Read the docs
TI-2026-39261 Aliases CVE-2026-54369GHSA-53ch-pxc8-6g72

acl < 2.4.0 Symlink Traversal Privilege Escalation via libacl Functions

Priority LOW 37CWE-59Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · High · None
Fix status
Partial Red Hat: 47 fixed, 3 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat.

Summary

acl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() that allows local attackers to escalate privileges by replacing any pathname component with a symbolic link. Attackers who control any component of a pathname processed by a privileged caller can redirect ACL read or write operations to arbitrary files or directories, enabling unauthorized manipulation of access control lists and local privilege escalation.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00153 4th percentileScored 2026-11-07
Fix Partial acl (acl project): 2.4.0Red Hat: 93 advisoriesRed Hat: 47 fixed, 3 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
acl projectaclbefore 2.4.02.4.0Patch availableCNA
  • acl Vendoracl project Affected before 2.4.0 Fixed in 2.4.0 Patch available CNA

Remediation

  • Fix · CNA acl (acl project) Fixed in 2.4.0

Red Hat 93 advisories

  • RHSA-2026:92452 Released 2026-10-29 · Red Hat rating Critical
    Red Hat Enterprise Linux AI 3.5.2 enhancement update
    • Red Hat Enterprise Linux AI 3.5 registry.redhat.io/rhelai3/bootc-aws-cuda-rhel9, registry.redhat.io/rhelai3/bootc-azure-cuda-rhel9, registry.redhat.io/rhelai3/bootc-azure-rocm-rhel9 +3
  • RHSA-2026:92449 Released 2026-10-29 · Red Hat rating Critical
    Red Hat Enterprise Linux AI 3.5.2 enhancement update
    • Red Hat Enterprise Linux AI 3.5 registry.redhat.io/rhelai3/disk-image-cuda-rhel9
  • RHSA-2026:90272 Released 2026-10-27 · Red Hat rating Critical
    OpenShift Container Platform 4.12.102 bug fix and security update
    • Red Hat OpenShift Container Platform 4.12 rhcos-x86_64-412.86.202610250235-0
Show 90 more Red Hat advisories
  • RHSA-2026:89725 Released 2026-10-27 · Red Hat rating Critical
    OpenShift Container Platform 4.18.59 bug fix and security update
    • Red Hat OpenShift Container Platform 4.18 rhcos-aarch64-418.94.202610242013-0, rhcos-ppc64le-418.94.202610242013-0, rhcos-s390x-418.94.202610242013-0 +1
  • RHSA-2026:82811 Released 2026-10-22 · Red Hat rating Important
    OpenShift Container Platform 4.15.70 bug fix and security update
    • Red Hat OpenShift Container Platform 4.15 rhcos-aarch64-415.92.202610081130-0, rhcos-ppc64le-415.92.202610081130-0, rhcos-s390x-415.92.202610081130-0 +1
  • RHSA-2026:77320 Released 2026-10-15 · Red Hat rating Important
    OpenShift Container Platform 4.13.72 bug fix and security update
    • Red Hat OpenShift Container Platform 4.13 rhcos-x86_64-413.92.202609302032-0
  • RHSA-2026:82888 Released 2026-10-14 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.17.2
    • Cert Manager support for Red Hat OpenShift release 1.17 registry.redhat.io/cert-manager/cert-manager-operator-bundle
  • RHSA-2026:82857 Released 2026-10-14 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.18.2
    • Cert Manager support for Red Hat OpenShift release 1.18 registry.redhat.io/cert-manager/cert-manager-operator-bundle
  • RHSA-2026:82415 Released 2026-10-13 · Red Hat rating Critical
    Red Hat AI Inference 3.5.2 (cpu)
    • Red Hat AI Inference Server 3.5 registry.redhat.io/rhaii/vllm-cpu-rhel9
  • RHSA-2026:82372 Released 2026-10-13 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.18.2
    • Cert Manager support for Red Hat OpenShift release 1.18 registry.redhat.io/cert-manager/cert-manager-operator-rhel9
