CVE-2026-86330
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2026
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
Noobaa-core: noobaa-core: os command injection in cluster_internal_api.set_hostname_internal
An OS command injection flaw was found in the set_hostname_internal function of NooBaa's cluster_internal_api. This component is responsible for managing the Multi-Cloud Object Gateway in OpenShift Data Foundation. The vulnerability occurs because the hostname parameter is passed directly to a shell command without proper sanitization. An authenticated attacker with administrative privileges can provide a specially crafted hostname containing shell metacharacters to execute arbitrary commands on the host system with the privileges of the NooBaa process.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Red Hat Openshift Data Foundation 4
- Vendor
- Red Hat
- Product
- Red Hat Openshift Data Foundation 4
- Platforms
- Unknown
- Default status
affected- Package
- odf4/mcg-core-rhel9
- Package collection
- https://access.redhat.com/downloads/content/package-browser/
No explicit version tuples; consult this entry's default status.
Red Hat Openshift Data Foundation 4
- Vendor
- Red Hat
- Product
- Red Hat Openshift Data Foundation 4
- Platforms
- Unknown
- Default status
affected- Package
- rhceph-dev/odf4-mcg-core-rhel9
- Package collection
- https://access.redhat.com/downloads/content/package-browser/
No explicit version tuples; consult this entry's default status.