Executive brief
flightctl is a fleet management tool used by Red Hat to manage device configurations across multiple organizations. A race condition in the device-render worker can cause one tenant's TLS security settings—including client certificates and certificate verification settings—to inadvertently leak into another tenant's git operations, potentially exposing credentials or allowing security bypasses. This risk is highest in multi-tenant deployments where multiple organizations use git-backed configuration providers simultaneously.
Technical details
The vulnerability is a race condition (CWE-413) in the configureRepoHTTPSClient() function of flightctl's device-render worker. The function builds per-repository tls.Config objects (which may contain InsecureSkipVerify, custom CA bundles, or mTLS client certificates) and installs them into go-git's process-global client.Protocols map via gitclient.InstallProtocol("https", ...). Since the worker processes devices for multiple tenants concurrently from a shared goroutine pool, whichever tenant's repository configuration is written last overwrites the global setting for all in-flight git.Clone calls, causing credential and TLS setting leakage between tenants. Exploitation requires a multi-tenant deployment, fleet administrator privileges to create Repository resources with custom TLS settings, control of an external git server, and winning a race condition. The attack vector is network-based and no user interaction is required. Single-organization deployments are not affected because all users hold equivalent privileges.
Affected products
- Red Hat flightctl <UNKNOWN>
Timeline
- 2026-09-16: disclosed