  • RHSA-2026:82371 Released 2026-10-13 · Red Hat rating Critical
    Red Hat AI Inference 3.5.2 (spyre)
    • Red Hat AI Inference Server 3.5 registry.redhat.io/rhaii/vllm-spyre-rhel9
  • RHSA-2026:82368 Released 2026-10-13 · Red Hat rating Critical
    Red Hat AI Inference 3.5.2 (cuda)
    • Red Hat AI Inference Server 3.5 registry.redhat.io/rhaii/vllm-cuda-rhel9
  • RHSA-2026:82354 Released 2026-10-13 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.18.2
    • Cert Manager support for Red Hat OpenShift release 1.18 registry.redhat.io/cert-manager/cert-manager-istio-csr-rhel9
  • RHSA-2026:82347 Released 2026-10-13 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.18.2
    • Cert Manager support for Red Hat OpenShift release 1.18 registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9, registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9
  • RHSA-2026:82336 Released 2026-10-13 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.17.1
    • Cert Manager support for Red Hat OpenShift release 1.17 registry.redhat.io/cert-manager/cert-manager-istio-csr-rhel9
  • RHSA-2026:82322 Released 2026-10-13 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.17.2
    • Cert Manager support for Red Hat OpenShift release 1.17 registry.redhat.io/cert-manager/cert-manager-operator-rhel9
  • RHSA-2026:82304 Released 2026-10-13 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.17.2
    • Cert Manager support for Red Hat OpenShift release 1.17 registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9, registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9
  • RHSA-2026:82066 Released 2026-10-13 · Red Hat rating Important
    Red Hat AI Inference Model Optimization Tools 3.5.2 (CUDA)
    • Red Hat AI Inference Server 3.5 registry.redhat.io/rhaii/model-opt-cuda-rhel9
  • RHSA-2026:82061 Released 2026-10-13 · Red Hat rating Critical
    Red Hat AI Inference Tech Preview 3.5.2 (Gaudi)
    • Red Hat AI Inference Server 3.5 registry.redhat.io/rhaii/vllm-gaudi-rhel9
  • RHSA-2026:82059 Released 2026-10-13 · Red Hat rating Critical
    Red Hat AI Inference 3.5.2 (ROCm)
    • Red Hat AI Inference Server 3.5 registry.redhat.io/rhaii/vllm-rocm-rhel9
  • RHSA-2026:81201 Released 2026-10-12 · Red Hat rating Important
    Cost Management Metrics Operator Update
    • Cost Management 4 registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator
  • RHSA-2026:81127 Released 2026-10-12 · Red Hat rating Important
    Red Hat AI Base Images 3.3.5 (CUDA 12.9)
    • Red Hat OpenShift AI 3.3 registry.redhat.io/rhai/base-image-cuda-12.9-rhel9
  • RHSA-2026:80756 Released 2026-10-12 · Red Hat rating Important
    Red Hat AI Base Images 3.3.5 (CUDA 13.0)
    • Red Hat OpenShift AI 3.3 registry.redhat.io/rhai/base-image-cuda-13.0-rhel9
  • RHSA-2026:73866 Released 2026-10-08 · Red Hat rating Important
    OpenShift Container Platform 4.14.75 bug fix and security update
    • Red Hat OpenShift Container Platform 4.14 rhcos-aarch64-414.92.202609282130-0, rhcos-ppc64le-414.92.202609282130-0, rhcos-s390x-414.92.202609282130-0 +1
  • RHSA-2026:73851 Released 2026-10-08 · Red Hat rating Important
    OpenShift Container Platform 4.16.72 bug fix update
    • Red Hat OpenShift Container Platform 4.16 rhcos-aarch64-416.94.202609281908-0, rhcos-ppc64le-416.94.202609281908-0, rhcos-s390x-416.94.202609281908-0 +1
  • RHSA-2026:76042 Released 2026-10-05 · Red Hat rating Important
    Red Hat AI Base Images 3.5.2 (CUDA)
    • Red Hat OpenShift AI 3.5 registry.redhat.io/rhai/base-image-cuda-12.9-rhel9
  • RHSA-2026:75660 Released 2026-10-05 · Red Hat rating Important
