CVE-2026-125672
Last modified
CVE-2026-125672 is a medium-severity vulnerability rated 6.6/10 on the CVSS scale. A flaw was found in cockpit-storaged. A Tang keyserver address read from a clevis token in a LUKS header is concatenated into curl's argument vector without a "--" separator.
Description
A flaw was found in cockpit-storaged. A Tang keyserver address read from a clevis token in a LUKS header is concatenated into curl's argument vector without a "--" separator. An address beginning with "-" is parsed by curl as an option instead of a hostname, allowing an attacker who can attach a crafted LUKS/clevis block device (for example, a local unprivileged user with an active console or desktop login session) to have an administratively-privileged Cockpit user unknowingly trigger curl option injection when editing the device's Tang keyserver settings. This can lead to arbitrary file read or write as the Cockpit session user.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | All versions |
| Red Hat | Red Hat Enterprise Linux 6 | All versions |
| Red Hat | Red Hat Enterprise Linux 7 | All versions |
| Red Hat | Red Hat Enterprise Linux 8 | All versions |
| Red Hat | Red Hat Enterprise Linux 9 | All versions |
References
Timeline
- Published
- Last Modified
- Status
- Awaiting Analysis
Frequently Asked Questions
What is CVE-2026-125672?
How severe is CVE-2026-125672?
How do I fix CVE-2026-125672?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-12562The RCU II+ and Multiload II+ are vulnerable to an unauthent…8.8
- CVE-2026-12564A flaw was found in the AAP Controller's HashiCorp Vault cre…9.6
- CVE-2026-12565The unarchive internal module's archive extraction commands …5.3
- CVE-2026-125652A flaw was found in the keycloak-services component of Keycl…6.8
- CVE-2026-12566The docker_pull module uses the realm parameter from a Docke…3.1
- CVE-2026-12567The github_workflows module constructs local directory paths…2.2
- CVE-2026-12568The postman_download module uses the workspace name field fr…6.5
- CVE-2026-12569A critical remote code execution (RCE) vulnerability has bee…9.8
- CVE-2026-1257The Administrative Shortcodes plugin for WordPress is vulner…7.5
- CVE-2026-12570A vulnerability in keras-team/keras versions <= 3.15.0 allow…5.5
- CVE-2026-125703A flaw was found in the GStreamer gst-plugins-bad MXF plugin…5.5
- CVE-2026-125704A use-after-free flaw was found in GStreamer core buffer val…7.5
Are you affected by CVE-2026-125672?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST