NooBaa - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/noobaa/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 28 Sep 2026 14:15:21 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgOS Command Injection in NooBaa cluster_internal_apihttps://feed.craftedsignal.io/briefs/2026-09-noobaa-cve/Mon, 28 Sep 2026 14:15:21 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-noobaa-cve/CVE-2026-86330 is an OS command injection vulnerability in the NooBaa cluster_internal_api component of Red Hat OpenShift Data Foundation, allowing authenticated administrative attackers to execute arbitrary system commands.CVE-2026-86330 is a high-severity OS command injection vulnerability identified in the set_hostname_internal function within the cluster_internal_api component of NooBaa. NooBaa serves as the Multi-Cloud Object Gateway for Red Hat OpenShift Data Foundation. The vulnerability stems from the direct and unsanitized passage of the hostname parameter into a shell execution context. This flaw permits an authenticated user possessing administrative privileges to inject shell metacharacters into the hostname field, resulting in the execution of arbitrary commands on the underlying host. The injected commands run with the privileges assigned to the NooBaa process, posing a significant risk to the integrity and confidentiality of the storage gateway environment.

Impact

Successful exploitation of this vulnerability allows an authenticated administrative attacker to gain arbitrary code execution on the host system running the NooBaa component. This can lead to full compromise of the Multi-Cloud Object Gateway, unauthorized access to stored data, or lateral movement within the OpenShift environment. The vulnerability impacts deployments of Red Hat OpenShift Data Foundation utilizing the affected NooBaa version.

Recommendation

Detection engineering teams should monitor for suspicious process executions originating from the NooBaa process space.

  • Audit administrative access to the cluster_internal_api to identify potential abuse of configuration parameters.
  • Apply security patches provided by Red Hat for OpenShift Data Foundation to address CVE-2026-86330.
  • Implement process-level monitoring on the NooBaa controller to detect unexpected shell invocations (e.g., /bin/sh or /bin/bash) triggered by the NooBaa process.
]]>highadvisoryvulnerabilityremote-code-executionopenshift