CVE-2026-72924
CVE-2026-72924: 1 tracked advisory record across Red Hat. Compare vendor sources and published fix guidance.
Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.
Vendor advisory comparison
Red Hat
1 advisory- Advisory severityMedium4.6
Medium [CVE-2026-72924] Forwarded services exposed on all network interfaces by default
CVE-2026-72924Source published Source updated
GitHub CLI (gh) is GitHub's official command line tool. Versions 2.28.0 through 2.97.0 bind the local listener created by gh codespace ports forward to all available network interfaces by default. While port forwarding is active, a service in a Codespace can therefore become reachable through the user's non-loopback local IP addresses by other hosts that can route to the user's machine. This behavior does not change the GitHub-side visibility of the Codespaces port. Instead, it exposes the forwarded service through a wildcard-bound listener on the user's local machine, even when the source Codespaces port remains private. Exploitation requires a network-adjacent attacker to reach the victim's machine while forwarding is active. This issue is fixed in version 2.98.0. This can lead to…
- Affected products in this advisory
- Red Hat OpenShift GitOps
- Red Hat OpenStack Platform 18.0
- Source-reported affected versions
- 2.28.0
- 2.97.0
- Source-reported fixed versions
- 2.98.0
- Mitigation guidance
- There are no known mitigations available for this vulnerability at this time. Red Hat recommends applying the available security update once it is released.
Android app · Google Play
Monitor future Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.