NooBaa CVE-2026-86330

Requires authenticated access with NooBaa administrative privileges (PR:H) to reach the cluster_internal_api set_hostname_internal function; the attacker must supply a hostname value containing shell metacharacters that is passed unsanitized to a shell command. Exploitation is limited by the need for pre-existing admin credentials on the Multi-Cloud Object Gateway, so it is not exploitable against default unauthenticated exposure. Realized impact is bounded by the privileges of the NooBaa process context (typically the NooBaa pod in an OpenShift Data Foundation deployment) rather than guaranteed node-level root.

This is a genuine but access-gated vulnerability. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 7.2) describes network-reachable, low-complexity exploitation with full CIA impact, but crucially requires PR:H - the description confirms an 'authenticated attacker with administrative privileges'. That admin-only prerequisite is the single largest risk-limiting factor: an attacker already holding NooBaa administrative credentials is a high-trust actor, so this is more a privilege-boundary/defense-in-depth failure than a mass-exploitable perimeter flaw. No EPSS score, no CISA KEV listing, and no public exploit are present in the provided data, so exploitation status is 'no public exploit identified at time of analysis'. There are no conflicting signals here - the CVSS network vector is consistent with the description (the API is remotely reachable), and the auth requirement is explicitly stated in both. The main uncertainty is real-world impact scope: the description says commands run 'on the host system with the privileges of the NooBaa process', which in a containerized OpenShift Data Foundation deployment typically means the NooBaa pod's service context rather than the bare-metal node - verify whether container escape or elevated pod privileges extend this to node compromise. Overall a real, patch-worthy issue but a low-to-moderate operational priority given the administrative-authentication barrier and absence of exploitation evidence.

An attacker who has obtained NooBaa administrative credentials (or an over-privileged operator abusing access) invokes the cluster_internal_api set_hostname_internal call and supplies a hostname value containing shell metacharacters (e.g. ; or backticks). Because the parameter is passed unsanitized into a shell command, the injected commands execute with the privileges of the NooBaa process. No public proof-of-concept is identified in the provided data.