CVE-2026-92615 Red Hat CVE debrief

Who should care

Defenders managing git operations for multiple organizations should assess exposure and verify tenant repository configurations. Operators, security teams, and vulnerability management teams should review TLS settings for InsecureSkipVerify or mTLS client credentials and verify tenant repository configurations.

Why it matters

CVE-2026-92615 flaw in flightctl allows tenant TLS settings to leak into other tenant git operations, requiring defenders to assess git operations security and verify tenant repository configurations.

• Tenant TLS settings may leak into other tenant git operations
• InsecureSkipVerify or mTLS client credentials may be compromised
• Git operations security requires assessment and verification

Technical summary

The configureRepoHTTPSClient() function in flightctl's device-render worker builds a per-repository tls.Config and installs it into go-git's process-global client.Protocols map. A race condition allows one tenant's TLS settings to leak into another tenant's git operations. This flaw allows tenant TLS settings, including InsecureSkipVerify or mTLS client credentials, to leak into other tenant git operations. Defenders managing git operations for multiple organizations should assess exposure and verify tenant repository configurations.

Defensive priority

Medium priority for git operations security assessment

Recommended defensive actions

• Assess git operations security for multiple organizations
• Review TLS settings for InsecureSkipVerify or mTLS client credentials
• Verify tenant repository configurations
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

CVE Program and NIST NVD records detail a flaw in flightctl's configureRepoHTTPSClient() function, allowing tenant TLS settings to leak into other tenant git operations due to a race condition. The CVE record was published on 2026-09-16T16:17:23.513Z and has not been modified since then. The NVD entry is currently Awaiting Analysis. Official CVE Program and NVD records provide source-grounded evidence of this vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.