EUVD-2026-55617
GHSA-7c5g-xvpm-qr5v
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Network-exposed M2M endpoint requires a valid low-privilege OIDC token (PR:L) and attacker knowledge of mapping patterns (AC:H); successful exploitation grants unauthorized elevated roles with full C:H and I:H but no availability impact.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
2DescriptionCVE.org
A flaw was found in StackRox/RHACS Central's Auth Machine-to-Machine (M2M) token exchange. When an administrator configures M2M role mappings, the system uses unanchored regular expressions for matching claim values. This allows an attacker with a valid OpenID Connect (OIDC) token, whose claim value is a superstring of a configured pattern, to gain unauthorized access to roles they were not intended to receive. This can lead to privilege escalation within the system.
AnalysisAI
Privilege escalation in Red Hat Advanced Cluster Security 4 (StackRox Central) allows authenticated OIDC token holders to gain unauthorized role assignments through unanchored regular expression matching in the Machine-to-Machine token exchange subsystem. When administrators configure M2M role mappings, RHACS matches incoming OIDC claim values against configured patterns without regex anchors, meaning an attacker whose claim value is a superstring of a mapped pattern - for example, 'superadmin' matching a pattern intended only for 'admin' - receives elevated roles unintentionally. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target RHACS 4 deployment has the Machine-to-Machine (M2M) token exchange feature enabled and that an administrator has defined at least one M2M role mapping using OIDC claim-based pattern matching. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 6.8 score and vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N accurately characterize a moderate-to-elevated real-world risk: network reachability and high confidentiality and integrity impact are serious, but AC:H reflects a genuine prerequisite that the attacker must know or infer the target's M2M regex patterns and control a claim value that satisfies the superstring condition. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consult the Red Hat Security Advisory at https://access.redhat.com/security/cve/CVE-2026-19278 and Bugzilla entry 2512524 at https://bugzilla.redhat.com/show_bug.cgi?id=2512524 for the official patched release version once published - no exact fix version was confirmed in the available input data, so the patch version must be independently verified before deployment. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Deploy-time policy bypass in Red Hat Advanced Cluster Security for Kubernetes 4 lets a user with Kubernetes Deployment-c
Authenticated denial of service in Red Hat Advanced Cluster Security for Kubernetes (RHACS) 4 allows any user holding a
Denial of service in claircore's Alpine APK package scanner affects Red Hat Advanced Cluster Security 4 and Red Hat Quay
Same weakness CWE-625 – Permissive Regular Expression
View allSame technique Privilege Escalation
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today