CVE-2026-86330Noobaa-core: noobaa-core: os command injection in cluster_internal_api.set_hostname_internal
Updated under an hour ago ()
Does this affect you?
It affects Red Hat Openshift Data Foundation 4. Add what you run to find out whether that includes you.
EPSS puts the chance of exploitation in the next 30 days at 2.18%, higher than 82% of scored CVEs.
Do this next
Free account, 1 product
An OS command injection flaw was found in the set_hostname_internal function of NooBaa's cluster_internal_api. This component is responsible for managing the Multi-Cloud Object Gateway in OpenShift Data Foundation. The vulnerability occurs because the hostname parameter is passed directly to a shell command without proper sanitization. An authenticated attacker with administrative privileges can provide a specially crafted hostname containing shell metacharacters to execute arbitrary commands on the host system with the privileges of the NooBaa process.
- CVSS
- 7.2 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- CWE-78
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- 2.18% (percentile 82)
- Assigned by
- redhat
- NVD analysis
- Awaiting Analysis
- Record last updated
- Sep 30, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Red Hat Red Hat Openshift Data Foundation 4 redhat:openshift_data_foundation | 4 | CNA record |
References
- https://access.redhat.com/security/cve/CVE-2026-86330vdb-entry, x-refsource-redhat
- https://bugzilla.redhat.com/show_bug.cgi?id=2529295issue-tracking, x-refsource-redhat
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.