CVE-2026-86330

An OS command injection flaw was found in the set_hostname_internal function of NooBaa's cluster_internal_api. This component is responsible for managing the Multi-Cloud Object Gateway in OpenShift Data Foundation. The vulnerability occurs because the hostname parameter is passed directly to a shell command without proper sanitization. An authenticated attacker with administrative privileges can provide a specially crafted hostname containing shell metacharacters to execute arbitrary commands on the host system with the privileges of the NooBaa process.

• CWE-78

• https://access.redhat.com/security/cve/CVE-2026-86330
• https://bugzilla.redhat.com/show_bug.cgi?id=2529295

Published

Sep 28, 2026

Last Modified

Sep 30, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-86322A flaw was found in Foreman’s Api::V2::PersonalAccessTokensC…8.8
• CVE-2026-86323A flaw was found in Foreman’s Api::V2::MailNotificationsCont…4.3
• CVE-2026-86324A flaw was found in Foreman’s Api::V2::SshKeysController, wh…4.3
• CVE-2026-86325A stack-based buffer overflow vulnerability exists in protoc…9.4
• CVE-2026-86326An improper verification of cryptographic signature vulnerab…8.6
• CVE-2026-8633IBM Web Server Plug-ins for WebSphere Application Server and…9.8
• CVE-2026-86332A flaw was found in odh-dashboard in Red Hat OpenShift AI. T…6.5
• CVE-2026-86334Path traversal in the CLI client image export and copy funct…4.2
• CVE-2026-86335Missing Authorization in imageDownload in Canonical LXD befo…6.3
• CVE-2026-86336Apache TomEE running on JDK 21 or later skips EJB method aut…
• CVE-2026-86338Ash field_policies are documented to protect against filter-…6
• CVE-2026-8634Crabbox prior to v0.12.0 contains an environment variable ex…9.1