Dracut: dracut: root code execution via dhcp options command injection in networkmanager initrd module
Priority MEDIUM 41CWE-78Published · Updated
Key facts
- Attack vector
- Adjacent network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-78.
Summary
A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP options, such as a malicious root-path, next-server, or bootfile name, to a system using dracut's NetworkManager-based initrd network module. These options are improperly handled and written into a temporary shell script without proper escaping, leading to command injection. This allows the attacker to achieve root code execution within the initramfs during system boot.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.03222 88th percentileScored 2026-11-07
Fix Fixed Red Hat: 6 advisories
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 8 | — | 049-244.git20260529.el8_10 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | — | 049-138.git20220131.el8_4.1 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On | — | 049-138.git20220131.el8_4.1 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | — | 049-203.git20220511.el8_6.1 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On | — | 049-203.git20220511.el8_6.1 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.8 Telecommunications Update Service | — | 049-223.git20230119.el8_8.1 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions | — | 049-223.git20230119.el8_8.1 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.12 | — | 412.86.202610250235-0 | Patch available | CNA |
| Red Hat | Red Hat Hardened Images | — | 109-7.hum1 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 10 | — | — | Not affected | CNA |
| Red Hat | Red Hat Enterprise Linux 6 | — | — | Not affected | CNA |
| Red Hat | Red Hat Enterprise Linux 7 | — | — | Not affected | CNA |
| Red Hat | Red Hat Enterprise Linux 9 | — | — | Not affected | CNA |
| Red Hat | Red Hat OpenShift Container Platform 5 | — | — | Not affected | CNA |
- Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in 049-244.git20260529.el8_10 Patch available CNA
- Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support VendorRed Hat Affected — Fixed in 049-138.git20220131.el8_4.1 Patch available CNA
- Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On VendorRed Hat Affected — Fixed in 049-138.git20220131.el8_4.1 Patch available CNA
- Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support VendorRed Hat Affected — Fixed in 049-203.git20220511.el8_6.1 Patch available CNA
- Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On VendorRed Hat Affected — Fixed in 049-203.git20220511.el8_6.1 Patch available CNA
- Red Hat Enterprise Linux 8.8 Telecommunications Update Service VendorRed Hat Affected — Fixed in 049-223.git20230119.el8_8.1 Patch available CNA
- Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions VendorRed Hat Affected — Fixed in 049-223.git20230119.el8_8.1 Patch available CNA
- Red Hat OpenShift Container Platform 4.12 VendorRed Hat Affected — Fixed in 412.86.202610250235-0 Patch available CNA
- Red Hat Hardened Images VendorRed Hat Affected — Fixed in 109-7.hum1 Patch available CNA
- Red Hat Enterprise Linux 10 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Enterprise Linux 6 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Enterprise Linux 7 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat OpenShift Container Platform 5 VendorRed Hat Affected — Fixed in — Not affected CNA
CPE names CNA · 14
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:/o:redhat:enterprise_linux:8::baseos | 8 | — | Red Hat |
| cpe:/o:redhat:rhel_aus:8.4::baseos | 8.4 | — | Red Hat |
| cpe:/o:redhat:rhel_eus_long_life:8.4::baseos | 8.4 | — | Red Hat |
| cpe:/o:redhat:rhel_aus:8.6::baseos | 8.6 | — | Red Hat |
| cpe:/o:redhat:rhel_eus_long_life:8.6::baseos | 8.6 | — | Red Hat |
| cpe:/o:redhat:rhel_e4s:8.8::baseos | 8.8 | — | Red Hat |
| cpe:/o:redhat:rhel_tus:8.8::baseos | 8.8 | — | Red Hat |
| cpe:/a:redhat:openshift:4.12::el8 | 4.12 | — | Red Hat |
| cpe:/a:redhat:hummingbird:1 | 1 | — | Red Hat |
| cpe:/a:redhat:enterprise_linux:10 | 10 | — | Red Hat |
- cpe:/o:redhat:enterprise_linux:8::baseos Versions 8 — ·Red Hat
- cpe:/o:redhat:rhel_aus:8.4::baseos Versions 8.4 — ·Red Hat
- cpe:/o:redhat:rhel_eus_long_life:8.4::baseos Versions 8.4 — ·Red Hat
- cpe:/o:redhat:rhel_aus:8.6::baseos Versions 8.6 — ·Red Hat
