Bug 2529295 (CVE-2026-86330)

Summary: CVE-2026-86330 noobaa-core: noobaa-core: OS command injection in cluster_internal_api.set_hostname_internal
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: security-response-team
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
An OS command injection flaw was found in the set_hostname_internal function of NooBaa's cluster_internal_api. This component is responsible for managing the Multi-Cloud Object Gateway in OpenShift Data Foundation. The vulnerability occurs because the hostname parameter is passed directly to a shell command without proper sanitization. An authenticated attacker with administrative privileges can provide a specially crafted hostname containing shell metacharacters to execute arbitrary commands on the host system with the privileges of the NooBaa process.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-09-07 07:21:17 UTC 
An OS command injection vulnerability exists in noobaa-core within the src/util/os_utils.js file. The set_hostname function uses a template literal to interpolate the hostname parameter directly into a shell command executed via exec(). Because the input is not sanitized, an attacker can use shell metacharacters (e.g., semicolons or backticks) to execute arbitrary commands. This endpoint is exposed via the cluster_internal_api.set_hostname_internal RPC method. Exploitation requires a valid administrative auth_token. A successful attack allows for arbitrary command execution as the noob user (UID 10001) within the container, which can lead to full container compromise.