Red Hat — CraftedSignal Threat Feed

Quarkus Vertx HTTP Authorization Bypass via Matrix Parameters

hello@craftedsignal.io — Mon, 04 May 2026 17:20:20 +0000

A vulnerability exists in Quarkus Vertx HTTP versions < 3.20.6.1, >= 3.21.0 and < 3.27.3.1, >= 3.30.0 and < 3.33.1.1, and >= 3.34.0 and < 3.35.1.1. The vulnerability, designated as CVE-2026-39852, allows unauthenticated or lower-privileged users to bypass HTTP path-based authorization policies. By appending a semicolon (;) and arbitrary text to the request URL, attackers can gain unauthorized access to protected resources. This vulnerability stems from an inconsistency in path normalization: Quarkus’s security layer checks the raw URL path, while RESTEasy Reactive’s routing layer strips matrix parameters before matching endpoints. This means a request like /api/admin;anything can bypass authorization for /api/admin while still routing to the protected endpoint. This issue was discovered and verified by the GitHub Security Lab.

Attack Chain

An attacker identifies a protected endpoint, such as /api/admin, that requires authentication or specific privileges.
The attacker crafts a malicious HTTP request targeting the protected endpoint but appends a semicolon and arbitrary text, such as /api/admin;anything.
The request is sent to the Quarkus Vertx HTTP server.
Quarkus’s security layer performs an authorization check on the raw URL path /api/admin;anything, which may not match the intended authorization rules for /api/admin.
RESTEasy Reactive’s routing layer strips the matrix parameters (;anything) from the URL, resulting in the endpoint /api/admin being matched.
The request is routed to the protected endpoint /api/admin, bypassing the intended authorization checks.
The attacker gains unauthorized access to the protected resource or functionality.
The attacker performs actions they would not normally be authorized to perform, such as accessing sensitive data or modifying system configurations.

Impact

Successful exploitation of this vulnerability can lead to unauthorized access to sensitive data, modification of system configurations, or other malicious activities. The vulnerability affects Quarkus Vertx HTTP applications that rely on path-based authorization policies. The number of affected applications is currently unknown, but any application using the vulnerable versions of Quarkus Vertx HTTP is susceptible.

Recommendation

Upgrade Quarkus Vertx HTTP to a patched version (>= 3.20.6.1, >= 3.27.3.1, >= 3.33.1.1, >= 3.35.1.1) to remediate CVE-2026-39852.
Deploy the Sigma rule Detect Quarkus Authorization Bypass Attempt to identify potential exploitation attempts in web server logs.
Monitor web server logs for requests containing semicolons in the URL path to detect potential exploitation attempts using the Monitor Semicolons in URL Path Sigma rule.

AAP Gateway Account Hijacking Vulnerability (CVE-2026-6266)

hello@craftedsignal.io — Mon, 04 May 2026 14:16:35 +0000

A vulnerability, tracked as CVE-2026-6266, exists in the AAP gateway. Specifically, the user auto-link strategy introduced in AAP 2.6 automatically links external Identity Provider (IDP) identities to existing AAP user accounts based on email matching without verifying email ownership. This vulnerability enables a remote attacker to potentially hijack a victim’s account and gain unauthorized access to other accounts, including administrative accounts. The attacker achieves this by manipulating the email address provided by the IDP during the auto-linking process. This poses a significant risk to organizations using AAP for identity management, potentially leading to data breaches and system compromise.

Attack Chain

Attacker identifies a target user account within the AAP gateway.
Attacker creates an account on a configured external Identity Provider (IDP).
Attacker configures the IDP account with the same email address as the target user in the AAP gateway.
The target user attempts to authenticate to the AAP gateway using the configured IDP.
The AAP gateway, running version 2.6 or later, automatically links the attacker-controlled IDP identity to the existing AAP user account based on email matching, without verifying ownership.
The attacker successfully authenticates to the AAP gateway using the attacker-controlled IDP account, gaining access to the target user’s account.
If the hijacked account has administrative privileges, the attacker can escalate privileges and compromise the entire AAP gateway environment.

Impact

Successful exploitation of CVE-2026-6266 can lead to unauthorized access to sensitive data and systems managed by the AAP gateway. This includes the potential compromise of administrative accounts, which could allow an attacker to gain full control over the AAP environment. The vulnerability impacts organizations using AAP 2.6 and later for identity management. The potential consequences include data breaches, service disruption, and financial loss.