- cpe:/o:redhat:rhel_eus_long_life:8.6::baseos Versions 8.6 — ·Red Hat
- cpe:/o:redhat:rhel_e4s:8.8::baseos Versions 8.8 — ·Red Hat
- cpe:/o:redhat:rhel_tus:8.8::baseos Versions 8.8 — ·Red Hat
- cpe:/a:redhat:openshift:4.12::el8 Versions 4.12 — ·Red Hat
- cpe:/a:redhat:hummingbird:1 Versions 1 — ·Red Hat
- cpe:/a:redhat:enterprise_linux:10 Versions 10 — ·Red Hat
Remediation
Red Hat 6 advisories
- RHSA-2026:90272 Released 2026-10-27 · Red Hat rating CriticalOpenShift Container Platform 4.12.102 bug fix and security update
- Red Hat OpenShift Container Platform 4.12 rhcos-x86_64-412.86.202610250235-0
- RHSA-2026:69118 Released 2026-09-21 · Red Hat rating Importantdracut security update
- Red Hat Enterprise Linux BaseOS AUS (v.8.4) dracut-049-138.git20220131.el8_4.1, dracut-caps-049-138.git20220131.el8_4.1, dracut-config-generic-049-138.git20220131.el8_4.1 +5
- Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4) dracut-049-138.git20220131.el8_4.1, dracut-caps-049-138.git20220131.el8_4.1, dracut-config-generic-049-138.git20220131.el8_4.1 +5
- RHSA-2026:69119 Released 2026-09-21 · Red Hat rating Importantdracut security update
- Red Hat Enterprise Linux BaseOS AUS (v.8.6) dracut-049-203.git20220511.el8_6.1, dracut-caps-049-203.git20220511.el8_6.1, dracut-config-generic-049-203.git20220511.el8_6.1 +5
- Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6) dracut-049-203.git20220511.el8_6.1, dracut-caps-049-203.git20220511.el8_6.1, dracut-config-generic-049-203.git20220511.el8_6.1 +5
Show 3 more Red Hat advisories
- RHSA-2026:61252 Released 2026-08-31 · Red Hat rating Importantdracut security update
- Red Hat Enterprise Linux BaseOS E4S (v.8.8) dracut-049-223.git20230119.el8_8.1, dracut-network-049-223.git20230119.el8_8.1
- Red Hat Enterprise Linux BaseOS TUS (v.8.8) dracut-049-223.git20230119.el8_8.1, dracut-network-049-223.git20230119.el8_8.1
- RHSA-2026:40700 Released 2026-07-16 · Red Hat rating ImportantRed Hat Hardened Images RPMs bug fix and enhancement update
- Red Hat Hardened Images dracut-109-7.hum1@aarch64, dracut-109-7.hum1@src, dracut-109-7.hum1@x86_64 +14
- RHSA-2026:26534 Released 2026-06-17 · Red Hat rating Importantdracut security update
- Red Hat Enterprise Linux BaseOS (v. 8) dracut-049-244.git20260529.el8_10, dracut-caps-049-244.git20260529.el8_10, dracut-config-generic-049-244.git20260529.el8_10 +5
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux BaseOS (v. 8) | Fixed | RHSA-2026:26534 |
| Red Hat Enterprise Linux BaseOS AUS (v.8.4) | Fixed | RHSA-2026:69118 |
| Red Hat Enterprise Linux BaseOS AUS (v.8.6) | Fixed | RHSA-2026:69119 |
| Red Hat Enterprise Linux BaseOS E4S (v.8.8) | Fixed | RHSA-2026:61252 |
| Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4) | Fixed | RHSA-2026:69118 |
| Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6) | Fixed | RHSA-2026:69119 |
| Red Hat Enterprise Linux BaseOS TUS (v.8.8) | Fixed | RHSA-2026:61252 |
| Red Hat Hardened Images | Fixed | RHSA-2026:40700 |
| Red Hat OpenShift Container Platform 4.12 | Fixed | RHSA-2026:90272 |
Not affected: 7 products
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 9
- Red Hat Enterprise Linux BaseOS E4S (v.8.8)
- Red Hat Enterprise Linux BaseOS TUS (v.8.8)
- Red Hat OpenShift Container Platform 5
Timeline
- 2026-10-02 Threatist record created from CVE-2026-16445
- 2026-10-03 Alias added: GHSA-4672-282m-8fgr
- 2026-10-25 Priority changed: LOW → MEDIUM
- 2026-10-27 Fix available: [email protected] · CNA
- 2026-10-27 1 new reference · CNA
- 2026-10-27 Fix available: Red Hat OpenShift Container Platform 4.12 · Red Hat
- 2026-10-29 Fix available: RHSA-2026:90272 · Red Hat
- 2026-10-30 Affected versions changed · CNA
- 2026-10-30 Affected versions changed · Red Hat
References
More Red Hat vulnerabilities
- TI-2019-15875 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-15874 Protection mechanism failure in Jenkins Script Security Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
- TI-2019-05363 Code injection in Elastic Kibana KEVCVSS 3.1CRITICAL 10.0
- TI-2019-03949 Out-of-bounds write in ESXi and Horizon DaaS KEVCVSS 3.1CRITICAL 9.8
- TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8
Sources
- CVE-2026-16445 · CVE Program
- CVE-2026-16445 · NVD
- FIRST EPSS
- GHSA-4672-282m-8fgr · GitHub Advisory Database · CC BY 4.0
- CVE-2026-16445 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences