What is the CVSS score of EUVD-2026-18817?

EUVD-2026-18817 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.1%.

Is there a patch available for EUVD-2026-18817?

Yes, a patch is available for EUVD-2026-18817. Update the affected software to the latest version immediately.

Red Hat Enterprise Linux 10 EUVD-2026-18817

| CVE-2026-3184 MEDIUM

Authentication Bypass by Alternate Name (CWE-289)

2026-04-03 redhat

Authentication Bypass Red Hat Enterprise Linux 10 Red Hat Enterprise Linux 7 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 9 Red Hat Openshift Container Platform 4 Red Hat Hardened Images 1 Red Hat

5.3

CVSS 3.1 · NVD

View

Vulnerability Assessment

Weakness	CWE CWE-289 OWASP Top 10:2025 A07:2025 - Authentication Failures ASVS 5.0 V6 - Authentication Alternate name authentication
Impact	This vulnerability presents a low-to-moderate real-world risk despite its CVSS score of 3.7. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N) reveals critical constraints: the attack vector is network-based and requires no authentication, but the attack complexity is high, limiting the practical exploitability. The integrity impact is limited (I:L), and there is no confidentiality or availability impact. The high attack complexity suggests that successful exploitation depends on specific system configurations, PAM rule sets, and hostname canonicalization patterns that must be reverse-engineered per target. Absence of a public exploit code and lack of confirmed active exploitation (no CISA KEV listing) indicate this is not currently a weaponized threat. The vulnerability's utility is further constrained to environments where login(1) is invoked with the -h flag-a relatively uncommon direct administrative operation in modern deployments, though it may be used by legacy authentication infrastructure or custom scripts. Organizations relying on hostname-based PAM rules as a primary access control mechanism face the highest risk; those using additional authentication layers (multi-factor authentication, certificate-based access) are substantially mitigated.
Exploit ScenarioDerived	An attacker with network access to a system running a vulnerable version of util-linux could craft a specially formed hostname that, when passed to login(1) via the -h option, undergoes canonicalization in a way that matches an allowed FQDN in the target's PAM host-based access rules. For example, if PAM rules permit login from 'trusted.example.com', the attacker might provide a crafted hostname that canonicalizes to that FQDN despite originating from an untrusted source, thereby gaining unauthorized access to a user account. The high attack complexity suggests this requires detailed knowledge of the target's canonicalization behavior and PAM rule configuration, making opportunistic exploitation unlikely; however, targeted attacks against systems with known configurations could succeed. No public proof-of-concept code is currently available.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Apr 03, 2026

Improper hostname canonicalization in util-linux login(1) utility with the -h option allows remote attackers to bypass host-based PAM access control rules by supplying specially crafted hostnames that are modified before being passed to PAM_RHOST, potentially leading to unauthorized access. The vulnerability affects Red Hat Enterprise Linux 7 through 10 and related products; exploitation requires high attack complexity but no authentication or user interaction. No public exploit code has been identified, and this is not currently confirmed as actively exploited.

RemediationAI

Apply vendor-released patches from Red Hat for the affected util-linux package across all impacted RHEL versions (7, 8, 9, 10), Red Hat Hardened Images, and OpenShift Container Platform 4 installations. Consult https://access.redhat.com/security/cve/CVE-2026-3184 for version-specific patch availability and instructions. As a compensating control pending patching, restrict use of login(1) with the -h flag to trusted administrative contexts and review PAM configuration files (typically /etc/pam.d/) to identify rules that rely solely on hostname-based access decisions; implement additional authentication factors (such as certificate-based or multi-factor authentication) to reduce dependence on hostname canonicalization as a security boundary.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The util-linux login(1) utility is responsible for user authentication and session initialization on Unix-like systems. When invoked with the -h option to set a remote hostname, the utility performs hostname canonicalization before passing the result to PAM (Pluggable Authentication Modules) via the PAM_RHOST environment variable. The flaw (CWE-289: Authentication using Password with Weak Encryption) stems from improper canonicalization logic that modifies the supplied hostname in a way that diverges from the attacker's original input. Host-based PAM access control rules often rely on fully qualified domain names (FQDNs) for decision-making. An attacker who understands the canonicalization behavior can craft a hostname that, after transformation, matches an allowed FQDN in PAM rules when it should not, circumventing authentication policies. The CPE data indicates the vulnerability affects multiple versions of Red Hat Enterprise Linux (7, 8, 9, 10), Red Hat Hardened Images, and Red Hat OpenShift Container Platform 4.

Know when Red Hat Enterprise Linux 10 gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

SUSE 5.6 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Red Hat 3.7 LOW

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Severity Changed

Jul 21, 2026 - 19:22 NVD

LOW MEDIUM

CVSS changed

Jul 21, 2026 - 19:22 NVD

3.7 (LOW) 5.3 (MEDIUM)

CVE Published

Apr 03, 2026 - 18:43 nvd

LOW 3.7

DescriptionNVD

A flaw was found in util-linux. Improper hostname canonicalization in the login(1) utility, when invoked with the -h option, can modify the supplied remote hostname before setting PAM_RHOST. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.

Threat Intelligence Overview

EPSS Score

0.1%

Top 76% exploitable

Social Media

Sightings

Data Quality

7 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment Vendor CIRCL

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC No

EPSS 0.1%

Patch available Yes

Active threat No

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Human Impact· derived

Medium

Technical Impact

Partial

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +26

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Authentication Bypass CRITICAL

Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.

Affected Products (CPE)NVD

cpe:2.3:a:red_hat:red_hat_enterprise_linux_10:*:*:*:*:*:*:*:*

cpe:2.3:a:red_hat:red_hat_enterprise_linux_7:*:*:*:*:*:*:*:*

cpe:2.3:a:red_hat:red_hat_enterprise_linux_8:*:*:*:*:*:*:*:*

cpe:2.3:a:red_hat:red_hat_enterprise_linux_9:*:*:*:*:*:*:*:*

cpe:2.3:a:red_hat:red_hat_hardened_images_1:*:*:*:*:*:*:*:*

cpe:2.3:a:red_hat:red_hat_openshift_container_platform_4:*:*:*:*:*:*:*:*

More in Red Hat Enterprise Linux 10

View all

CVE-2026-18663 MEDIUM This Month

5.9 Aug 12

Heap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash

CVE-2026-4631 CRITICAL Act Now POC

9.8 Apr 07

Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h

CVE-2026-4480 CRITICAL Act Now POC

9.0 May 26

Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft

CVE-2026-101258 HIGH This Week POC

7.8 Oct 06

Ghostscript can execute arbitrary shell commands with the privileges of its process when it renders a crafted PostScript

CVE-2026-96889 HIGH This Week POC

7.8 Sep 23

Use-after-free in librsvg during rendering of crafted SVG documents with nested XInclude directives and duplicate entity

CVE-2026-4775 HIGH This Week POC

7.8 Mar 24

A signed integer overflow vulnerability exists in the libtiff library's putcontig8bitYCbCr44tile function that leads to

CVE-2026-114406 MEDIUM This Month POC

6.8 Oct 21

The system CA trust store shipped in Red Hat's ca-certificates RPM packages includes eMudhra root authorities that signe

CVE-2026-18922 CRITICAL Act Now

9.8 Sep 07

Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo

CVE-2026-14544 CRITICAL Act Now

9.8 Jul 03

Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter

CVE-2026-76578 CRITICAL Act Now

9.8 Sep 07

Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a

CVE-2026-102560 CRITICAL Act Now

9.8 Sep 29

A heap buffer overflow exists in libsoup's WebSocket permessage-deflate compression path: when a very large outbound mes

