CVE-2026-115424Medium· 5.5▾ SunlitA flaw was found in the OpenShift client oc. When extracting container image layers with oc image extract, the application fails to properly sanitize symbolic and hard link targets pointing to absolute paths or to sibling directories of th…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 30.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 25.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
Last analysed / modified upstream
0.2%
A flaw was found in the OpenShift client oc. When extracting container image layers with oc image extract, the application fails to properly sanitize symbolic and hard link targets pointing to absolute paths or to sibling directories of the extraction destination. An attacker who supplies a malicious container image can exploit this vulnerability by embedding links, and a chained file entry, that reference locations outside the intended extraction directory. This allows the attacker to write attacker-controlled content to arbitrary locations on the host filesystem with the privileges of the user running the command, potentially leading to file modification outside the destination directory.
oc: oc: Symlink/hardlink target validation bypass in oc image extract allows file write outside destination — rated Moderate by Red Hat. Released 2026-10-21, updated 2026-10-23.
Affected:
No fix planned:
Fix deferred
Workarounds / mitigations:
Where possible, run oc image extract as an unprivileged user and into a dedicated, isolated destination directory, and avoid fixed/predictable destination paths in automated or CI pipelines. Restrict who can modify the image references that automated extraction jobs consume.
There is no configuration option to disable only this link…
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-88753High· 7.5A Regular-Expression Denial of Service (ReDoS) in the Markdown2
CVE-2026-104795High· 8.8The insights-runtime-extractor runs as a privileged DaemonSet (`hostPID: true`) that scans container processes for runtime fingerprinting
CVE-2026-92817High· 8.8The Ignition Perspective module does not properly validate session privileges when determining Designer-level access
CVE-2026-110036Low· 3.3A flaw was found in device-mapper-persistent-data
CVE-2026-97024High· 7.1A path traversal vulnerability in Flatpak's handling of the files/etc directory during app deployment allows a malicious Flatpak app to cause certain host system files (such as passwd, group, machine-id, or resolv.conf) to be emptied or …
CVE-2026-97023High· 7.1A path traversal vulnerability in Flatpak's handling of the export/bin directory during app deployment allows a malicious Flatpak app to cause deletion of attacker-chosen files outside the deployment directory when the app is installed o…