    Red Hat AI Base Images 3.5.2 (Spyre)
    • Red Hat OpenShift AI 3.5 registry.redhat.io/rhai/base-image-spyre-rhel9
  • RHSA-2026:75659 Released 2026-10-05 · Red Hat rating Important
    Red Hat AI Base Images 3.5.2 (ROCm 7.14)
    • Red Hat OpenShift AI 3.5 registry.redhat.io/rhai/base-image-rocm-7.14-rhel9
  • RHSA-2026:75658 Released 2026-10-05 · Red Hat rating Important
    Red Hat AI Base Images 3.5.2 (TPU)
    • Red Hat OpenShift AI 3.5 registry.redhat.io/rhai/base-image-tpu-rhel9
  • RHSA-2026:75657 Released 2026-10-05 · Red Hat rating Important
    Red Hat AI Base Images 3.5.2 (CUDA 13.0)
    • Red Hat OpenShift AI 3.5 registry.redhat.io/rhai/base-image-cuda-13.0-rhel9
  • RHSA-2026:75655 Released 2026-10-05 · Red Hat rating Important
    Red Hat AI Base Images 3.5.2 (Rubin)
    • Red Hat OpenShift AI 3.5 registry.redhat.io/rhai/base-image-rubin-rhel9
  • RHSA-2026:75654 Released 2026-10-05 · Red Hat rating Important
    Red Hat AI Base Images 3.5.2 (Neuron)
    • Red Hat OpenShift AI 3.5 registry.redhat.io/rhai/base-image-neuron-rhel9
  • RHSA-2026:75652 Released 2026-10-05 · Red Hat rating Important
    Red Hat AI Base Images 3.5.2 (CPU)
    • Red Hat OpenShift AI 3.5 registry.redhat.io/rhai/base-image-cpu-rhel9
  • RHSA-2026:74771 Released 2026-10-01 · Red Hat rating Important
    Red Hat AI Base Images 3.5.2 (Gaudi)
    • Red Hat OpenShift AI 3.5 registry.redhat.io/rhai/base-image-gaudi-rhel9
  • RHSA-2026:74688 Released 2026-10-01 · Red Hat rating Important
    Red Hat AI Base Images 3.4.3 (ROCm 6.4)
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhai/base-image-rocm-6.4-rhel9
  • RHSA-2026:74687 Released 2026-10-01 · Red Hat rating Important
    Red Hat AI Base Images 3.4.3 (ROCm 7.1)
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhai/base-image-rocm-7.1-rhel9
  • RHSA-2026:74685 Released 2026-10-01 · Red Hat rating Important
    Red Hat AI Base Images 3.4.3 (CUDA 12.9)
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhai/base-image-cuda-12.9-rhel9
  • RHSA-2026:74683 Released 2026-10-01 · Red Hat rating Important
    Red Hat AI Base Images 3.4.3 (CUDA 13.0)
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhai/base-image-cuda-13.0-rhel9
  • RHSA-2026:74681 Released 2026-10-01 · Red Hat rating Important
    Red Hat AI Base Images 3.4.3 (Spyre)
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhai/base-image-spyre-rhel9
  • RHSA-2026:74679 Released 2026-10-01 · Red Hat rating Important
    Red Hat AI Base Images 3.4.3 (CPU)
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhai/base-image-cpu-rhel9
  • RHSA-2026:74678 Released 2026-10-01 · Red Hat rating Important
    Red Hat AI Base Images 3.4.3 (Gaudi)
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhai/base-image-gaudi-rhel9
  • RHSA-2026:74677 Released 2026-10-01 · Red Hat rating Important
    Red Hat AI Base Images 3.4.3 (TPU)
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhai/base-image-tpu-rhel9
  • RHSA-2026:74674 Released 2026-10-01 · Red Hat rating Important
    Red Hat AI Base Images 3.4.3 (Neuron)
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhai/base-image-neuron-rhel9
  • RHSA-2026:70586 Released 2026-10-01 · Red Hat rating Important
    OpenShift Container Platform 4.17.58 bug fix and security update
    • Red Hat OpenShift Container Platform 4.17 rhcos-aarch64-417.94.202609191027-0, rhcos-ppc64le-417.94.202609191027-0, rhcos-s390x-417.94.202609191027-0 +1
  • RHSA-2026:74463 Released 2026-10-01 · Red Hat rating Important
    Red Hat AI Base Images 3.2.3 (ROCm 7.0)
    • Red Hat OpenShift AI 3.2 registry.redhat.io/rhai/base-image-rocm-rhel9