CVE-2026-5121 HIGH Act Now

7.5 Mar 30

Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe

Same weakness CWE-289 – Authentication Bypass by Alternate Name

View all

CVE-2021-34746 CRITICAL POC

9.8

CVE-2024-56511 CRITICAL POC

9.3

CVE-2023-38487 HIGH POC

8.2

CVE-2026-57176 MEDIUM POC

6.8

CVE-2025-13613 CRITICAL

9.8

CVE-2026-15980 CRITICAL

9.8

CVE-2026-8457 CRITICAL

9.8

CVE-2026-76183 CRITICAL

9.8

Same technique Authentication Bypass

View all

CVE-2015-3306 CRITICAL POC

10.0

CVE-2023-22515 CRITICAL POC

9.8

CVE-2012-4681 CRITICAL POC

9.8

CVE-2013-2465 CRITICAL POC

9.8

CVE-2011-3544 CRITICAL POC

9.8

CVE-2022-40684 CRITICAL POC

9.8

CVE-2025-61882 CRITICAL POC

9.8

CVE-2024-0012 CRITICAL POC

9.3

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
Container bci/bci-base-fips:15.7-18.15 Container bci/bci-init:15.7-50.21 Container bci/bci-sle15-kernel-module-devel:15.7-57.21 Container bci/openjdk-devel:17.0.18.0-18.22 Container bci/openjdk-devel:21.0.10.0-22.22 Container bci/openjdk-devel:25.0.2.0-6.21 Container bci/ruby:2.5-23.20 Container bci/ruby:3.4-22.20 Container private-registry/1.2/harbor-registry:1.2.0-1.8 Container private-registry/1.2/harbor-registryctl:1.2.0-1.8 Container private-registry/harbor-registry:2.8.3-1.6 Container private-registry/harbor-registryctl:latest Container suse/kea:2.6-75.16 Container suse/kiosk/firefox-esr:140.9-71.23 Container suse/kiosk/pulseaudio:17.0-69.18 Container suse/kiosk/xorg-client:latest Container suse/kiosk/xorg:21.1-77.1 Container suse/mariadb:11.8.6-73.18 Container suse/multi-linux-manager/5.1/x86_64/proxy-httpd:5.1.3.8.18.1 Container suse/multi-linux-manager/5.1/x86_64/proxy-salt-broker:5.1.3.9.16.1 Container suse/multi-linux-manager/5.1/x86_64/server-hub-xmlrpc-api:5.1.3.8.16.1 Container suse/multi-linux-manager/5.1/x86_64/server-saline:5.1.3.9.16.1 Container suse/multi-linux-manager/5.1/x86_64/server:5.1.3.8.16.1 Container suse/postgres:16.13-85.20 Container suse/postgres:16.14 Container suse/postgres:17.10 Container suse/postgres:17.9-75.20 Container suse/postgres:18.3-65.20 Container suse/rmt-server:2.26-79.16 Container suse/sle15:15.7-5.17.21 Container third-party/amd/amdgpu-driver:sles-15.7-30.20.1 Container third-party/amd/amdgpu-driver:sles-15.7-30.30.3 Container third-party/amd/amdgpu-driver:sles-15.7-30.30.4 Container third-party/amd/amdgpu-driver:sles-15.7-31.10 Container third-party/amd/amdgpu-driver:sles-15.7-31.20 Container third-party/amd/amdgpu-driver:sles-15.7-31.30 Image proxy-httpd-image Image server-hub-xmlrpc-api-image Image server-image-sles15sp7 Image server-saline-image	Affected
Container bci/php-apache:8.3.29-20.20 Container bci/python:3.11.15-82.11 Container bci/python:3.13.13-85.11 Container suse/multi-linux-manager/5.1/x86_64/server-migration-14-16:5.1.3.8.16.1 Image proxy-salt-broker-image Image server-database-migration-image	Affected
Container rancher/seedimage-builder:latest Image SLES-Azure-3P Image SLES-Azure-Basic Image SLES-Azure-Standard Image SLES-BYOS-Azure Image SLES-BYOS-EC2 Image SLES-BYOS-GCE Image SLES-CHOST-BYOS-Aliyun Image SLES-CHOST-BYOS-Azure Image SLES-CHOST-BYOS-EC2 Image SLES-CHOST-BYOS-GCE Image SLES-CHOST-BYOS-GDC Image SLES-CHOST-BYOS-SAP-CCloud Image SLES-EC2 Image SLES-EC2-ECS Image SLES-GCE Image SLES-GCE-3P Image SLES-Hardened-BYOS-Azure Image SLES-Hardened-BYOS-EC2 Image SLES-Hardened-BYOS-GCE	Affected
Container suse/ltss/sle15.6/bci-base-fips:15.6-35.58 Container suse/ltss/sle15.6/sle15:15.6-5.48 Container suse/manager/5.0/x86_64/proxy-httpd:5.0.8.7.35.3 Container suse/manager/5.0/x86_64/proxy-salt-broker:5.0.8.7.37.3 Container suse/manager/5.0/x86_64/server-hub-xmlrpc-api:5.0.8.6.35.1 Container suse/manager/5.0/x86_64/server:latest	Affected
Container suse/manager/5.0/x86_64/server-migration-14-16:5.0.8.7.35.1	Affected

References

Advisories & patches

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back