flightctl EUVD-2026-80802

Requires a multi-tenant deployment of Red Hat Edge Manager / flightctl where the device-render worker concurrently renders devices for multiple organizations from a shared goroutine pool, and at least two tenants have configured HTTPS git repositories using per-repository TLS settings (InsecureSkipVerify, a custom CA bundle, or tenant-supplied mTLS client certificates). Exploitation is LIMITED by the non-deterministic nature of the race (AC:H) - the attacker cannot reliably control which tenant's config wins, it depends on scheduling and overlapping in-flight git.Clone timing; an authenticated tenant/org account able to define a repository is required (not remote-unauthenticated). Single-tenant or serialized-rendering deployments are not exposed.

The vendor CVSS of 6.6 (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:N) frames this correctly as a hard-to-control but high-impact cross-tenant confidentiality flaw, and I broadly agree with the shape while assessing PR:L rather than PR:H - configuring an HTTPS git repository only requires a normal authenticated organization/tenant user, not high privilege. The core signal is AC:H: the leak is a non-deterministic last-write-wins race on go-git's process-global client.Protocols map, so an attacker cannot reliably force their own or a victim's TLS config to win; it depends on goroutine scheduling and concurrent in-flight git.Clone timing. No EPSS score, no CISA KEV entry, and no public POC are present in the input, so exploitation status is 'no public exploit identified at time of analysis' - this is a design/concurrency defect reported by Red Hat rather than an actively exploited bug. Realistically this is a genuine multi-tenant isolation priority for hosted Red Hat Edge Manager / flightctl operators (mTLS client credentials and InsecureSkipVerify can cross tenant boundaries), but the low controllability and requirement for a specific concurrent multi-org rendering deployment keep real-world exploitability modest. No EPSS or SSVC data was supplied, so probabilistic and decision-framework signals cannot be cross-referenced.

In a multi-tenant Red Hat Edge Manager / flightctl deployment, two organizations each configure an HTTPS git repository - one supplying mTLS client certificates, another enabling InsecureSkipVerify. Because the device-render worker installs each per-repo tls.Config into go-git's process-global protocol map from a shared goroutine pool, whichever tenant's configuration is written last wins for all concurrent git.Clone calls, causing one tenant's mTLS credentials or relaxed TLS verification to be used for another tenant's git operation. No public exploit code is identified, and the leak is opportunistic rather than reliably attacker-driven (AC:H).