Red Hat Security Advisory

RHSA-2026:34351

Red Hat Hardened Images RPMs Security Update

Released 2026-07-01 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Hardened Images acl-2.4.0-0.1.hum1@aarch64, acl-2.4.0-0.1.hum1@src, acl-2.4.0-0.1.hum1@x86_64 +4

Fixes 2 records

TI-2026-39261 CVE-2026-54369 · GHSA-53ch-pxc8-6g72

acl < 2.4.0 Symlink Traversal Privilege Escalation via libacl Functions

LOW 37

acl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() that allows local attackers to esc…

CVSS 4.0HIGH 8.4 Local Low privileges No interaction EPSS 0.00153 Published 2026-06-29 Partial fix · 2.4.0 CWE-59

TI-2026-39262 CVE-2026-54370 · GHSA-r45p-762r-6pqj

acl < 2.4.0 TOCTOU Symlink Traversal via getfacl/setfacl/chacl

LOW 32

acl before version 2.4.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link between an…

CVSS 4.0HIGH 7.2 Local Low privileges No interaction EPSS 0.00088 Published 2026-06-29 Partial fix · 2.4.0 CWE-367