EUVD-2026-80802
GHSA-q6r7-r3xg-x977
Severity by source
AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:N
Authenticated tenant repo config is PR:L not PR:H; non-deterministic global-map race is AC:H; cross-tenant leak of mTLS creds is S:C/C:H with minor TLS-integrity I:L and no availability impact.
Primary rating from Vendor (redhat).
CVSS VectorNVD
Lifecycle Timeline
1DescriptionNVD
A flaw was found in flightctl. The configureRepoHTTPSClient() function in the device-render worker builds a per-repository tls.Config (which may include InsecureSkipVerify, a custom CA bundle, or tenant-supplied mTLS client certificates) and installs it into go-git's process-global client.Protocols map via gitclient.InstallProtocol("https", ...). Because the worker renders devices for multiple organizations concurrently from a shared goroutine pool, whichever tenant's repository configuration is written last wins for all in-flight git.Clone calls. This race condition can cause one tenant's TLS settings, including InsecureSkipVerify or mTLS client credentials, to leak into another tenant's git operations.
AnalysisAI
Cross-tenant TLS configuration leakage in flightctl (shipped as Red Hat Edge Manager 1 and embedded in Red Hat Advanced Cluster Management for Kubernetes 2) lets an authenticated organization user have their HTTPS git repository's TLS settings - potentially InsecureSkipVerify, a custom CA bundle, or their own mTLS client certificate - applied to another organization's concurrent git.Clone operations, because the device-render worker installs each per-repository tls.Config into go-git's process-global Protocols map. Exploitation requires a multi-tenant deployment that renders devices for several organizations concurrently from a shared goroutine pool and is inherently non-deterministic (AC:H) since the attacker cannot control which tenant's configuration wins; single-tenant or serialized-rendering deployments are not exposed. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a multi-tenant deployment of Red Hat Edge Manager / flightctl where the device-render worker concurrently renders devices for multiple organizations from a shared goroutine pool, and at least two tenants have configured HTTPS git repositories using per-repository TLS settings (InsecureSkipVerify, a custom CA bundle, or tenant-supplied mTLS client certificates). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS of 6.6 (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:N) frames this correctly as a hard-to-control but high-impact cross-tenant confidentiality flaw, and I broadly agree with the shape while assessing PR:L rather than PR:H - configuring an HTTPS git repository only requires a normal authenticated organization/tenant user, not high privilege. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch version was identified in the available intelligence at time of analysis - the two references provided (https://access.redhat.com/security/cve/CVE-2026-92615 and https://bugzilla.redhat.com/show_bug.cgi?id=2518323) are the tracking assets to monitor, and the correct fix is an upstream change to stop installing per-repository tls.Config objects into go-git's process-global Protocols map (for example, supplying a repository-scoped http.Client/transport to each Clone call, or holding a lock plus re-installing the correct config around every clone) - until that lands, apply compensating controls. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Cross-cluster remote code execution in Red Hat Advanced Cluster Management for Kubernetes 2 (multicloud-integrations / A
Cross-tenant bearer-token disclosure in Red Hat Advanced Cluster Management for Kubernetes 2 (RHACM) lets an authenticat
Unauthorized cross-tenant Secret and ConfigMap access in the multicloud-operators-channel component of Red Hat Advanced
Secret exfiltration across Kubernetes namespace boundaries in the multicloud-operators-subscription component of Red Hat
Privilege escalation in Red Hat Advanced Cluster Management for Kubernetes 2 lets a namespace-scoped tenant abuse the mu
Privilege escalation and cluster-wide arbitrary resource deployment affects the multicloud-operators-subscription compon
Privilege escalation in Red Hat Advanced Cluster Management's multicloud-operators-subscription controller lets a low-pr
Privilege escalation in Red Hat Advanced Cluster Management for Kubernetes 2 stems from the search-v2-operator being bou
Cross-cluster remote code execution in Red Hat Advanced Cluster Management for Kubernetes 2 (acm-search-v2-rhel9 search
Remote code execution as root on the Submariner gateway node is possible in cert-auth mode, affecting Submariner as bund
Cross-namespace Secret manipulation in the multicloud-operators-channel component of Red Hat Advanced Cluster Management
Command and SQL injection in Red Hat Advanced Cluster Management for Kubernetes 2 (acm-search-v2-rhel9) lets a privilege
Same weakness CWE-413 – Improper Resource Locking
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today