CVE-2026-92615Flightctl: flightctl: package-global go-git https transport mutated per-repo -- cross-tenant tls-config bleed
Descripción
A flaw was found in flightctl. The configureRepoHTTPSClient() function in the device-render worker builds a per-repository tls.Config (which may include InsecureSkipVerify, a custom CA bundle, or tenant-supplied mTLS client certificates) and installs it into go-git's process-global client.Protocols map via gitclient.InstallProtocol("https", ...). Because the worker renders devices for multiple organizations concurrently from a shared goroutine pool, whichever tenant's repository configuration is written last wins for all in-flight git.Clone calls. This race condition can cause one tenant's TLS settings, including InsecureSkipVerify or mTLS client credentials, to leak into another tenant's git operations.
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
Productos y versiones afectados
| Fabricante | Producto | Versiones | |
|---|---|---|---|
| edge manager | 1.2 | — | |
| edge manager | 1.3 | — | |
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2 | all versions | |
| Red Hat | Red Hat Edge Manager 1.2 | all versions | |
| Red Hat | Red Hat Edge Manager 1.3 | all versions | |
| Red Hat | RHEM 1.2 for RHEL 10 | all versions | |
| Red Hat | RHEM 1.2 for RHEL 9 | all versions |
Referencias y parches
- RHSA-2026:94608 vendor-advisory
- RHSA-2026:94612 vendor-advisory
- RHSA-2026:94632 vendor-advisory
- RHSA-2026:96291 vendor-advisory
- RHSA-2026:96293 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-92615 vdb-entry
- RHBZ#2518323 issue-tracking