CVE-2026-86330 Noobaa-core: noobaa-core: os command injection in cluster_internal_api.set_hostname_internal
An authenticated administrator can execute arbitrary OS commands via the hostname parameter in NooBaa's internal API, compromising the host system.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-86330?
CVE-2026-86330 is a high-severity command injection vulnerability in Red Hat Openshift Data Foundation 4, published on 28 Sep 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
An OS command injection flaw was found in the set_hostname_internal function of NooBaa's cluster_internal_api. This component is responsible for managing the Multi-Cloud Object Gateway in OpenShift Data Foundation. The vulnerability occurs because the hostname parameter is passed directly to a shell command without proper sanitization. An authenticated attacker with administrative privileges can provide a specially crafted hostname containing shell metacharacters to execute arbitrary commands on the host system with the privileges of the NooBaa process.
Weakness: CWE-78
Which versions are affected by CVE-2026-86330?
How do I fix CVE-2026-86330?
No fix has been published for CVE-2026-86330 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-86330 being exploited?
There is no known exploitation of CVE-2026-86330 in the wild and no public exploit code.
Sources
Also known as GHSA-xc7x-4vw8-2652.