VDB
RHSA-2026:73038
RHSA-2026:73038
PUBLISHED
CVSS 4.400000095367432 MEDIUM
A flaw was found in moby/go-archive. The tar extraction routines in the component do not properly restrict filesystem operations to the intended destination directory. An attacker who controls the contents of an archive can exploit this by including symbolic links, allowing them to create or overwrite files at arbitrary locations on the system where the archive is being extracted. This could lead to unauthorized modification of system files or potentially arbitrary code execution.
Risk Scores
CVSS 3.1
4.400000095367432
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6c0b3f002aac0debb7d52811d21d9f8fc9d0cf2e9d2aaf92a8f47bf8093481c7_amd64 as a component of Multicluster Global Hub 1.8.2 | *, *, * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e7640a28e2f17e2f4f69ef01c644201650d25ddff0c96f41fad26f5d4b2e9380_arm64 as a component of Multicluster Global Hub 1.8.2 | *, *, * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:d50c662083de7084d90165f5d0f7f4b1986aa04334aee78ad3fd82fbe37a91df_ppc64le as a component of Multicluster Global Hub 1.8.2 | *, *, * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:315b101e0c3bf4624321aede464e6bc1c994eb40d0f1bf230eb3988a28dc48b5_s390x as a component of Multicluster Global Hub 1.8.2 | *, *, * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba58eb7ea0463459218cbe493faea59105a4ce954f6d8f3fb3447ac7958ab4e8_amd64 as a component of Multicluster Global Hub 1.8.2 | *, *, * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:a8fa93d288d8919041c7bdab43c133b6251462483e5475a1b8e87d31ffb81e57_ppc64le as a component of Multicluster Global Hub 1.8.2 | *, *, * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:42ecc29d988d1b4c370d7ea5cb0619d29a6938b01c093864e17837c3dd047314_amd64 as a component of Multicluster Global Hub 1.8.2 | *, *, * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2fb54434e80fd99e0f4ffb8f568181c78047aa2ef75f105a5247a1c1e32f0bb6_ppc64le as a component of Multicluster Global Hub 1.8.2 | *, *, * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:991fc487eaa4357cd0a2e87e44780e040ee62bf85bbed4ef009e44f0ca88c304_s390x as a component of Multicluster Global Hub 1.8.2 | *, *, * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a6263ed1836ad0d34d120a43b09dcbb2e66a1a57cebc70ebbb6e43ef792ea506_ppc64le as a component of Multicluster Global Hub 1.8.2 | *, *, * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:51a06c0911cd26f67f9a2e8bcdd1e9523e88a8cd6c1e3c497c0fb12c5625f197_arm64 as a component of Multicluster Global Hub 1.8.2 | *, *, * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a0f75fc098b74a93989ba73ae780026e549e880ccdca020aaf1a7cb61ec99860_arm64 as a component of Multicluster Global Hub 1.8.2 | *, *, * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:7092341d99cdb2da484f2770c94c48f0fc38e1c3f59c854ad7bdea0e6db8aa73_amd64 as a component of Multicluster Global Hub 1.8.2 | *, *, * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:7514779fdd0ec7f734986bd02bac08cf3a5133871bb44580febc6f28eec0f6e0_s390x as a component of Multicluster Global Hub 1.8.2 | *, *, * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:949e39031b1a6f4006b220c67380ae29f64835e08712ff790d9a1f5d90c2a2ee_amd64 as a component of Multicluster Global Hub 1.8.2 | *, *, * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2c812623490bba09d1fdeb595686bfff1e90b6c31dc563533212f87abc56fc01_s390x as a component of Multicluster Global Hub 1.8.2 | *, *, * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c438ac2ce14366ffa5bc4defa829b0694eefd7427966618a9a0482bf5b58d591_arm64 as a component of Multicluster Global Hub 1.8.2 | *, *, * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b8f1f7489eb65d4161d67802b6231714f91fec3e531119c1c30bd8a5cd6b000a_arm64 as a component of Multicluster Global Hub 1.8.2 | *, *, * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e7af92caa4e3c17f82a60cef6f8406bcd0b55eea88abbdf7619022a3038c1600_ppc64le as a component of Multicluster Global Hub 1.8.2 | *, *, * |
| Red Hat | Multicluster Global Hub 1.8.2 |
…and 2 more
Timeline
- Sep 29, 2026 CVE Published
- Oct 15, 2026 CVE Updated
- Oct 15, 2026 Distribution Patch
- Oct 15, 2026 Distribution Patch
- Oct 15, 2026 Security Advisory
- Oct 15, 2026 Security Advisory
- Oct 15, 2026 Security Advisory
- Oct 15, 2026 Security Advisory
- Oct 15, 2026 Security Advisory
- Oct 15, 2026 Security Advisory
- Oct 15, 2026 Security Advisory
- Oct 15, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:73038 advisory
- https://access.redhat.com/security/cve/CVE-2026-17106 advisory
- https://access.redhat.com/security/cve/CVE-2026-33818 advisory
- https://access.redhat.com/security/cve/CVE-2026-41178 advisory
- https://access.redhat.com/security/cve/CVE-2026-42502 advisory
- https://access.redhat.com/security/cve/CVE-2026-46604 advisory
- https://access.redhat.com/security/cve/CVE-2026-48586 advisory
- https://access.redhat.com/security/cve/CVE-2026-50151 advisory
- https://access.redhat.com/security/cve/CVE-2026-56852 advisory
- https://access.redhat.com/security/cve/CVE-2026-56853 advisory
- https://access.redhat.com/security/cve/CVE-2026-56858 advisory
- https://access.redhat.com/security/cve/CVE-2026-56859 advisory
- https://access.redhat.com/security/cve/CVE-2026-56860 advisory
- https://access.redhat.com/security/cve/CVE-2026-56862 advisory
- https://access.redhat.com/security/cve/CVE-2026-71235 advisory
- https://access.redhat.com/security/cve/CVE-2026-71576 advisory
- https://access.redhat.com/security/cve/CVE-2026-71577 advisory
- https://access.redhat.com/security/cve/CVE-2026-75762 advisory
- https://access.redhat.com/security/cve/CVE-2026-77849 advisory
- https://access.redhat.com/security/cve/CVE-2026-79921 advisory
…and 103 more