CVE-2026-92615
CVE-2026-92615: 1 tracked advisory record across Red Hat. Compare vendor sources and published fix guidance.
Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.
Vendor advisory comparison
Red Hat
1 advisory- Advisory severityMedium6.6
Medium [CVE-2026-92615] Package-global go-git HTTPS transport mutated per-repo -- cross-tenant TLS-config bleed
CVE-2026-92615Source published Source updated
Package-global go-git HTTPS transport mutated per-repo -- cross-tenant TLS-config bleed. Red Hat rates this moderate (CVSS 6.6). Weakness: CWE-413. Affected products named by the advisory: Red Hat Advanced Cluster Management for Kubernetes 2; Red Hat Edge Manager 1.
- Related products — impact not confirmed
- Red Hat Advanced Cluster Management for Kubernetes 2
- Red Hat Edge Manager 1
- Source-reported affected versions
- Affected-version details not available in this record.
- Source-reported fixed versions
- No fixed-version detail extracted. This does not mean no fix exists.
- Mitigation guidance
- There is no application-level workaround that fully eliminates this race condition without a code change. The following deployment-level measures reduce exposure in multi-tenant environments: - Avoid mTLS client certificates for git repositories: If tenant Repository resources do not supply client TLS certificates (httpConfig.tls.clientCertificate), the most sensitive data (client private key material) is absent from the global transport and cannot leak. - Avoid skipServerVerification: Do not set httpConfig.skipServerVerification: true on any Repository resource. This prevents a tenant's InsecureSkipVerify=true from propagating to other tenants' clones, which would otherwise allow an on-path attacker to serve malicious configuration.
Android app · Google Play
Monitor future Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.