Read the docs
TI-2026-62466 Aliases CVE-2026-92615GHSA-q6r7-r3xg-x977

Flightctl: flightctl: package-global go-git https transport mutated per-repo -- cross-tenant tls-config bleed

Priority LOW 29CWE-413Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
High · Low · None
Fix status
Partial Red Hat: 3 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.

Summary

A flaw was found in flightctl. The configureRepoHTTPSClient() function in the device-render worker builds a per-repository tls.Config (which may include InsecureSkipVerify, a custom CA bundle, or tenant-supplied mTLS client certificates) and installs it into go-git's process-global client.Protocols map via gitclient.InstallProtocol("https", ...). Because the worker renders devices for multiple organizations concurrently from a shared goroutine pool, whichever tenant's repository configuration is written last wins for all in-flight git.Clone calls. This race condition can cause one tenant's TLS settings, including InsecureSkipVerify or mTLS client credentials, to leak into another tenant's git operations.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00196 9th percentileScored 2026-11-07
Fix Partial Red Hat: 3 advisoriesRed Hat: 3 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Red HatRHEM 1.2 for RHEL 10—1.2.2-1.el10Patch availableCNA
Red HatRHEM 1.2 for RHEL 9—1.2.2-1.el9Patch availableCNA
Red HatRed Hat Edge Manager 1.2—1793718463Patch availableCNA
Red HatRed Hat Edge Manager 1.2—1793718887Patch availableCNA
Red HatRed Hat Advanced Cluster Management for Kubernetes 2——No fix listedCNA
  • RHEM 1.2 for RHEL 10 VendorRed Hat Affected — Fixed in 1.2.2-1.el10 Patch available CNA
  • RHEM 1.2 for RHEL 9 VendorRed Hat Affected — Fixed in 1.2.2-1.el9 Patch available CNA
  • Red Hat Edge Manager 1.2 VendorRed Hat Affected — Fixed in 1793718463 Patch available CNA
  • Red Hat Edge Manager 1.2 VendorRed Hat Affected — Fixed in 1793718887 Patch available CNA
  • Red Hat Advanced Cluster Management for Kubernetes 2 VendorRed Hat Affected — Fixed in — No fix listed CNA

CPE names CNA · 3

CPEVersionsRoleVendor
cpe:/a:redhat:edge_manager:1.2::el101.2—Red Hat
cpe:/a:redhat:edge_manager:1.2::el91.2—Red Hat
cpe:/a:redhat:acm:22—Red Hat
  • cpe:/a:redhat:edge_manager:1.2::el10 Versions 1.2 — ·Red Hat
  • cpe:/a:redhat:edge_manager:1.2::el9 Versions 1.2 — ·Red Hat
  • cpe:/a:redhat:acm:2 Versions 2 — ·Red Hat

Remediation

Red Hat 3 advisories

  • RHSA-2026:94632 Released 2026-11-03 · Red Hat rating Important
    Red Hat Edge Manager Version 1.2.2 Security Update
    • RHEM 1.2 for RHEL 10 flightctl-1.2.2-1.el10, flightctl-agent-1.2.2-1.el10, flightctl-cli-1.2.2-1.el10
    • RHEM 1.2 for RHEL 9 flightctl-1.2.2-1.el9, flightctl-agent-1.2.2-1.el9, flightctl-cli-1.2.2-1.el9
  • RHSA-2026:94612 Released 2026-11-03 · Red Hat rating Important
    Red Hat Edge Manager Version 1.2.2 Security Update
    • Red Hat Edge Manager 1.2 registry.redhat.io/rhem/flightctl-alert-exporter-rhel10, registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10, registry.redhat.io/rhem/flightctl-api-rhel10 +11
  • RHSA-2026:94608 Released 2026-11-03 · Red Hat rating Important
    Red Hat Edge Manager Version 1.2.2 Security Update
    • Red Hat Edge Manager 1.2 registry.redhat.io/rhem/flightctl-alert-exporter-rhel9, registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel9, registry.redhat.io/rhem/flightctl-api-rhel9 +11

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Advanced Cluster Management for Kubernetes 2AffectedNo fix planned: Will not fix
RHEM 1.2 for RHEL 10Fixed RHSA-2026:94632
RHEM 1.2 for RHEL 9Fixed RHSA-2026:94632
Red Hat Edge Manager 1.2Fixed RHSA-2026:94608, RHSA-2026:94612
Not affected: 3 products
  • RHEM 1.2 for RHEL 10
  • RHEM 1.2 for RHEL 9
  • Red Hat Edge Manager 1.2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-92615
  2. 2026-10-03 Alias added: GHSA-q6r7-r3xg-x977
  3. 2026-11-03 Fix available: flightctl@0:1.2.2-1.el10, flightctl@0:1.2.2-1.el9 · CNA
  4. 2026-11-03 1 new reference · CNA
  5. 2026-11-03 Fix available: RHSA-2026:94632 · Red Hat
  6. 2026-11-03 Fix available: RHEM 1.2 for RHEL 10, RHEM 1.2 for RHEL 9 · Red Hat
  7. 2026-11-04 Fix available: rhem/flightctl-worker-rhel10@1793718463, rhem/flightctl-worker-rhel9@1793718887 · CNA
  8. 2026-11-04 2 new references · CNA
  9. 2026-11-04 Fix available: RHSA-2026:94612 · Red Hat
  10. 2026-11-04 Fix available: RHSA-2026:94608 · Red Hat
  11. 2026-11-04 Fix available: Red Hat Edge Manager 1.2 · Red Hat

References

Advisory 3

Other 2

  • TI-2019-15875 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin KEVCVSS 3.1CRITICAL 9.9
  • TI-2019-15874 Protection mechanism failure in Jenkins Script Security Plugin KEVCVSS 3.1CRITICAL 9.9
  • TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
  • TI-2019-05363 Code injection in Elastic Kibana KEVCVSS 3.1CRITICAL 10.0
  • TI-2019-03949 Out-of-bounds write in ESXi and Horizon DaaS KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8
See all 7413 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences