4c9c43f929304dc0c25a507b5d041d8af4894a5_s390x as a component of Multicluster Global Hub 1.5.7 | * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b453630e58fe386ccf0f1f0323429e5ca93600ad54818ef6ebe2a1437cc1fb97_s390x as a component of Red Hat multicluster global hub 1.5.3 | * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c7f3aa6419753ff217d2d05a659a1951e0ad840b3c3f1d04780f489c93421c25_ppc64le as a component of Red Hat multicluster global hub 1.5.3 | * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:b497a86bb02a05f3758c6b5722fb0da61ca5f448092d322359dd4d06cdd08870_arm64 as a component of Red Hat multicluster global hub 1.5.3 | * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:bfca5230561f1901c2208ee6242831ea0b8f185c51166c8a2cfa9ac749be38bc_amd64 as a component of Multicluster Global Hub 1.5.7 | * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7fe412718d7bd3e37855a085a53394d93064741830df7e922a2164d8fcacb92a_amd64 as a component of Red Hat multicluster global hub 1.5.3 | * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d7557d40a63a755904852baa59c6106cbe16ce0e8cbc1ce5986fc50152094315_s390x as a component of Red Hat multicluster global hub 1.5.3 | * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6e6a1da8ae29ab7b2d58748d7e45941989b9c3091434a5d13731ac7d453377e6_ppc64le as a component of Multicluster Global Hub 1.5.7 | * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6065e223ba12401f3bd6058f921dd3535e05e331c3ae1dd32452c1bc91d6cc76_ppc64le as a component of Red Hat multicluster global hub 1.5.3 | * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cd6c5ce0a19e15ce0091d4a342599c85998453b9cb495584cce4c16ae99e25d2_arm64 as a component of Multicluster Global Hub 1.5.7 | * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1843b2f6e362127e0fe74fb6cf4f96828fcf7d82753370c17a23075ce7538ff9_arm64 as a component of Red Hat multicluster global hub 1.5.3 | * |
…and 22 more
Timeline
- Aug 13, 2026 CVE Published
- Sep 22, 2026 CVE Updated
- Sep 22, 2026 Distribution Patch
- Sep 22, 2026 Distribution Patch
- Sep 22, 2026 Security Advisory
- Sep 22, 2026 Security Advisory
- Sep 22, 2026 Security Advisory
- Sep 22, 2026 Security Advisory
References
- https://access.redhat.com/security/cve/CVE-2026-42306 advisory
- https://access.redhat.com/security/cve/CVE-2026-55969 advisory
- https://access.redhat.com/security/cve/CVE-2026-66801 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://access.redhat.com/errata/RHSA-2026:54577 advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_54577.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2488484 issue
- https://www.cve.org/CVERecord?id=CVE-2026-42306 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-42306 advisory
- https://github.com/moby/moby/security/advisories/GHSA-rg2x-37c3-w2rh advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2507433 issue
- https://www.cve.org/CVERecord?id=CVE-2026-55969 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-55969 advisory
- http://www.openwall.com/lists/oss-security/2026/07/24/40 advisory
- https://lists.apache.org/thread/7v3jhgwfbmhx42424phydlnzb109g8b9 advisory
- https://lists.apache.org/thread/xmkgd107k795hyrg5kf97mny30sgl5bo advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2508045 issue
- https://www.cve.org/CVERecord?id=CVE-2026-66801 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-66801 advisory