VDB
RHSA-2026:68515
RHSA-2026:68515
PUBLISHED
CVSS 4.400000095367432 MEDIUM
A flaw was found in moby/go-archive. The tar extraction routines in the component do not properly restrict filesystem operations to the intended destination directory. An attacker who controls the contents of an archive can exploit this by including symbolic links, allowing them to create or overwrite files at arbitrary locations on the system where the archive is being extracted. This could lead to unauthorized modification of system files or potentially arbitrary code execution.
Risk Scores
CVSS 3.1
4.400000095367432
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf4cf3becce69c5e75b3987afaeb06833e92393b178f51ab366f13d224e8f8de_amd64 as a component of Multicluster Global Hub 1.8.2 | * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:6f87d47921c4b6161c6ead31676870b12f79ba240c478dd35ff5652313f949fa_arm64 as a component of Multicluster Global Hub 1.8.2 | * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a6263ed1836ad0d34d120a43b09dcbb2e66a1a57cebc70ebbb6e43ef792ea506_ppc64le as a component of Multicluster Global Hub 1.8.2 | * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6c0b3f002aac0debb7d52811d21d9f8fc9d0cf2e9d2aaf92a8f47bf8093481c7_amd64 as a component of Multicluster Global Hub 1.8.2 | * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8408aa29230ad808dbb415e6ba6676fb20d4a092d51bef3350b803a5fc3173c4_s390x as a component of Multicluster Global Hub 1.8.2 | * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:991fc487eaa4357cd0a2e87e44780e040ee62bf85bbed4ef009e44f0ca88c304_s390x as a component of Multicluster Global Hub 1.8.2 | * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5d918eb2a8f66bb88309d3c664a39fdf5f4b114affe94fe53e0b40c530d62cf7_s390x as a component of Multicluster Global Hub 1.8.2 | * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a0f75fc098b74a93989ba73ae780026e549e880ccdca020aaf1a7cb61ec99860_arm64 as a component of Multicluster Global Hub 1.8.2 | * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7c4e86d18a27db792f81bdaca580e5d444bb051d6ed69be5c7fb729bee023490_arm64 as a component of Multicluster Global Hub 1.8.2 | * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf3ca46916a9fb1ec3b3a58a61f450cd72a9d96c7e1025373b830f288ac897fa_ppc64le as a component of Multicluster Global Hub 1.8.2 | * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:cb7614e99220c6c8a7aad2d3d825a257b02a6404843f89d593f1a9d61ad22348_amd64 as a component of Multicluster Global Hub 1.8.2 | * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:67ee22bc6faf683e8ae37ba3cfb4152e6e14bcb477e9929dc27c99062dd8bf01_amd64 as a component of Multicluster Global Hub 1.8.2 | * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1feb02ae99a463d9e6319b71ac4a3eda47de42d5c55142dc03fcf7f003dc24a_ppc64le as a component of Multicluster Global Hub 1.8.2 | * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2eaab1aa06261c35b7f3fec47792b7884ae04bbb5e631080097c33dbd9ba2a82_s390x as a component of Multicluster Global Hub 1.8.2 | * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a99ee13ca3a00455bbdeadbffe28c658764a2a938e09e16d15324fe68a0c0e00_ppc64le as a component of Multicluster Global Hub 1.8.2 | * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:9187be523aa0e681bbf08ef19b615269ce0ba3f6a952fe0aa6461bb3b9008795_amd64 as a component of Multicluster Global Hub 1.8.2 | * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:783a800f8a138e3248ca96f861eda148720fd4ba863bc4fae45af754dcce542d_arm64 as a component of Multicluster Global Hub 1.8.2 | * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:02cfdd71deb8fad770bcc7df04e3ce6714fac89d1204796ee2098db9c2d334d0_arm64 as a component of Multicluster Global Hub 1.8.2 | * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:4d0554bf41068beee732eac112e5c149dec452f7292a70bef9e9507ed9857be7_ppc64le as a component of Multicluster Global Hub 1.8.2 | * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d20697adb726ca17dcfec5d1773bd6a43e0c5c82bf730354f7c7aab83e33fbb9_s390x as a component of Multicluster Global Hub 1.8.2 | * |
…and 1 more
Timeline
- Sep 17, 2026 CVE Published
- Sep 23, 2026 CVE Updated
- Sep 23, 2026 Distribution Patch
- Sep 23, 2026 Distribution Patch
- Sep 23, 2026 Security Advisory
- Sep 23, 2026 Security Advisory
- Sep 23, 2026 Security Advisory
- Sep 23, 2026 Security Advisory
- Sep 23, 2026 Security Advisory
- Sep 23, 2026 Security Advisory
- Sep 23, 2026 Security Advisory
- Sep 23, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:68515 advisory
- https://access.redhat.com/security/cve/CVE-2026-17106 advisory
- https://access.redhat.com/security/cve/CVE-2026-33818 advisory
- https://access.redhat.com/security/cve/CVE-2026-41178 advisory
- https://access.redhat.com/security/cve/CVE-2026-42502 advisory
- https://access.redhat.com/security/cve/CVE-2026-46604 advisory
- https://access.redhat.com/security/cve/CVE-2026-48586 advisory
- https://access.redhat.com/security/cve/CVE-2026-50151 advisory
- https://access.redhat.com/security/cve/CVE-2026-56852 advisory
- https://access.redhat.com/security/cve/CVE-2026-56853 advisory
- https://access.redhat.com/security/cve/CVE-2026-56858 advisory
- https://access.redhat.com/security/cve/CVE-2026-56859 advisory
- https://access.redhat.com/security/cve/CVE-2026-56860 advisory
- https://access.redhat.com/security/cve/CVE-2026-56862 advisory
- https://access.redhat.com/security/cve/CVE-2026-71235 advisory
- https://access.redhat.com/security/cve/CVE-2026-71576 advisory
- https://access.redhat.com/security/cve/CVE-2026-71577 advisory
- https://access.redhat.com/security/cve/CVE-2026-75762 advisory
- https://access.redhat.com/security/cve/CVE-2026-77849 advisory
- https://access.redhat.com/security/cve/CVE-2026-79921 advisory
…and 111 more