Recommendation

Apply the patch provided in Red Hat Security Advisory RHSA-2026:13508 to remediate CVE-2026-6266.
Monitor AAP gateway logs for successful authentications from unexpected IDPs to detect potential account hijacking attempts. Deploy a Sigma rule to detect this behavior.
Implement multi-factor authentication (MFA) for all AAP accounts to mitigate the impact of successful account hijacking, even if the IDP is compromised.

CVE-2026-31431 'Copy Fail' Linux Kernel Privilege Escalation

hello@craftedsignal.io — Sat, 02 May 2026 03:06:08 +0000

CVE-2026-31431, known as “Copy Fail,” is a high-severity local privilege escalation vulnerability affecting the Linux kernel’s cryptographic subsystem. The vulnerability resides within the algif_aead module of the AF_ALG (userspace crypto API) and results from improper memory handling during in-place operations. An unprivileged user can exploit this flaw to corrupt the cache of readable files, including setuid binaries, resulting in unauthorized root privilege escalation. This vulnerability impacts a wide range of Linux distributions, including Ubuntu 24.04 LTS, Amazon Linux 2023, Red Hat Enterprise Linux (RHEL 10.1), and SUSE 16, as well as other distributions like Debian, Fedora, and Arch Linux. The availability of a working proof-of-concept exploit has raised concerns about potential widespread exploitation, leading to its addition to the CISA KEV catalog.

Attack Chain

Reconnaissance: The attacker gains limited visibility into the environment (e.g., compromised CI runner, web container) and identifies the kernel version. Kernel version information is obtained without elevated privileges.
Script Execution: The attacker executes a compact Python script that interacts with standard kernel interfaces, without relying on networking, compilation, or third-party libraries.
AF_ALG Abuse: The script abuses an interaction between the AF_ALG (asynchronous crypto) socket interface, the splice() system call and improper error handling during a failed copy operation.
Kernel Page Cache Corruption: This interaction leads to a controlled 4-byte overwrite in the kernel page cache, corrupting sensitive kernel-managed data.
Privilege Escalation: By corrupting kernel structures associated with credentials or execution context, the attacker escalates their process to UID 0.
Boundary Breach: The system’s privilege boundary is broken, neutralizing SELinux/AppArmor protections, and bypassing local security controls.
Lateral Movement/Container Escape: The attacker can now use the root privileges gained to perform lateral movement or escape the container.

Impact

Successful exploitation of CVE-2026-31431 leads to full root privilege escalation, resulting in high impact to confidentiality, integrity, and availability. This could facilitate container breakout, multi-tenant compromise, and lateral movement within shared environments. The vulnerability’s reliability, stealth (in-memory-only modification), and cross-platform applicability make it particularly dangerous in cloud, CI/CD, and Kubernetes environments.

Recommendation

Identify all instances of affected products and versions in your environment and prioritize patching (CVE-2026-31431).
Deploy the Sigma rule for suspicious process execution under /tmp, often used in exploit PoCs, and tune for your environment.
Monitor for suspicious AF_ALG socket creation events, as indicated in the Attack Chain, using the provided Sigma rule.
If patches are unavailable, consider implementing network isolation and access controls as interim mitigation measures.

GnuTLS DTLS Handshake Parsing Flaw (CVE-2026-33845)

hello@craftedsignal.io — Thu, 30 Apr 2026 18:16:28 +0000

CVE-2026-33845 describes a vulnerability in the GnuTLS library related to the parsing of DTLS handshake fragments. The vulnerability stems from improper handling of malformed fragments that have a zero length but a non-zero offset. This leads to an integer underflow during the reassembly process, which then triggers an out-of-bounds read. The vulnerability is remotely exploitable, meaning an attacker could potentially trigger it without needing local access. Successful exploitation can lead to information disclosure or a denial-of-service condition. The affected component is the GnuTLS library, which is used by various applications for secure communication.

Attack Chain

An attacker crafts a malicious DTLS handshake fragment with a zero length and non-zero offset.
The attacker sends the malformed DTLS handshake fragment to a vulnerable GnuTLS server.
The GnuTLS library receives the fragment and begins the reassembly process.
The integer underflow occurs when calculating the correct offset for the fragment reassembly.
The integer underflow leads to an out-of-bounds memory read operation.
The out-of-bounds read allows the attacker to potentially read sensitive information from the server’s memory.
Alternatively, the out-of-bounds read may cause the server to crash, resulting in a denial-of-service.
The attacker achieves either information disclosure or denial-of-service based on the server’s response to the out-of-bounds read.

