Is CVE-2026-3184 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-3184 being exploited in the wild.

How severe is CVE-2026-3184?

Low severity, with a CVSS score of 3.7, published 3 April 2026.

Which products and versions are affected?

Red Hat Hardened Images util-linux-main prior to 2.42-7.1.hum1.

Is there a fix for CVE-2026-3184?

A patch was published on 2026-04-09: Red Hat released security advisory RHSA-2026:7180 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-3184 attacked?

It is attacked over the network, in an operating system.

Am I affected by CVE-2026-3184?

Check whether you run Kernel Util-Linux, Red Hat Hardened Images or Redhat Hardened Images at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-3184: util-linux login access control bypass via hostname canonicalization

CVE-2026-3184 · Severity: low · CVSS 3.7 · Published 2026-04-03

A security flaw exists in a core Linux utility used for managing user logins. An attacker could potentially bypass certain security rules that restrict access based on where a user is connecting from. This could allow unauthorized access to systems that rely on specific network location rules for security.

Technologies: Kernel Util-Linux, Redhat Hardened Images. Vendors: Kernel, Red Hat, Redhat.

Quick answers

Is CVE-2026-3184 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-3184 being exploited in the wild.
How severe is CVE-2026-3184?: Low severity, with a CVSS score of 3.7, published 3 April 2026.
Which products and versions are affected?: Red Hat Hardened Images util-linux-main prior to 2.42-7.1.hum1.
Is there a fix for CVE-2026-3184?: A patch was published on 2026-04-09: Red Hat released security advisory RHSA-2026:7180 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-3184 attacked?: It is attacked over the network, in an operating system.
Am I affected by CVE-2026-3184?: Check whether you run Kernel Util-Linux, Red Hat Hardened Images or Redhat Hardened Images at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in the login(1) utility of util-linux due to improper hostname canonicalization when invoked with the -h option. The utility may modify the supplied remote hostname before setting the PAM_RHOST variable. An attacker can exploit this by providing a specially crafted hostname to bypass Pluggable Authentication Module (PAM) access control rules (such as pam_access) that rely on Fully Qualified Domain Names (FQDNs). Exploitation requires a remote login pathway that invokes login(1) with -h and a target system configured with host-based authorization rules. Red Hat has released updates for affected Hardened Images.

Affected products

kernel.org util-linux All versions prior to fix
Red Hat Red Hat Hardened Images util-linux-main prior to 2.42-7.1.hum1

Timeline

2026-02-25: other: Vulnerability reported to Red Hat Bugzilla
2026-04-03: disclosed: Initial public disclosure
2026-04-09: patched: Red Hat released security advisory RHSA-2026:7180

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.