CVE-2026-86330— Noobaa-core: noobaa-core: os command injection in cluster_internal_api.set_hostname_internal
Quick assessment
Affected
Red Hat Red Hat Openshift Data Foundation 4
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 NooBaa 的 中的 函数发现了一个操作系统命令注入漏洞。该组件负责管理 OpenShift Data Foundation 中的多云对象网关。此漏洞的发生是因为 参数未经过适当的净化处理，直接传入了 shell 命令中。拥有管理员权限的经过身份验证的攻击者可以提供包含 shell 元字符的特制 ，从而以 NooBaa 进程的权限在宿主系统上执行任意命令。
Possible ATT&CK Techniques 1 AI
T1059 · Command and Scripting Interpreter
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-86330
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Noobaa-core: noobaa-core: os command injection in cluster_internal_api.set_hostname_internal
Source: CVE Program / CVE List V5
Vulnerability Description
An OS command injection flaw was found in the set_hostname_internal function of NooBaa's cluster_internal_api. This component is responsible for managing the Multi-Cloud Object Gateway in OpenShift Data Foundation. The vulnerability occurs because the hostname parameter is passed directly to a shell command without proper sanitization. An authenticated attacker with administrative privileges can provide a specially crafted hostname containing shell metacharacters to execute arbitrary commands on the host system with the privileges of the NooBaa process.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
OS命令中使用的特殊元素转义处理不恰当(OS命令注入)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Red Hat | Red Hat Openshift Data Foundation 4 | - |
cpe:/a:redhat:openshift_data_foundation:4
|
|
| Red Hat | Red Hat Openshift Data Foundation 4 | - |
cpe:/a:redhat:openshift_data_foundation:4
|
|
II. Public POCs for CVE-2026-86330
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-86330
请登录查看更多情报信息。
Other References for CVE-2026-86330 (2)
Same Patch Batch · Red Hat · 2026-09-28 · 3 CVEs total
| CVE-2026-101292 | 8.2 HIGH | Artemis-core-client: unsafe reflection in apache activemq artemis federation message deser |
| CVE-2026-101333 | 3.7 LOW | Keycloak-services: keycloak-services: unbounded metric series creation via idp tag on brok |
IV. Related Vulnerabilities
Same vendor: Red Hat
-
CVE-2026-101333
Keycloak-services: keycloak-services: unbounded metric serie -
CVE-2026-101292
Artemis-core-client: unsafe reflection in apache activemq ar -
CVE-2026-96284
Flatpak: flatpak: arbitrary read-access to files in the syst -
CVE-2026-96282
Flatpak: flatpak: extension metadata path traversal file exi -
CVE-2026-96283
Flatpak: flatpak: flatpak-system-helper cross-user cancelpul
Same weakness: CWE-78
-
CVE-2026-4556
macOS Exam4 Local Privilege Escalation via Command Injection -
CVE-2026-101072
Netcore NR289-GE CGI ap_ip.cgi system os command injection -
CVE-2026-78424
OS Command Injection in Packet-Capture (Sniffer) Filter lead -
CVE-2026-91006
Apache Karaf: OS Command Injection in Child-Instance Launch -
CVE-2026-86530
BUFFALO Wi-Fi产品命令注入漏洞
V. Comments for CVE-2026-86330
No comments yet