CVE-2026-86330

Noobaa-core: noobaa-core: os command injection in cluster_internal_api.set_hostname_internal

CVSS 3.1 7.2 HIGHCheck source for fixed versionsKEV status unknown

Original advisory

Historical advisory recorded 23 Oct 2026 15:48:27 UTC. Read the latest advisory.

cve-program · CVE-2026-86330

Published

An OS command injection flaw was found in the set_hostname_internal function of NooBaa's cluster_internal_api. This component is responsible for managing the Multi-Cloud Object Gateway in OpenShift Data Foundation. The vulnerability occurs because the hostname parameter is passed directly to a shell command without proper sanitization. An authenticated attacker with administrative privileges can provide a specially crafted hostname containing shell metacharacters to execute arbitrary commands on the host system with the privileges of the NooBaa process.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-86330

Published

odf4/mcg-core-rhel9

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Openshift Data Foundation 4",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "odf4/mcg-core-rhel9",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:openshift_data_foundation:4"
                    ]
                }

rhceph-dev/odf4-mcg-core-rhel9

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Openshift Data Foundation 4",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "rhceph-dev/odf4-mcg-core-rhel9",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:openshift_data_foundation:4"
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON