CVE-2026-115424 Red Hat CVE debrief

Who should care

OpenShift administrators and users who extract container images with oc image extract should assess exposure and verify remediation status to mitigate potential risks. This includes reviewing the official advisory, assessing exposure, and verifying remediation status. Additionally, defenders should monitor for unauthorized file modifications and review container image extraction processes.

Why it matters

CVE-2026-115424 allows an attacker to write to arbitrary locations on the host filesystem by exploiting a flaw in the OpenShift client oc. Defenders should assess exposure, verify remediation, and monitor for unauthorized file modifications.

• Potential for unauthorized file modification on host filesystem
• Need for verification of affected versions and remediation status
• Possible impact on data integrity and system security
• Requires review of container image extraction processes

Technical summary

The OpenShift client oc is vulnerable to improper sanitization of symbolic and hard link targets when extracting container image layers. An attacker can exploit this by supplying a malicious container image with links referencing locations outside the intended extraction directory, potentially leading to file modification on the host filesystem. This vulnerability can be mitigated by reviewing and updating OpenShift client oc to the latest version, restricting access to oc image extract command, and monitoring file system for unauthorized modifications.

Defensive priority

Medium

Recommended defensive actions

• Review and update OpenShift client oc to the latest version
• Restrict access to oc image extract command
• Monitor file system for unauthorized modifications
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but its scope, remediation, and exploitation status require verification from official sources. Defenders should review the official advisory, assess exposure, and verify remediation status. The vulnerability's impact on data integrity and system security necessitates a thorough review of container image extraction processes and potential compensating controls.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.