  • RHSA-2026:74462 Released 2026-10-01 · Red Hat rating Important
    Red Hat AI Base Images 3.2.3 (CUDA 12.9)
    • Red Hat OpenShift AI 3.2 registry.redhat.io/rhai/base-image-cuda-rhel9
  • RHSA-2026:74461 Released 2026-10-01 · Red Hat rating Important
    Red Hat AI Base Images 3.2.3 (Spyre)
    • Red Hat OpenShift AI 3.2 registry.redhat.io/rhai/base-image-spyre-rhel9
  • RHSA-2026:74460 Released 2026-10-01 · Red Hat rating Important
    Red Hat AI Base Images 3.2.3 (CPU)
    • Red Hat OpenShift AI 3.2 registry.redhat.io/rhai/base-image-cpu-rhel9
  • RHSA-2026:74459 Released 2026-10-01 · Red Hat rating Important
    Red Hat AI Base Images 3.2.3 (ROCm 6.4)
    • Red Hat OpenShift AI 3.2 registry.redhat.io/rhai/base-image-rocm-rhel9
  • RHSA-2026:74458 Released 2026-10-01 · Red Hat rating Important
    Red Hat AI Base Images 3.2.3 (TPU)
    • Red Hat OpenShift AI 3.2 registry.redhat.io/rhai/base-image-tpu-rhel9
  • RHSA-2026:74450 Released 2026-10-01 · Red Hat rating Important
    Red Hat AI Base Images 3.3.4 (Neuron)
    • Red Hat OpenShift AI 3.3 registry.redhat.io/rhai/base-image-neuron-rhel9
  • RHSA-2026:74365 Released 2026-10-01 · Red Hat rating Important
    Red Hat AI Base Images 3.3.4 (Spyre)
    • Red Hat OpenShift AI 3.3 registry.redhat.io/rhai/base-image-spyre-rhel9
  • RHSA-2026:74364 Released 2026-10-01 · Red Hat rating Important
    Red Hat AI Base Images 3.3.4 (CUDA 12.9)
    • Red Hat OpenShift AI 3.3 registry.redhat.io/rhai/base-image-cuda-12.9-rhel9
  • RHSA-2026:74363 Released 2026-10-01 · Red Hat rating Important
    Red Hat AI Base Images 3.3.4 (ROCm 7.0)
    • Red Hat OpenShift AI 3.3 registry.redhat.io/rhai/base-image-rocm-7.0-rhel9
  • RHSA-2026:74362 Released 2026-10-01 · Red Hat rating Important
    Red Hat AI Base Images 3.3.4 (CUDA 13.0)
    • Red Hat OpenShift AI 3.3 registry.redhat.io/rhai/base-image-cuda-13.0-rhel9
  • RHSA-2026:74361 Released 2026-10-01 · Red Hat rating Important
    Red Hat AI Base Images 3.3.4 (ROCm 6.4)
    • Red Hat OpenShift AI 3.3 registry.redhat.io/rhai/base-image-rocm-6.4-rhel9
  • RHSA-2026:74360 Released 2026-10-01 · Red Hat rating Important
    Red Hat AI Base Images 3.3.4 (TPU)
    • Red Hat OpenShift AI 3.3 registry.redhat.io/rhai/base-image-tpu-rhel9
  • RHSA-2026:74359 Released 2026-10-01 · Red Hat rating Important
    Red Hat AI Base Images 3.3.4 (CPU)
    • Red Hat OpenShift AI 3.3 registry.redhat.io/rhai/base-image-cpu-rhel9
  • RHSA-2026:73962 Released 2026-09-30 · Red Hat rating Important
    Red Hat AI Base Images 3.0.3 (cuda)
    • Red Hat OpenShift AI 3.0 registry.redhat.io/rhai/base-image-cuda-rhel9
  • RHSA-2026:73961 Released 2026-09-30 · Red Hat rating Important
    Red Hat AI Base Images 3.0.3 (spyre)
    • Red Hat OpenShift AI 3.0 registry.redhat.io/rhai/base-image-spyre-rhel9
  • RHSA-2026:73960 Released 2026-09-30 · Red Hat rating Important
    Red Hat AI Base Images 3.0.3 (cpu)
    • Red Hat OpenShift AI 3.0 registry.redhat.io/rhai/base-image-cpu-rhel9
  • RHSA-2026:73959 Released 2026-09-30 · Red Hat rating Important
    Red Hat AI Base Images 3.0.3 (tpu)
    • Red Hat OpenShift AI 3.0 registry.redhat.io/rhai/base-image-tpu-rhel9
  • RHSA-2026:71440 Released 2026-09-30 · Red Hat rating Important
    OpenShift Container Platform 4.19.49 bug fix and security update
    • Red Hat OpenShift Container Platform 4.19 rhcos-aarch64-4.19.9.6.202609221245-0, rhcos-ppc64le-4.19.9.6.202609221245-0, rhcos-s390x-4.19.9.6.202609221245-0 +1
  • RHSA-2026:73930 Released 2026-09-30 · Red Hat rating Important
    Red Hat AI Inference Server 3.2.2 (rocm)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/vllm-rocm-rhel9
