CVE-2026-19278 Stackrox: stackrox: privilege escalation via unanchored regular expressions in auth m2m role mappings
Attackers with valid OIDC tokens can escalate privileges by exploiting unanchored regex in M2M role mappings, requiring admin configuration.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-19278?
CVE-2026-19278 is a medium-severity vulnerability in Red Hat Advanced Cluster Security 4, published on 10 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A flaw was found in StackRox/RHACS Central's Auth Machine-to-Machine (M2M) token exchange. When an administrator configures M2M role mappings, the system uses unanchored regular expressions for matching claim values. This allows an attacker with a valid OpenID Connect (OIDC) token, whose claim value is a superstring of a configured pattern, to gain unauthorized access to roles they were not intended to receive. This can lead to privilege escalation within the system.
Weakness: CWE-625
Which versions are affected by CVE-2026-19278?
How do I fix CVE-2026-19278?
No fix has been published for CVE-2026-19278 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-19278 being exploited?
There is no known exploitation of CVE-2026-19278 in the wild and no public exploit code.
Sources
Also known as GHSA-7c5g-xvpm-qr5v.