Impact

Successful exploitation of CVE-2026-33845 can lead to a denial-of-service condition, impacting the availability of services relying on the vulnerable GnuTLS library. The out-of-bounds read can also potentially expose sensitive information from the server’s memory, leading to data breaches. Given the widespread use of GnuTLS in various applications, a successful widespread attack could affect numerous organizations and users.

Recommendation

Apply available patches for GnuTLS provided by Red Hat or other vendors to address CVE-2026-33845.
Monitor network traffic for malformed DTLS handshake fragments with zero length and non-zero offset that may indicate exploitation attempts targeting CVE-2026-33845.
Deploy the Sigma rule DetectGnuTLSDTLSMalformedFragment to identify suspicious network connections associated with the vulnerability.

Local Privilege Escalation Vulnerability 'Copy Fail' in Linux Kernel

hello@craftedsignal.io — Thu, 30 Apr 2026 13:54:47 +0000

A local privilege escalation vulnerability, “Copy Fail” (CVE-2026-31431), impacts Linux kernels released since 2017. Discovered by Theori’s AI-driven pentesting platform Xint Code, the vulnerability allows an unprivileged local attacker to gain root permissions. Theori reported the finding to the Linux kernel security team on March 23, 2026, and patches became available within a week. A proof-of-concept exploit was published, demonstrating a 732-byte script that can root every Linux distribution shipped since 2017. This vulnerability stems from a logic bug in the Linux kernel’s authencesn cryptographic template. Theori demonstrated successful exploits on Ubuntu 24.04, Amazon Linux 2023, RHEL 10.1, and SUSE 16.

Attack Chain

An unprivileged local attacker gains access to a vulnerable Linux system.
The attacker utilizes the AF_ALG socket-based interface to access Linux kernel crypto functions from user space.
The attacker uses the splice() system call to perform a controlled 4-byte write in the page cache of a readable file, instead of a normal buffer.
The attacker targets a setuid-root binary file for modification.
The 4-byte write alters the behavior of the setuid-root binary.
The attacker executes the modified setuid-root binary.
Due to the altered behavior, the binary grants the attacker elevated privileges.
The attacker gains root privileges on the system.

Impact

Successful exploitation of the Copy Fail vulnerability (CVE-2026-31431) allows an unprivileged local attacker to gain root privileges on a vulnerable Linux system. Theori demonstrated and confirmed the exploit on Ubuntu 24.04, Amazon Linux 2023, RHEL 10.1, and SUSE 16, highlighting the widespread impact. Multi-tenant Linux hosts, Kubernetes/container clusters, CI runners/build farms, and cloud SaaS environments running user code are at high risk.

Recommendation

Apply available kernel patches for CVE-2026-31431 on affected Linux distributions, prioritizing multi-tenant environments (e.g., Ubuntu 24.04 LTS, Amazon Linux 2023, RHEL 10.1, SUSE 16).
As an interim mitigation, disable the vulnerable crypto interface by blocking AF_ALG socket creation or disabling the algif_aead module, as described in the overview.
Monitor for the execution of unusual processes after the modification of binaries in /tmp or /var/tmp using the Sigma rule “Detect Suspicious Splice Usage for Privilege Escalation”.
Deploy the Sigma rule “Detect algif_aead module removal” to detect attempts to disable the vulnerable module.

Multiple Vulnerabilities in Red Hat Enterprise Linux Fast Datapath

hello@craftedsignal.io — Thu, 30 Apr 2026 09:57:14 +0000

Multiple vulnerabilities exist within the Fast Datapath component of Red Hat Enterprise Linux (RHEL). These vulnerabilities can be exploited by a remote, anonymous attacker without requiring authentication. Successful exploitation could lead to a denial-of-service (DoS) condition, rendering affected systems unavailable, or the unauthorized disclosure of sensitive information. While the specific nature of the vulnerabilities is not detailed, the broad impact necessitates immediate attention from security teams responsible for RHEL environments utilizing Fast Datapath. Defenders should focus on identifying and mitigating potential exploitation attempts targeting this component.

Attack Chain

The attacker identifies a vulnerable RHEL system running Fast Datapath exposed to the network.
The attacker crafts a malicious network packet designed to exploit a memory corruption vulnerability within Fast Datapath.
The malicious packet is sent to the target system over the network.
Fast Datapath processes the packet, triggering a buffer overflow or other memory corruption error.
The memory corruption causes the Fast Datapath process to crash, leading to a denial-of-service condition.
(Alternative) The attacker exploits a separate vulnerability to read sensitive information from Fast Datapath’s memory.
The attacker exfiltrates the disclosed information.

Impact

Successful exploitation of these vulnerabilities could result in a denial of service, disrupting critical services and impacting business operations. The disclosure of sensitive information could also lead to further compromise, including unauthorized access to systems or data. The number of affected systems will depend on the prevalence of Fast Datapath deployments within RHEL environments.

Recommendation

Deploy the Sigma rule Detect Suspicious Network Traffic to Fast Datapath to identify potential exploitation attempts (see below).
Investigate and patch systems running Red Hat Enterprise Linux with Fast Datapath enabled as soon as patches are available from Red Hat.
Monitor network traffic for anomalous patterns that may indicate attempts to exploit these vulnerabilities.

Multiple Vulnerabilities in Red Hat Linux Kernel

hello@craftedsignal.io — Thu, 30 Apr 2026 00:00:00 +0000

On April 30, 2026, CERT-FR published an advisory regarding multiple vulnerabilities in the Red Hat Linux kernel. These vulnerabilities, detailed in Red Hat Security Advisories RHSA-2026:10756, RHSA-2026:10996, and RHSA-2026:11313, can lead to significant security risks including arbitrary code execution, privilege escalation, and remote denial of service. The affected systems include various versions and architectures of Red Hat CodeReady Linux Builder and Red Hat Enterprise Linux. Successful exploitation of these vulnerabilities could allow attackers to gain unauthorized access, control systems, or disrupt services, impacting the confidentiality, integrity, and availability of affected systems.

Attack Chain

Initial Compromise (via unconfirmed vector): An attacker identifies a vulnerable Red Hat Linux system running an affected kernel version. While the exact exploit vector isn’t specified in the advisory, it involves a vulnerability in the kernel.
Exploit Trigger: The attacker triggers a specific kernel vulnerability, such as those identified as CVE-2026-23001 or CVE-2026-31402, by sending a crafted input to a vulnerable kernel component. The specific method depends on the nature of each CVE.
Code Execution: Upon successful exploitation, the attacker achieves arbitrary code execution within the kernel context. This allows the attacker to run malicious code directly on the system.
Privilege Escalation: Leveraging the code execution capability, the attacker exploits another vulnerability (e.g., CVE-2025-68741) to escalate privileges to root or SYSTEM. This may involve exploiting race conditions, memory corruption bugs, or other privilege escalation flaws within the kernel.
System Control: With elevated privileges, the attacker gains full control over the compromised system. They can now access sensitive data, modify system configurations, install backdoors, or move laterally to other systems within the network.
Lateral Movement (Optional): The attacker uses the compromised system as a launching point to attack other systems on the network, potentially exploiting other vulnerabilities or using stolen credentials.
Persistence (Optional): The attacker establishes persistence on the compromised system to maintain access even after reboots. This may involve installing rootkits, modifying system startup scripts, or creating rogue user accounts.
Denial of Service/Data Exfiltration/etc.: Depending on their objectives, the attacker may use the compromised system to launch denial-of-service attacks against other targets, exfiltrate sensitive data, or cause other damage.

Impact

Successful exploitation of these kernel vulnerabilities can lead to complete system compromise, allowing attackers to execute arbitrary code, escalate privileges, and cause denial of service. The wide range of affected Red Hat Enterprise Linux and CodeReady Linux Builder versions implies a potentially large number of vulnerable systems. This can result in significant data breaches, system downtime, financial losses, and reputational damage for affected organizations.

Recommendation

Apply the patches provided in Red Hat Security Advisories RHSA-2026:10756, RHSA-2026:10996, and RHSA-2026:11313 to remediate the vulnerabilities.
Prioritize patching systems based on their criticality and exposure to external networks.
Monitor systems for suspicious activity that may indicate exploitation attempts, focusing on unexpected kernel module loads or privilege escalations using process_creation logging.
Deploy the Sigma rule detecting suspicious kernel module loading to identify potential rootkit installation attempts.
Investigate any alerts generated by the deployed Sigma rules to determine the scope and impact of potential compromises.

Red Hat Enterprise Linux LibRaw Multiple Vulnerabilities Allow Code Execution or DoS

hello@craftedsignal.io — Wed, 29 Apr 2026 09:54:06 +0000

Multiple vulnerabilities have been identified within the LibRaw component of Red Hat Enterprise Linux. These vulnerabilities, if successfully exploited, could allow an attacker to achieve arbitrary code execution or trigger a denial-of-service (DoS) condition on a vulnerable system. While the specific CVEs are not detailed in the advisory, the high-level threat remains significant, potentially impacting any system relying on the affected LibRaw library for processing raw image data. Defenders should prioritize patching and monitoring systems utilizing LibRaw to mitigate the risks. This advisory serves as an early warning in advance of any detailed technical release; specific exploit methods will become clearer as details emerge.

Attack Chain

An attacker identifies a vulnerable version of LibRaw within a Red Hat Enterprise Linux system. This may involve scanning for specific LibRaw versions or identifying services reliant on the library.
The attacker crafts a malicious raw image file designed to exploit a specific vulnerability in LibRaw’s parsing logic.
The attacker delivers the malicious file to the target system. This could involve uploading the file to a web server, emailing it as an attachment, or injecting it into a data stream processed by LibRaw.
The vulnerable LibRaw library attempts to process the malicious image file.
Due to the vulnerability (e.g., a buffer overflow or integer overflow), LibRaw crashes, leading to a denial-of-service. Alternatively, the attacker gains control of the program counter.
The attacker executes arbitrary code within the context of the LibRaw process, potentially gaining control over the entire system.
The attacker uses the initial foothold to escalate privileges and move laterally within the network.
The final objective is to disrupt services and/or exfiltrate sensitive data.

Impact

Successful exploitation of these vulnerabilities can lead to arbitrary code execution, potentially granting an attacker full control over affected systems. This could result in data breaches, system compromise, and service disruption. A denial-of-service condition could also disrupt critical services reliant on the vulnerable systems. The number of affected systems depends on the prevalence of vulnerable LibRaw versions within Red Hat Enterprise Linux deployments. The specific impact will depend on the privileges of the compromised process and the system’s role within the network.

Recommendation

Monitor process execution for unexpected child processes spawned by applications utilizing LibRaw (see “Detect Suspicious Process Creation from LibRaw” Sigma rule).
Implement file integrity monitoring to detect unauthorized modifications to LibRaw binaries (see “Detect LibRaw Binary Modification” Sigma rule).
Investigate and block any anomalous network connections originating from systems utilizing LibRaw.
Consult Red Hat security advisories for specific CVEs and patch information as they become available.

InstructLab Arbitrary Code Execution via Malicious HuggingFace Model

hello@craftedsignal.io — Wed, 22 Apr 2026 14:17:07 +0000

InstructLab contains a critical vulnerability (CVE-2026-6859) in its linux_train.py script. The script unconditionally sets trust_remote_code=True when interacting with the HuggingFace model hub. This design flaw allows a remote attacker to inject arbitrary Python code into the training process. The attacker only needs to convince a user to execute the ilab train, ilab download, or ilab generate command while specifying a malicious model hosted on HuggingFace. Successful exploitation results in arbitrary code execution within the context of the InstructLab process, potentially leading to complete system compromise.

Attack Chain

Attacker creates a malicious model on the HuggingFace Hub. This model contains embedded Python code designed for malicious purposes.
Attacker social engineers a user to execute ilab train, ilab download, or ilab generate commands.
User executes the command, specifying the attacker’s malicious model from the HuggingFace Hub.
The linux_train.py script, due to the hardcoded trust_remote_code=True, downloads the malicious model.
The script loads the model, triggering the execution of the attacker’s embedded Python code.
The attacker’s code executes within the InstructLab process, allowing for arbitrary actions.
The attacker achieves persistence by modifying system files or creating new services.
The attacker gains full control of the compromised system, potentially exfiltrating data or causing further damage.

Impact

Successful exploitation of this vulnerability allows a remote attacker to execute arbitrary Python code on the target system. This can lead to complete system compromise, allowing the attacker to steal sensitive data, install malware, or disrupt operations. While the number of affected systems is currently unknown, any system running a vulnerable version of InstructLab and interacting with the HuggingFace Hub is at risk.

Recommendation

Deploy the Sigma rules provided below to detect suspicious process creation events related to InstructLab executing code from temporary directories or with unusual network activity.
Monitor process creation events for the execution of Python scripts with trust_remote_code=True within InstructLab’s processes using the provided Sigma rule.
Implement strict controls and validation for models downloaded from HuggingFace, even if trust_remote_code=True is required.
Apply any available patches or updates for InstructLab to address CVE-2026-6859 as provided by Red Hat.