  • RHSA-2026:73929 Released 2026-09-30 · Red Hat rating Important
    Red Hat AI Inference Server 3.2.2 (cuda)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/vllm-cuda-rhel9
  • RHSA-2026:73909 Released 2026-09-30 · Red Hat rating Important
    Red Hat AI Base Images 3.0.3 (rocm)
    • Red Hat OpenShift AI 3.0 registry.redhat.io/rhai/base-image-rocm-rhel9
  • RHSA-2026:73859 Released 2026-09-30 · Red Hat rating Important
    Red Hat AI Inference Server Model Optimization Tools 3.2.2 (CUDA)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/model-opt-cuda-rhel9
  • RHSA-2026:71444 Released 2026-09-29 · Red Hat rating Important
    OpenShift Container Platform 4.21.35 bug fix and security update
    • Red Hat OpenShift Container Platform 4.21 rhcos-aarch64-4.21.9.6.202609230720-0, rhcos-ppc64le-4.21.9.6.202609230720-0, rhcos-s390x-4.21.9.6.202609230720-0 +1
  • RHSA-2026:71442 Released 2026-09-29 · Red Hat rating Important
    OpenShift Container Platform 4.20.40 bug fix and security update
    • Red Hat OpenShift Container Platform 4.20 rhcos-aarch64-4.20.9.6.202609222234-0, rhcos-ppc64le-4.20.9.6.202609222234-0, rhcos-s390x-4.20.9.6.202609222234-0 +1
  • RHSA-2026:72819 Released 2026-09-28 · Red Hat rating Important
    acl security update
    • Red Hat Enterprise Linux BaseOS AUS (v.8.6) acl-2.4.0-0.el8_6.1, libacl-2.4.0-0.el8_6.1, libacl-devel-2.4.0-0.el8_6.1
    • Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6) acl-2.4.0-0.el8_6.1, libacl-2.4.0-0.el8_6.1, libacl-devel-2.4.0-0.el8_6.1
  • RHSA-2026:72820 Released 2026-09-28 · Red Hat rating Important
    acl security update
    • Red Hat Enterprise Linux BaseOS AUS (v.8.4) acl-2.4.0-0.el8_4.1, libacl-2.4.0-0.el8_4.1, libacl-devel-2.4.0-0.el8_4.1
    • Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4) acl-2.4.0-0.el8_4.1, libacl-2.4.0-0.el8_4.1, libacl-devel-2.4.0-0.el8_4.1
  • RHSA-2026:72502 Released 2026-09-28 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.20.1
    • Cert Manager support for Red Hat OpenShift release 1.20 registry.redhat.io/cert-manager/cert-manager-trust-manager-rhel9
  • RHSA-2026:72476 Released 2026-09-28 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.20.1
    • Cert Manager support for Red Hat OpenShift release 1.20 registry.redhat.io/cert-manager/cert-manager-operator-rhel9
  • RHSA-2026:72475 Released 2026-09-28 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.20.1
    • Cert Manager support for Red Hat OpenShift release 1.20 registry.redhat.io/cert-manager/cert-manager-istio-csr-rhel9
  • RHSA-2026:72470 Released 2026-09-28 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.20.1
    • Cert Manager support for Red Hat OpenShift release 1.20 registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9, registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9
  • RHSA-2026:72399 Released 2026-09-28 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.20.1
    • Cert Manager support for Red Hat OpenShift release 1.20 registry.redhat.io/cert-manager/cert-manager-operator-rhel9
  • RHSA-2026:72395 Released 2026-09-28 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.20.1
    • Cert Manager support for Red Hat OpenShift release 1.20 registry.redhat.io/cert-manager/cert-manager-istio-csr-rhel9
  • RHSA-2026:72394 Released 2026-09-28 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.20.1
    • Cert Manager support for Red Hat OpenShift release 1.20 registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9
  • RHSA-2026:71656 Released 2026-09-24 · Red Hat rating Important
    acl security update
