{"schema":"vulnpedia.research/1","cve":"CVE-2026-115424","generated":"2026-10-26T13:52:32.101Z","references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-115424","tags":["vdb-entry","x_refsource_REDHAT","vendor-reference"],"source":"mitre","sourceId":"redhat","modified":"2026-10-22T21:12:27.259Z","origins":[{"source":"mitre","sourceId":"redhat","modified":"2026-10-22T21:12:27.259Z","url":"https://access.redhat.com/security/cve/CVE-2026-115424"},{"source":"nvd","sourceId":"CVE-2026-115424","modified":"2026-10-23T16:44:17.950","url":"https://access.redhat.com/security/cve/CVE-2026-115424"},{"source":"redhat","sourceId":"CVE-2026-115424","modified":"2026-10-23T00:37:56+00:00","url":"https://access.redhat.com/security/cve/CVE-2026-115424"}]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2558338","tags":["issue-tracking","x_refsource_REDHAT","vendor-reference"],"source":"mitre","sourceId":"redhat","modified":"2026-10-22T21:12:27.259Z","origins":[{"source":"mitre","sourceId":"redhat","modified":"2026-10-22T21:12:27.259Z","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2558338"},{"source":"nvd","sourceId":"CVE-2026-115424","modified":"2026-10-23T16:44:17.950","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2558338"},{"source":"redhat","sourceId":"CVE-2026-115424","modified":"2026-10-23T00:37:56+00:00","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2558338"}]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-115424.json","tags":["vendor-advisory"],"source":"redhat","sourceId":"CVE-2026-115424","modified":"2026-10-23T00:37:56+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-115424","modified":"2026-10-23T00:37:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-115424.json"}]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-115424","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-115424","modified":"2026-10-23T00:37:56+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-115424","modified":"2026-10-23T00:37:56+00:00","url":"https://www.cve.org/CVERecord?id=CVE-2026-115424"}]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115424","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-115424","modified":"2026-10-23T00:37:56+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-115424","modified":"2026-10-23T00:37:56+00:00","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115424"}]},{"source":"euvd","sourceId":"EUVD-2026-108515","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-108515","tags":["ADVISORY"],"origins":[{"source":"euvd","sourceId":"EUVD-2026-108515","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-108515"}]}],"packages":[],"pocCandidates":[],"cataloguedPoc":[],"vendorStatements":[{"source":"redhat","sourceId":"CVE-2026-115424","modified":"2026-10-23T00:37:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-115424.json","productId":"red_hat_openshift_container_platform_4:openshift-clients","product":"openshift-clients as a component of Red Hat OpenShift Container Platform 4","status":"known_affected","remediations":[{"category":"workaround","details":"Treat container images as trusted inputs when using oc image extract. Do not extract images from registries or publishers you do not control or have not verified.\n\nWhere possible, run oc image extract as an unprivileged user and into a dedicated, isolated destination directory, and avoid fixed/predictable destination paths in automated or CI pipelines. Restrict who can modify the image references that automated extraction jobs consume.\n\nThere is no configuration option to disable only this link-extraction behavior. Apply updated oc client packages or rebuilt platform images when Red Hat publishes them for your product and stream."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/openshift-clients","origins":[{"source":"redhat","sourceId":"CVE-2026-115424","modified":"2026-10-23T00:37:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-115424.json"}]},{"source":"redhat","sourceId":"CVE-2026-115424","modified":"2026-10-23T00:37:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-115424.json","productId":"red_hat_openshift_container_platform_4:openshift-clients-redistributable","product":"openshift-clients-redistributable as a component of Red Hat OpenShift Container Platform 4","status":"known_affected","remediations":[{"category":"workaround","details":"Treat container images as trusted inputs when using oc image extract. Do not extract images from registries or publishers you do not control or have not verified.\n\nWhere possible, run oc image extract as an unprivileged user and into a dedicated, isolated destination directory, and avoid fixed/predictable destination paths in automated or CI pipelines. Restrict who can modify the image references that automated extraction jobs consume.\n\nThere is no configuration option to disable only this link-extraction behavior. Apply updated oc client packages or rebuilt platform images when Red Hat publishes them for your product and stream."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/openshift-clients-redistributable","origins":[{"source":"redhat","sourceId":"CVE-2026-115424","modified":"2026-10-23T00:37:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-115424.json"}]},{"source":"redhat","sourceId":"CVE-2026-115424","modified":"2026-10-23T00:37:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-115424.json","productId":"red_hat_openshift_container_platform_4:openshift-clients.src","product":"openshift-clients.src as a component of Red Hat OpenShift Container Platform 4","status":"known_affected","remediations":[{"category":"workaround","details":"Treat container images as trusted inputs when using oc image extract. Do not extract images from registries or publishers you do not control or have not verified.\n\nWhere possible, run oc image extract as an unprivileged user and into a dedicated, isolated destination directory, and avoid fixed/predictable destination paths in automated or CI pipelines. Restrict who can modify the image references that automated extraction jobs consume.\n\nThere is no configuration option to disable only this link-extraction behavior. Apply updated oc client packages or rebuilt platform images when Red Hat publishes them for your product and stream."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/openshift-clients?arch=src","origins":[{"source":"redhat","sourceId":"CVE-2026-115424","modified":"2026-10-23T00:37:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-115424.json"}]},{"source":"redhat","sourceId":"CVE-2026-115424","modified":"2026-10-23T00:37:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-115424.json","productId":"red_hat_openshift_container_platform_4:openshift/ose-rhel-coreos-8","product":"openshift/ose-rhel-coreos-8 as a component of Red Hat OpenShift Container Platform 4","status":"known_affected","remediations":[{"category":"workaround","details":"Treat container images as trusted inputs when using oc image extract. Do not extract images from registries or publishers you do not control or have not verified.\n\nWhere possible, run oc image extract as an unprivileged user and into a dedicated, isolated destination directory, and avoid fixed/predictable destination paths in automated or CI pipelines. Restrict who can modify the image references that automated extraction jobs consume.\n\nThere is no configuration option to disable only this link-extraction behavior. Apply updated oc client packages or rebuilt platform images when Red Hat publishes them for your product and stream."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:oci/ose-rhel-coreos-8?repository_url=registry.redhat.io/openshift/ose-rhel-coreos-8","origins":[{"source":"redhat","sourceId":"CVE-2026-115424","modified":"2026-10-23T00:37:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-115424.json"}]},{"source":"redhat","sourceId":"CVE-2026-115424","modified":"2026-10-23T00:37:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-115424.json","productId":"red_hat_openshift_container_platform_4:openshift/ose-rhel-coreos-9","product":"openshift/ose-rhel-coreos-9 as a component of Red Hat OpenShift Container Platform 4","status":"known_affected","remediations":[{"category":"workaround","details":"Treat container images as trusted inputs when using oc image extract. Do not extract images from registries or publishers you do not control or have not verified.\n\nWhere possible, run oc image extract as an unprivileged user and into a dedicated, isolated destination directory, and avoid fixed/predictable destination paths in automated or CI pipelines. Restrict who can modify the image references that automated extraction jobs consume.\n\nThere is no configuration option to disable only this link-extraction behavior. Apply updated oc client packages or rebuilt platform images when Red Hat publishes them for your product and stream."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:oci/ose-rhel-coreos-9?repository_url=registry.redhat.io/openshift/ose-rhel-coreos-9","origins":[{"source":"redhat","sourceId":"CVE-2026-115424","modified":"2026-10-23T00:37:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-115424.json"}]}],"vendorCoverage":{"total":5,"shown":5,"omitted":0,"source":"redhat"}}