Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-16445— Dracut: dracut: root code execution via dhcp options command injection in networkmanager initrd module

Quick assessment

Affected
Red Hat Red Hat Enterprise Linux 8
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

dracut project dracut是dracut project团队开源的一个Linux内核initramfs生成工具。 dracutdevs dracut存在命令注入漏洞，该漏洞源于基于NetworkManager的initrd网络模块对特制DHCP选项处理不当，未正确转义就写入临时shell脚本，导致命令注入，使得相邻网络的远程攻击者可在系统启动期间在initramfs中实现root代码执行。

CVSS 7.5 · High EPSS 1.12% · P65

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 13

VendorProduct Version RangeStatus
Red Hat Red Hat Enterprise Linux 10 any unaffected
Red Hat Red Hat Enterprise Linux 6 any unaffected
Red Hat Red Hat Enterprise Linux 7 any unaffected
Red Hat Red Hat Enterprise Linux 8 0:049-244.git20260529.el8_10< * unaffected
Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support 0:049-138.git20220131.el8_4.1< * unaffected
Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On 0:049-138.git20220131.el8_4.1< * unaffected
Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support 0:049-203.git20220511.el8_6.1< * unaffected
Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On 0:049-203.git20220511.el8_6.1< * unaffected
Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service 0:049-223.git20230119.el8_8.1< * unaffected
Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions 0:049-223.git20230119.el8_8.1< * unaffected
Red Hat Red Hat Enterprise Linux 9 any unaffected
Red Hat Red Hat Hardened Images 109-7.hum1< * unaffected
Red Hat Red Hat OpenShift Container Platform 4 any affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-16445

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Dracut: dracut: root code execution via dhcp options command injection in networkmanager initrd module
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP options, such as a malicious root-path, next-server, or bootfile name, to a system using dracut's NetworkManager-based initrd network module. These options are improperly handled and written into a temporary shell script without proper escaping, leading to command injection. This allows the attacker to achieve root code execution within the initramfs during system boot.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
OS命令中使用的特殊元素转义处理不恰当(OS命令注入)
Source: CVE Program / CVE List V5
Vulnerability Title
dracutdevs dracut 命令注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
dracut project dracut是dracut project团队开源的一个Linux内核initramfs生成工具。 dracutdevs dracut存在命令注入漏洞，该漏洞源于基于NetworkManager的initrd网络模块对特制DHCP选项处理不当，未正确转义就写入临时shell脚本，导致命令注入，使得相邻网络的远程攻击者可在系统启动期间在initramfs中实现root代码执行。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Red Hat Red Hat Enterprise Linux 8 0:049-244.git20260529.el8_10 ~ * cpe:/o:redhat:enterprise_linux:8::baseos
Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support 0:049-138.git20220131.el8_4.1 ~ * cpe:/o:redhat:rhel_aus:8.4::baseos
Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On 0:049-138.git20220131.el8_4.1 ~ * cpe:/o:redhat:rhel_aus:8.4::baseos
Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support 0:049-203.git20220511.el8_6.1 ~ * cpe:/o:redhat:rhel_aus:8.6::baseos
Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On 0:049-203.git20220511.el8_6.1 ~ * cpe:/o:redhat:rhel_aus:8.6::baseos
Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service 0:049-223.git20230119.el8_8.1 ~ * cpe:/o:redhat:rhel_e4s:8.8::baseos
Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions 0:049-223.git20230119.el8_8.1 ~ * cpe:/o:redhat:rhel_e4s:8.8::baseos
Red Hat Red Hat Hardened Images 109-7.hum1 ~ * cpe:/a:redhat:hummingbird:1
Red Hat Red Hat Enterprise Linux 10 - cpe:/o:redhat:enterprise_linux:10
Red Hat Red Hat Enterprise Linux 6 - cpe:/o:redhat:enterprise_linux:6
Red Hat Red Hat Enterprise Linux 7 - cpe:/o:redhat:enterprise_linux:7
Red Hat Red Hat Enterprise Linux 9 - cpe:/o:redhat:enterprise_linux:9
Red Hat Red Hat OpenShift Container Platform 4 - cpe:/a:redhat:openshift:4

II. Public POCs for CVE-2026-16445

# POC Description Source Link Shenlong Link
AI-Generated POC Premium
Qwen3.6-35B-A3B · 7133 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month

III. Intelligence Information for CVE-2026-16445

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-16445 (1)

Vendor Advisories for CVE-2026-16445 (8)

Same Patch Batch · Red Hat · 2026-07-21 · 20 CVEs total

CVE-2026-59851 8.8 HIGH Libssh: libssh: authentication bypass via missing gssapi principal check
CVE-2026-16493 7.8 HIGH Ansible-core: argument injection in ansible-galaxy collection install via git clone (incom
CVE-2026-15927 6.8 MEDIUM Quay: mirror-registry: ssrf: repo-level mirror accepts external_reference without url vali
CVE-2026-15370 6.7 MEDIUM Libssh: libssh: stack buffer overflow in sftp server longname construction
CVE-2026-59843 6.5 MEDIUM Libssh: libssh: denial of service via zero advertised channel packet size
CVE-2026-16461 6.5 MEDIUM Rpcbind: rpcbind: stack buffer overflow in rpcinfo rpcbdump() short-mode version-list form
CVE-2026-59844 6.5 MEDIUM Libssh: libssh: denial of service via oversized sftp read length
CVE-2026-59847 5.9 MEDIUM Libssh: libssh: integrity downgrade via openssl aes-gcm tag verification
CVE-2026-15811 5.8 MEDIUM Kronosnet: kronosnet: encryption key exposure in memory after cryptographic configuration
CVE-2026-59845 5.3 MEDIUM Libssh: libssh: denial of service via unchecked proxycommand fork() failure
CVE-2026-59848 5.3 MEDIUM Libssh: libssh: denial of service via sftp responses with unknown request ids
CVE-2026-15812 4.8 MEDIUM Kronosnet: kronosnet: access control list bypass via link id spoofing on unencrypted dynam
CVE-2026-59850 4.3 MEDIUM Libssh: libssh: use-after-free via data callbacks on closed channels
CVE-2026-12548 4.2 MEDIUM Libsoup: heap out-of-bounds read in libsoup due to integer truncation
CVE-2026-59846 3.9 LOW Libssh: libssh: information disclosure via proxycommand %r username expansion
CVE-2026-59842 3.7 LOW Libssh: libssh: information disclosure via short gssapi curve25519 public key
CVE-2026-12547 3.4 LOW Libsoup: information disclosure in libsoup via soupauthmanager proxy credential leak on pr
CVE-2026-59849 3.1 LOW Libssh: libssh: denial of service via automatic certificate authentication loop
CVE-2026-16517 2.9 LOW Libarchive: libarchive: signed integer overflow in archive_write_zip_header

IV. Related Vulnerabilities

Same product: Red Hat Enterprise Linux 8
Same vendor: Red Hat
Same weakness: CWE-78

V. Comments for CVE-2026-16445

No comments yet

Leave a comment