SB2026102654 - Link following in Red Hat OpenShift GitOps 1.20

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026102654

SB2026102654 - Link following in Red Hat OpenShift GitOps 1.20

Published: October 26, 2026

Security Bulletin ID SB2026102654
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Link following (CVE-ID: CVE-2026-71556)

CWE-ID: CWE-59 - Improper Link Resolution Before File Access ('Link Following')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to modify files outside the intended worktree path.

The vulnerability exists due to improper link resolution before file access in the worktree filesystem wrapper when performing worktree file operations on attacker-controlled symbolic link paths. A remote attacker can introduce a symbolic link in the worktree and cause the application to perform a write through that path to modify files outside the intended worktree path.

User interaction is required, and exploitation requires the attacker to be able to introduce or control a symbolic link in the worktree.


Remediation

Install update from vendor's website.

References