CVE-2026-19079
Last modified
CVE-2026-19079 is a medium-severity vulnerability rated 4.4/10 on the CVSS scale. A TOCTOU (Time-of-Check-Time-of-Use) race condition vulnerability was found in the fixfiles script in policycoreutils. When running fixfiles relabel or fixfiles restore, the script used find and chcon commands to locate and relabel unlabeled files under /tmp and other directories. EPSS estimates a 0.08% chance of exploitation in the next 30 days.
Description
A TOCTOU (Time-of-Check-Time-of-Use) race condition vulnerability was found in the fixfiles script in policycoreutils. When running fixfiles relabel or fixfiles restore, the script used find and chcon commands to locate and relabel unlabeled files under /tmp and other directories. A local attacker could exploit a race window between the file discovery and the label change operation by swapping directory components with symlinks, causing chcon to follow the symlink and modify SELinux labels on arbitrary system files. This could undermine SELinux mandatory access control protections on critical files such as /etc/shadow.
Metrics
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat Hardened Images | All versions |
| Red Hat | Red Hat Enterprise Linux 10 | All versions |
| Red Hat | Red Hat Enterprise Linux 6 | All versions |
| Red Hat | Red Hat Enterprise Linux 7 | All versions |
| Red Hat | Red Hat Enterprise Linux 8 | All versions |
| Red Hat | Red Hat Enterprise Linux 9 | All versions |
| Red Hat | Red Hat OpenShift Container Platform 4 | All versions |
References
Timeline
- Published
- Last Modified
- Status
- Received
Frequently Asked Questions
What is CVE-2026-19079?
How severe is CVE-2026-19079?
How do I fix CVE-2026-19079?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-19071A flaw has been found in itsourcecode Hospital Management Sy…6.3
- CVE-2026-19073The Order Sync with Zendesk for WooCommerce WordPress plugin…5.3
- CVE-2026-19074The Advanced Classifieds & Directory Pro Advanced Classified…5.3
- CVE-2026-19075All-in-One Video Gallery registers a public, unauthenticated…5
- CVE-2026-19077The Duplicate Post WordPress plugin before 1.5.5 does not pe…6.5
- CVE-2026-19078A flaw was found in the oauth-server component. This open re…4.3
- CVE-2026-1908The Integration with Hubspot Forms plugin for WordPress is v…6.4
- CVE-2026-19082Imager versions from 0.45_02 before 1.034 for Perl may expos…7.5
- CVE-2026-19089The Product Input Fields for WooCommerce WordPress plugin be…
- CVE-2026-1909The WaveSurfer-WP plugin for WordPress is vulnerable to Stor…6.4
- CVE-2026-19091The GeoDirectory – WP Business Directory Plugin and Classifi…8.1
- CVE-2026-1910The UpMenu – Online ordering for restaurants plugin for Word…6.4
Are you affected by CVE-2026-19079?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST