CVE-2026-84292: Red Hat Authority Injection via Unvalidated Port Serialization
This Red Hat advisory covers CVE-2026-84292 in Red Hat Enterprise Linux 10, Red Hat Satellite 6.19 for RHEL 9 and Cluster Observability Operator 1.5.3.
Key facts
- Vendor rating
- High, CVSS 7.5
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N· base score 7.5, scored by openjsAttack vector: network. Attack complexity: low. Privileges required: none. User interaction: none. Scope: unchanged. Confidentiality impact: none. Integrity impact: high. Availability impact: none.- Weakness
- CWE-116: Improper Encoding or Escaping of Output
- EPSS
- 0.24% chance of exploitation in the next 30 days (15th percentile). FIRST EPSS, .
- CISA SSVC
- Exploitation: none observed. Automatable: yes. Technical impact: partial. CISA, .
- CISA KEV
- Not listed (catalogue checked )
- Affected
- < 2.4.6; < 3.0.0; < 3.1.7 and 2 more below
- Fixed in
- 2.4.6, 3.1.7, 4.1.4 and 47 more below
- Source published
- Listed by VulniPulse
Compiled by VulniPulse from the linked sources. How records are collected and checked.
Affected products & platforms
Description
fast-uri serializes the port component of a URI without validating it.
When recomposing the authority, the userinfo and host components are escaped but the port is concatenated verbatim, so a port value that is not a sequence of digits can inject authority delimiters, demoting the intended host to userinfo and pointing the authority at an attacker-controlled host.
Both fast-uri and Node's URL read the result back as the attacker's host with no error, so re-validating the built URI does not catch it. This affects applications that build URIs from parts and assign untrusted data to the port component through the serialize, normalize, or equal functions in their object forms.
It is fixed in 2.4.6, 3.1.7, and 4.1.4, where recomposeAuthority rejects any port that is not a digit sequence per RFC 3986. A remote attacker can exploit this by crafting a malicious port value that injects authority delimiters.
This manipulation can demote the intended host to user information and redirect the authority to an attacker-controlled host, leading to information disclosure as applications interpret the attacker's host as legitimate. This is an Important flaw.
This could allow an attacker to redirect network traffic to an arbitrary host, compromising communication integrity. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).
Weakness: CWE-140.
Text from the source record.
- < 2.4.6
- < 3.0.0
- < 3.1.7
- < 4.0.0
- < 4.1.4
Official advisory · high-confidence parse· fetched ·verify at source
How to fix CVE-2026-84292
Upgrade to a fixed release named by Red Hat:
- 2.4.6
- 3.1.7
- 4.1.4
- cockpit-image-builder-0:94.4-1.el10_2
- foreman-0:3.18.0.14-1.el9sat
- cluster-observability-operator/troubleshooting-panel-console-plugin-rhel9:1790854494
- network-observability/network-observability-console-plugin-pf5-rhel9:1789978780
- network-observability/network-observability-console-plugin-rhel9:1789978277
- ansible-automation-platform/automation-portal:1788775748
- ansible-automation-platform/automation-portal:1788783591
- ansible-automation-platform-25/lightspeed-rhel8:1789685837
- ansible-automation-platform-26/lightspeed-rhel9:1789656884
- ansible-automation-platform-tech-preview/mcp-server-rhel9:1789669036
- ansible-automation-platform-27/mcp-server-rhel9:1789518969
- costmanagement/costmanagement-ui-rhel10:1791460851
- rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend:1791242697
- rhdh/red-hat-developer-hub-backstage-plugin-orchestrator:1791250003
- rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend:1791251282
- rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki:1791250355
- rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets:1791250794
- rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator:1791249640
- rhdh/rhdh-hub-rhel9:1791311495
- rhdh/rhdh-hub-rhel9:1789554285
- discovery/discovery-ui-rhel9:1789677459
- rhem/flightctl-ui-ocp-rhel10:1789486226
and 25 more in the Red Hat advisory.
Vendor guidance
- Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Support dates for the fixed release lines
- Red Hat Enterprise Linux 4: support ended
CVE-2026-84292 in other vendors' advisories
- Atlassian: CVE-2026-84292, high severity, fixed in Jira Data Center and Server: 11.3.12 (LTS) recommended Data Center Only, Jira Data Center and Server: 10.3.26 (LTS) Data Center Only, Jira Service Management Data Center and Server: 11.3.12 (LTS) recommended Data Center Only and 1 more
More Red Hat Linux advisories
CVE-2026-48710May 26, 2026Security restriction bypass via malformed HTTP Host headerCVE-2026-46300May 13, 2026"Fragnesia" is a variant of Dirty Frag vulnerability in the ESP/XFRMCVE-2026-31431Apr 22, 2026algif_aead - Revert to operating out-of-placeCVE-2026-111497Oct 22, 2026Out-of-Bounds Write in Google Brotli DecoderCVE-2026-109619Oct 21, 2026fatal error handling retains stale request state leading to use-after-freeCVE-2026-109618Oct 21, 2026OOM bailout during request parsing leads to memory corruption and RCE
Get an email when Red Hat RHEL & SELinux publishes the next one.
See Red Hat RHEL & SELinux's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).
iPhone and Android apps · New on the App Store
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
