Log in Start free

Vulnerability · Published Sep 16, 2026 · Assigned by redhat

CVE-2026-92615Flightctl: flightctl: package-global go-git https transport mutated per-repo -- cross-tenant tls-config bleed

Medium 6.6

In plain English

A medium-severity security flaw in Red Hat Advanced Cluster Management for Kubernetes 2 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities).

Severity (CVSS 3.1)6.6Medium
Exploit odds (30 days)0.2%top 90.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A flaw was found in flightctl. The configureRepoHTTPSClient() function in the device-render worker builds a per-repository tls.Config (which may include InsecureSkipVerify, a custom CA bundle, or tenant-supplied mTLS client certificates) and installs it into go-git's process-global client.Protocols map via gitclient.InstallProtocol("https", ...). Because the worker renders devices for multiple organizations concurrently from a shared goroutine pool, whichever tenant's repository configuration is written last wins for all in-flight git.Clone calls. This race condition can cause one tenant's TLS settings, including InsecureSkipVerify or mTLS client credentials, to leak into another tenant's git operations.

Affected products (as reported)

VendorProductVersions
Red Hat RHEM 1.2 for RHEL 10 see references
Red Hat RHEM 1.2 for RHEL 9 see references
Red Hat Red Hat Edge Manager 1.2 see references
Red Hat Red Hat Edge Manager 1.2 see references
Red Hat Red Hat Advanced Cluster Management for Kubernetes 2 see references

Weakness: CWE-413 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:N

References