    • Red Hat Enterprise Linux BaseOS E4S (v.8.8) acl-2.4.0-0.el8_8.1, libacl-2.4.0-0.el8_8.1, libacl-devel-2.4.0-0.el8_8.1
    • Red Hat Enterprise Linux BaseOS TUS (v.8.8) acl-2.4.0-0.el8_8.1, libacl-2.4.0-0.el8_8.1, libacl-devel-2.4.0-0.el8_8.1
  • RHSA-2026:67140 Released 2026-09-14 · Red Hat rating Important
    acl security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6)
    • Red Hat Enterprise Linux BaseOS EUS (v.9.6) acl-2.4.0-0.el9_6.1
  • RHSA-2026:67144 Released 2026-09-14 · Red Hat rating Important
    acl security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.4)
    • Red Hat Enterprise Linux BaseOS E4S (v.9.4) acl-2.4.0-0.el9_4.1
  • RHSA-2026:67142 Released 2026-09-14 · Red Hat rating Important
    acl security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2)
    • Red Hat Enterprise Linux BaseOS E4S (v.9.2) acl-2.4.0-0.el9_2.1
  • RHSA-2026:64805 Released 2026-09-08 · Red Hat rating Important
    acl security update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0)
    • Red Hat Enterprise Linux BaseOS EUS (v. 10.0) acl-2.4.0-0.el10_0.1, libacl-2.4.0-0.el10_0.1
  • RHSA-2026:58981 Released 2026-08-24 · Red Hat rating Critical
    Red Hat Update Infrastructure 5.3 Technology Preview security update
    • Red Hat Update Infrastructure 5 registry.redhat.io/rhui5/cds-kubernetes-tp-rhel9, registry.redhat.io/rhui5/installer-tp-rhel9, registry.redhat.io/rhui5/rhua-tp-rhel9
  • RHSA-2026:54769 Released 2026-08-18 · Red Hat rating Important
    OpenShift Container Platform 4.22.10 bug fix and security update
    • Red Hat OpenShift Container Platform 4.22 rhcos-aarch64-4.22.9.8.202608130832-0, rhcos-ppc64le-4.22.9.8.202608130832-0, rhcos-s390x-4.22.9.8.202608130832-0 +1
  • RHSA-2026:53371 Released 2026-08-11 · Red Hat rating Important
    Insights proxy Container Image
    • Red Hat Insights proxy 1.5 registry.redhat.io/insights-proxy/insights-proxy-container-rhel9
  • RHSA-2026:50205 Released 2026-08-04 · Red Hat rating Important
    Red Hat build of OpenTelemetry 3.10.1 release
    • Red Hat OpenShift distributed tracing 3.10.1 registry.redhat.io/rhosdt/opentelemetry-collector-rhel9, registry.redhat.io/rhosdt/opentelemetry-rhel9-operator
  • RHSA-2026:46836 Released 2026-07-27 · Red Hat rating Important
    A Subscription Management tool for finding and reporting Red Hat product usage
    • Red Hat Discovery 2 registry.redhat.io/discovery/discovery-server-rhel9, registry.redhat.io/discovery/discovery-ui-rhel9
  • RHSA-2026:44481 Released 2026-07-23 · Red Hat rating Important
    Red Hat Update Infrastructure 5.2 security update
    • Red Hat Update Infrastructure 5 registry.redhat.io/rhui5/cds-kubernetes-rhel9, registry.redhat.io/rhui5/cds-rhel9, registry.redhat.io/rhui5/haproxy-rhel9 +2
  • RHSA-2026:43420 Released 2026-07-22 · Red Hat rating Important
    acl security update
    • Red Hat Enterprise Linux BaseOS (v. 8) acl-2.4.0-1.el8_10, libacl-2.4.0-1.el8_10, libacl-devel-2.4.0-1.el8_10
  • RHSA-2026:42736 Released 2026-07-21 · Red Hat rating Important
    acl security update
    • Red Hat Enterprise Linux AppStream (v. 9) libacl-devel-2.4.0-1.el9_8
    • Red Hat Enterprise Linux BaseOS (v. 9) acl-2.4.0-1.el9_8, libacl-2.4.0-1.el9_8
  • RHSA-2026:42739 Released 2026-07-21 · Red Hat rating Important
    acl security update
    • Red Hat Enterprise Linux AppStream (v. 10) libacl-devel-2.4.0-1.el10_2
    • Red Hat Enterprise Linux BaseOS (v. 10) acl-2.4.0-1.el10_2, libacl-2.4.0-1.el10_2
  • RHSA-2026:34351 Released 2026-07-01 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images acl-2.4.0-0.1.hum1@aarch64, acl-2.4.0-0.1.hum1@src, acl-2.4.0-0.1.hum1@x86_64 +4

