# CVE-2026-3184: util-linux login access control bypass via hostname canonicalization

Source: https://junglewise.ai/threats/cve-2026-3184-util-linux-login-access-control-bypass-via-hostname  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-03. Updated: 2026-07-21  
License: CC BY 4.0 with a link back

CVE-2026-3184 · Severity: low · CVSS 3.7 · Published 2026-04-03

A security flaw exists in a core Linux utility used for managing user logins. An attacker could potentially bypass certain security rules that restrict access based on where a user is connecting from. This could allow unauthorized access to systems that rely on specific network location rules for security.

Technologies: [Kernel Util-Linux](https://junglewise.ai/threats/technologies/util-linux), [Redhat Hardened Images](https://junglewise.ai/threats/technologies/hardened-images). Vendors: [Kernel](https://junglewise.ai/threats/vendors/kernel), [Red Hat](https://junglewise.ai/threats/vendors/red-hat), [Redhat](https://junglewise.ai/threats/vendors/redhat).

## Quick answers

**Is CVE-2026-3184 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-3184 being exploited in the wild.

**How severe is CVE-2026-3184?** Low severity, with a CVSS score of 3.7, published 3 April 2026.

**Which products and versions are affected?** Red Hat Hardened Images util-linux-main prior to 2.42-7.1.hum1.

**Is there a fix for CVE-2026-3184?** A patch was published on 2026-04-09: Red Hat released security advisory RHSA-2026:7180 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-3184 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-2026-3184?** Check whether you run Kernel Util-Linux, Red Hat Hardened Images or Redhat Hardened Images at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists in the login(1) utility of util-linux due to improper hostname canonicalization when invoked with the -h option. The utility may modify the supplied remote hostname before setting the PAM_RHOST variable. An attacker can exploit this by providing a specially crafted hostname to bypass Pluggable Authentication Module (PAM) access control rules (such as pam_access) that rely on Fully Qualified Domain Names (FQDNs). Exploitation requires a remote login pathway that invokes login(1) with -h and a target system configured with host-based authorization rules. Red Hat has released updates for affected Hardened Images.

## Affected products

- kernel.org util-linux All versions prior to fix
- Red Hat Red Hat Hardened Images util-linux-main prior to 2.42-7.1.hum1

## Timeline

- 2026-02-25: other: Vulnerability reported to Red Hat Bugzilla
- 2026-04-03: disclosed: Initial public disclosure
- 2026-04-09: patched: Red Hat released security advisory RHSA-2026:7180

## References

- [https://catalog.redhat.com/software/containers/](https://catalog.redhat.com/software/containers/)
- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)
- [https://access.redhat.com/errata/RHSA-2026:7180](https://access.redhat.com/errata/RHSA-2026:7180)
- [https://access.redhat.com/security/cve/CVE-2026-3184](https://access.redhat.com/security/cve/CVE-2026-3184)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2442570](https://bugzilla.redhat.com/show_bug.cgi?id=2442570)

## Related threats

- [A flaw was found in libkcapi. A local attacker can influence an application that uses the Asynchronous Input/Output…](https://junglewise.ai/threats/cve-2026-71227-a-flaw-was-found-in-libkcapi-a-local-attacker-can-influence-an)
- [Memory Corruption via Uncanceled AIO Requests on Error: libkcapi's one-shot AIO path can return an error before all…](https://junglewise.ai/threats/cve-2026-71226-memory-corruption-via-uncanceled-aio-requests-on-error-libkcapi-s)
- [A flaw was found in libkcapi. When performing one-shot symmetric cipher operations on large inputs (over 64 KiB) in…](https://junglewise.ai/threats/cve-2026-71225-a-flaw-was-found-in-libkcapi-when-performing-one-shot-symmetric)
- [GnuTLS NULL pointer dereference in PSK binder verification](https://junglewise.ai/threats/cve-2026-1584-gnutls-null-pointer-dereference-in-psk-binder-verification)
- [libssh insecure default configuration on Windows](https://junglewise.ai/threats/cve-2025-14821-libssh-insecure-default-configuration-on-windows)