What is the CVSS score of CVE-2026-28676?

CVE-2026-28676 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Opensift are affected by CVE-2026-28676?

OpenShift deployments running versions prior to 1.6.3-alpha face a HIGH severity path-injection vulnerability that could allow attackers to read, write, or delete arbitrary files on affected systems.

How to fix or mitigate CVE-2026-28676?

Within 24 hours: Inventory all OpenShift instances and identify those running versions below 1.6.3-alpha; isolate affected systems from untrusted networks if possible. Within 7 days: Implement network segmentation to restrict access to OpenShift APIs; enable detailed logging and monitoring for file operation anomalies. Within 30 days: Upgrade to version 1.6.3-alpha or later once available; conduct forensic review of file access logs for signs of exploitation.

Opensift CVE-2026-28676

HIGH

Path Traversal (CWE-22)

2026-03-06 security-advisories@github.com

Path Traversal Opensift

8.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 06, 2026 - 05:16 nvd

HIGH 8.8

DescriptionGitHub Advisory

OpenSift is an AI study tool that sifts through large datasets using semantic search and generative AI. Prior to version 1.6.3-alpha, multiple storage helpers used path construction patterns that did not uniformly enforce base-directory containment. This created path-injection risk in file read/write/delete flows if malicious path-like values were introduced. This issue has been patched in version 1.6.3-alpha.

AnalysisAI

OpenShift versions prior to 1.6.3-alpha contain a path traversal vulnerability in multiple storage helpers that fail to properly validate directory boundaries, allowing authenticated attackers to read, write, or delete arbitrary files on the system. An attacker with valid credentials can exploit insufficient path sanitization to escape the intended base directory and access sensitive data or modify system files. No patch is currently available for affected versions.

Technical ContextAI

This vulnerability (CWE-22: Path Traversal) affects OpenSift is an AI study tool that sifts through large datasets using semantic search and generative AI.. OpenSift is an AI study tool that sifts through large datasets using semantic search and generative AI. Prior to version 1.6.3-alpha, multiple storage helpers used path construction patterns that did not uniformly enforce base-directory containment. This created path-injection risk in file read/write/delete flows if malicious path-like values were introduced. This issue has been patched in version 1.6.3-alpha.