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    acl 2.4.0

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2026-39262 acl < 2.4.0 TOCTOU Symlink Traversal via getfacl/setfacl/chaclPriority LOW 32
    Show all 2 records →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix yet
Red Hat Enterprise Linux 7AffectedNo fix yet
Red Hat OpenShift Container Platform 5AffectedNo fix yet
Cert Manager support for Red Hat OpenShift release 1.17Fixed RHSA-2026:82304, RHSA-2026:82322, RHSA-2026:82336, RHSA-2026:82888
Cert Manager support for Red Hat OpenShift release 1.18Fixed RHSA-2026:82347, RHSA-2026:82354, RHSA-2026:82372, RHSA-2026:82857
Cert Manager support for Red Hat OpenShift release 1.20Fixed RHSA-2026:72394, RHSA-2026:72395, RHSA-2026:72399, RHSA-2026:72470, RHSA-2026:72475, RHSA-2026:72476, RHSA-2026:72502
Cost Management 4Fixed RHSA-2026:81201
Red Hat AI Inference Server 3.2Fixed RHSA-2026:73859, RHSA-2026:73929, RHSA-2026:73930
Red Hat AI Inference Server 3.5Fixed RHSA-2026:82059, RHSA-2026:82061, RHSA-2026:82066, RHSA-2026:82368, RHSA-2026:82371, RHSA-2026:82415
Red Hat Discovery 2Fixed RHSA-2026:46836
Red Hat Enterprise Linux AI 3.5Fixed RHSA-2026:92449, RHSA-2026:92452
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:42739
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:42736
Red Hat Enterprise Linux AppStream E4S (v.9.2)Fixed RHSA-2026:67142
Red Hat Enterprise Linux AppStream E4S (v.9.4)Fixed RHSA-2026:67144
Red Hat Enterprise Linux AppStream EUS (v. 10.0)Fixed RHSA-2026:64805
Red Hat Enterprise Linux AppStream EUS (v.9.6)Fixed RHSA-2026:67140
Red Hat Enterprise Linux BaseOS (v. 10)Fixed RHSA-2026:42739
Red Hat Enterprise Linux BaseOS (v. 8)Fixed RHSA-2026:43420
Red Hat Enterprise Linux BaseOS (v. 9)Fixed RHSA-2026:42736
Red Hat Enterprise Linux BaseOS AUS (v.8.4)Fixed RHSA-2026:72820
Red Hat Enterprise Linux BaseOS AUS (v.8.6)Fixed RHSA-2026:72819
Red Hat Enterprise Linux BaseOS E4S (v.8.8)Fixed RHSA-2026:71656
Red Hat Enterprise Linux BaseOS E4S (v.9.2)Fixed RHSA-2026:67142
Red Hat Enterprise Linux BaseOS E4S (v.9.4)Fixed RHSA-2026:67144
Red Hat Enterprise Linux BaseOS EUS (v. 10.0)Fixed RHSA-2026:64805
Red Hat Enterprise Linux BaseOS EUS (v.9.6)Fixed RHSA-2026:67140
Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)Fixed RHSA-2026:72820
Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6)Fixed RHSA-2026:72819
Red Hat Enterprise Linux BaseOS TUS (v.8.8)Fixed RHSA-2026:71656
Red Hat Hardened ImagesFixed RHSA-2026:34351
Red Hat Insights proxy 1.5Fixed RHSA-2026:53371
Red Hat OpenShift AI 3.0Fixed RHSA-2026:73909, RHSA-2026:73959, RHSA-2026:73960, RHSA-2026:73961, RHSA-2026:73962
Red Hat OpenShift AI 3.2Fixed RHSA-2026:74458, RHSA-2026:74459, RHSA-2026:74460, RHSA-2026:74461, RHSA-2026:74462, RHSA-2026:74463
Red Hat OpenShift AI 3.3Fixed RHSA-2026:74359, RHSA-2026:74360, RHSA-2026:74361, RHSA-2026:74362, RHSA-2026:74363, RHSA-2026:74364, RHSA-2026:74365, RHSA-2026:74450, RHSA-2026:80756, RHSA-2026:81127
Red Hat OpenShift AI 3.4Fixed RHSA-2026:74674, RHSA-2026:74677, RHSA-2026:74678, RHSA-2026:74679, RHSA-2026:74681, RHSA-2026:74683, RHSA-2026:74685, RHSA-2026:74687, RHSA-2026:74688
Red Hat OpenShift AI 3.5Fixed RHSA-2026:74771, RHSA-2026:75652, RHSA-2026:75654, RHSA-2026:75655, RHSA-2026:75657, RHSA-2026:75658, RHSA-2026:75659, RHSA-2026:75660, RHSA-2026:76042
Red Hat OpenShift Container Platform 4.12Fixed RHSA-2026:90272
Red Hat OpenShift Container Platform 4.13Fixed RHSA-2026:77320
Red Hat OpenShift Container Platform 4.14Fixed RHSA-2026:73866
Red Hat OpenShift Container Platform 4.15Fixed RHSA-2026:82811
Red Hat OpenShift Container Platform 4.16Fixed RHSA-2026:73851
Red Hat OpenShift Container Platform 4.17Fixed RHSA-2026:70586
Red Hat OpenShift Container Platform 4.18Fixed RHSA-2026:89725
Red Hat OpenShift Container Platform 4.19Fixed RHSA-2026:71440
Red Hat OpenShift Container Platform 4.20Fixed RHSA-2026:71442
Red Hat OpenShift Container Platform 4.21Fixed RHSA-2026:71444
Red Hat OpenShift Container Platform 4.22Fixed RHSA-2026:54769
Red Hat OpenShift distributed tracing 3.10.1Fixed RHSA-2026:50205
Red Hat Update Infrastructure 5Fixed RHSA-2026:44481, RHSA-2026:58981
Not affected: 18 products
  • Cert Manager support for Red Hat OpenShift release 1.20
  • Cost Management 4
  • Red Hat Enterprise Linux AppStream (v. 10)
  • Red Hat Enterprise Linux AppStream (v. 9)
  • Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • Red Hat Enterprise Linux AppStream E4S (v.9.4)
  • Red Hat Enterprise Linux AppStream EUS (v. 10.0)
  • Red Hat Enterprise Linux AppStream EUS (v.9.6)
  • Red Hat Enterprise Linux BaseOS (v. 10)
  • Red Hat Enterprise Linux BaseOS (v. 8)
  • Red Hat Enterprise Linux BaseOS (v. 9)
  • Red Hat Enterprise Linux BaseOS E4S (v.9.2)
  • Red Hat Enterprise Linux BaseOS E4S (v.9.4)
  • Red Hat Enterprise Linux BaseOS EUS (v. 10.0)
  • Red Hat Enterprise Linux BaseOS EUS (v.9.6)
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift distributed tracing 3.10.1
  • Red Hat Update Infrastructure 5

