Quick answers
- Is CVE-2026-115424 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-115424 being exploited in the wild.
- How severe is CVE-2026-115424?
- Medium severity, with a CVSS score of 5.5, published 22 October 2026.
- Which products and versions are affected?
- Red Hat OpenShift <UNKNOWN>.
- Is there a fix for CVE-2026-115424?
- No fixed version is recorded yet. Only extract container images from trusted registries and publishers you control or have verified. Run `oc image extract` as an unprivileged user into a dedicated, isolated destination directory, and avoid fixed or predictable destination paths in automated or CI pipelines. Restrict access to the container image references consumed by automated extraction jobs.</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-22"}] If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-115424 attacked?
- It is attacked with local access, in a web application.
- Am I affected by CVE-2026-115424?
- Check whether you run Red Hat OpenShift at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
Only extract container images from trusted registries and publishers you control or have verified. Run `oc image extract` as an unprivileged user into a dedicated, isolated destination directory, and avoid fixed or predictable destination paths in automated or CI pipelines. Restrict access to the container image references consumed by automated extraction jobs.</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-22"}]
Technical details
The vulnerability is a path traversal flaw (CWE-61) in the `oc image extract` command where symlink and hardlink targets are validated using string-prefix comparison rather than proper path-boundary checking. An attacker can craft a malicious container image with links pointing to absolute paths or relative paths matching the destination directory name as a text prefix to bypass validation, then chain file entries that traverse the planted link to write arbitrary content outside the extraction directory. This requires local access to a system where a user runs the command against an untrusted or compromised container image.
Affected products
- Red Hat OpenShift <UNKNOWN>