Vulnerability · Published Aug 10, 2026 · Assigned by redhat

CVE-2026-19278Stackrox: stackrox: privilege escalation via unanchored regular expressions in auth m2m role mappings

Medium 6.8

In plain English

A medium-severity security flaw in Red Hat Advanced Cluster Security 4 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities).

Severity (CVSS 3.1)6.8Medium

Exploit odds (30 days)0.3%top 71.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A flaw was found in StackRox/RHACS Central's Auth Machine-to-Machine (M2M) token exchange. When an administrator configures M2M role mappings, the system uses unanchored regular expressions for matching claim values. This allows an attacker with a valid OpenID Connect (OIDC) token, whose claim value is a superstring of a configured pattern, to gain unauthorized access to roles they were not intended to receive. This can lead to privilege escalation within the system.

Affected products (as reported)

Vendor	Product	Versions
Red Hat	Red Hat Advanced Cluster Security 4	see references

Weakness: CWE-625 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

References

https://access.redhat.com/security/cve/CVE-2026-19278 vdb-entry, x_refsource_REDHAT
RHBZ#2512524 issue-tracking, x_refsource_REDHAT