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-54369
  2. 2026-10-03 Alias added: GHSA-53ch-pxc8-6g72
  3. 2026-10-05 Fix available: RHSA-2026:75659 · Red Hat
  4. 2026-10-05 Fix available: RHSA-2026:75660 · Red Hat
  5. 2026-10-05 Fix available: RHSA-2026:75655 · Red Hat
  6. 2026-10-05 Fix available: RHSA-2026:75657 · Red Hat
  7. 2026-10-05 Fix available: RHSA-2026:75654 · Red Hat
  8. 2026-10-05 Fix available: RHSA-2026:75652 · Red Hat
  9. 2026-10-05 Fix available: RHSA-2026:75658 · Red Hat
  10. 2026-10-05 Affected versions changed · Red Hat
  11. 2026-10-06 Fix available: RHSA-2026:76042 · Red Hat
  12. 2026-10-06 Affected versions changed · Red Hat
  13. 2026-10-09 Fix available: RHSA-2026:73866 · Red Hat
  14. 2026-10-09 Fix available: RHSA-2026:73851 · Red Hat
  15. 2026-10-09 Fix available: Red Hat OpenShift Container Platform 4.14, Red Hat OpenShift Container Platform 4.16 · Red Hat
  16. 2026-10-13 Fix available: RHSA-2026:81201 · Red Hat
  17. 2026-10-13 Fix available: RHSA-2026:82066 · Red Hat
  18. 2026-10-13 Fix available: RHSA-2026:80756 · Red Hat
  19. 2026-10-13 Fix available: RHSA-2026:81127 · Red Hat
  20. 2026-10-13 Fix available: RHSA-2026:82061 · Red Hat
  21. 2026-10-13 Fix available: RHSA-2026:82059 · Red Hat
  22. 2026-10-13 Fix available: Cost Management 4, Red Hat AI Inference Server 3.5 · Red Hat
  23. 2026-10-14 Fix available: RHSA-2026:82368 · Red Hat
  24. 2026-10-14 Fix available: RHSA-2026:82415 · Red Hat
  25. 2026-10-14 Fix available: RHSA-2026:82371 · Red Hat
  26. 2026-10-14 Fix available: RHSA-2026:82304 · Red Hat
  27. 2026-10-14 Fix available: RHSA-2026:82322 · Red Hat
  28. 2026-10-14 Fix available: RHSA-2026:82336 · Red Hat
  29. 2026-10-14 Fix available: RHSA-2026:82372 · Red Hat
  30. 2026-10-14 Fix available: RHSA-2026:82354 · Red Hat
  31. 2026-10-14 Fix available: RHSA-2026:82347 · Red Hat
  32. 2026-10-15 Fix available: RHSA-2026:82857 · Red Hat
  33. 2026-10-15 Fix available: RHSA-2026:82888 · Red Hat
  34. 2026-10-16 Fix available: RHSA-2026:77320 · Red Hat
  35. 2026-10-16 Fix available: Cert Manager support for Red Hat OpenShift release 1.17, Cert Manager support for Red Hat OpenShift release 1.18, Red Hat OpenShift Container Platform 4.13 · Red Hat
  36. 2026-10-23 Fix available: RHSA-2026:82811 · Red Hat
  37. 2026-10-23 Fix available: Red Hat OpenShift Container Platform 4.15 · Red Hat
  38. 2026-10-27 Fix available: Red Hat OpenShift Container Platform 4.12, Red Hat OpenShift Container Platform 4.18 · Red Hat
  39. 2026-10-29 Fix available: RHSA-2026:90272 · Red Hat
  40. 2026-10-29 Fix available: RHSA-2026:89725 · Red Hat
  41. 2026-10-30 Fix available: RHSA-2026:92452 · Red Hat
  42. 2026-10-30 Fix available: RHSA-2026:92449 · Red Hat
  43. 2026-10-30 Fix available: Red Hat Enterprise Linux AI 3.5 · Red Hat
  44. 2026-10-30 Affected versions changed · Red Hat
  45. 2026-10-31 Fix available: Red Hat OpenShift distributed tracing 3.10.1 · Red Hat
  46. 2026-11-06 Affected versions changed · Red Hat

References

Patch 1

Other 1

  • TI-2026-39262 acl < 2.4.0 TOCTOU Symlink Traversal via getfacl/setfacl/chacl CVSS 4.0HIGH 7.2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences