Vulnerability · Published Sep 28, 2026 · Assigned by redhat

CVE-2026-86330Noobaa-core: noobaa-core: os command injection in cluster_internal_api.set_hostname_internal

High 7.2

In plain English

A high-severity OS command injection in Red Hat Openshift Data Foundation 4 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.2% (higher than 82% of all known vulnerabilities).

Severity (CVSS 3.1)7.2High

Exploit odds (30 days)2.2%top 17.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

An OS command injection flaw was found in the set_hostname_internal function of NooBaa's cluster_internal_api. This component is responsible for managing the Multi-Cloud Object Gateway in OpenShift Data Foundation. The vulnerability occurs because the hostname parameter is passed directly to a shell command without proper sanitization. An authenticated attacker with administrative privileges can provide a specially crafted hostname containing shell metacharacters to execute arbitrary commands on the host system with the privileges of the NooBaa process.

Affected products (as reported)

Vendor	Product	Versions
Red Hat	Red Hat Openshift Data Foundation 4	see references
Red Hat	Red Hat Openshift Data Foundation 4	see references

Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

References

https://access.redhat.com/security/cve/CVE-2026-86330 vdb-entry, x_refsource_REDHAT
RHBZ#2529295 issue-tracking, x_refsource_REDHAT