7.5
CVE-2026-6893
- EPSS 1.09%
- Veröffentlicht 10.06.2026 19:49:27
- Zuletzt bearbeitet 02.10.2026 00:17:03
- Erkennungen
Dracut: dracut: root code execution via dhcp options command injection
A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP (Dynamic Host Configuration Protocol) options, such as a malicious hostname, to a system using dracut's legacy DHCP path. These options are improperly handled and written into temporary shell scripts without proper escaping, leading to command injection. This allows the attacker to achieve root code execution within the initramfs, potentially compromising the system's boot and network behavior.
Daten sind bereitgestellt durch das CVE Programm von Authorized Data Publishers (ADP) (Unstrukturiert)
HerstellerRed Hat
≫
Produkt
Red Hat Enterprise Linux 10
Default Statusaffected
Version
0:107-7.el10_2
Version <
*
Status
unaffected
HerstellerRed Hat
≫
Produkt
Red Hat Enterprise Linux 10.0 Extended Update Support
Default Statusaffected
Version
0:105-4.el10_0.1
Version <
*
Status
unaffected
HerstellerRed Hat
≫
Produkt
Red Hat Enterprise Linux 7 Extended Lifecycle Support
Default Statusaffected
Version
0:033-577.el7_9
Version <
*
Status
unaffected
HerstellerRed Hat
≫
Produkt
Red Hat Enterprise Linux 8
Default Statusaffected
Version
0:049-244.git20260529.el8_10
Version <
*
Status
unaffected
HerstellerRed Hat
≫
Produkt
Red Hat Enterprise Linux 8.8 Telecommunications Update Service
Default Statusaffected
Version
0:049-223.git20230119.el8_8.1
Version <
*
Status
unaffected
HerstellerRed Hat
≫
Produkt
Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
Default Statusaffected
Version
0:049-223.git20230119.el8_8.1
Version <
*
Status
unaffected
HerstellerRed Hat
≫
Produkt
Red Hat Enterprise Linux 9
Default Statusaffected
Version
0:057-115.git20260527.el9_8
Version <
*
Status
unaffected
HerstellerRed Hat
≫
Produkt
Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
Default Statusaffected
Version
0:057-25.git20250717.el9_2.2
Version <
*
Status
unaffected
HerstellerRed Hat
≫
Produkt
Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions
Default Statusaffected
Version
0:057-54.git20250423.el9_4.3
Version <
*
Status
unaffected
HerstellerRed Hat
≫
Produkt
Red Hat Enterprise Linux 9.6 Extended Update Support
Default Statusaffected
Version
0:057-89.git20250311.el9_6.1
Version <
*
Status
unaffected
HerstellerRed Hat
≫
Produkt
Red Hat OpenShift Container Platform 4.13
Default Statusaffected
Version
413.92.202609080414-0
Version <
*
Status
unaffected
HerstellerRed Hat
≫
Produkt
Red Hat OpenShift Container Platform 4.14
Default Statusaffected
Version
414.92.202609011250-0
Version <
*
Status
unaffected
HerstellerRed Hat
≫
Produkt
Red Hat OpenShift Container Platform 4.16
Default Statusaffected
Version
416.94.202609011112-0
Version <
*
Status
unaffected
HerstellerRed Hat
≫
Produkt
Red Hat OpenShift Container Platform 4.18
Default Statusaffected
Version
418.94.202609031320-0
Version <
*
Status
unaffected
HerstellerRed Hat
≫
Produkt
Red Hat OpenShift Container Platform 4.19
Default Statusaffected
Version
4.19.9.6.202609021231-0
Version <
*
Status
unaffected
HerstellerRed Hat
≫
Produkt
Red Hat Hardened Images
Default Statusaffected
Version
109-6.hum1
Version <
*
Status
unaffected
HerstellerRed Hat
≫
Produkt
Red Hat Enterprise Linux 6
Default Statusaffected
HerstellerRed Hat
≫
Produkt
Red Hat OpenShift Container Platform 4
Default Statusaffected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. 
Login
Login| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 1.09% | 0.619 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| RedHat | 7.5 | 1.6 | 5.9 |
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
|
| 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | 7.5 | 1.6 | 5.9 |
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
|
CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
https://bugzilla.redhat.com/show_bug.cgi?id=2459963
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6893.json
https://access.redhat.com/errata/RHSA-2026:26532
https://access.redhat.com/errata/RHSA-2026:26533
https://access.redhat.com/errata/RHSA-2026:26534
https://access.redhat.com/errata/RHSA-2026:26713
https://access.redhat.com/security/cve/CVE-2026-6893
https://access.redhat.com/errata/RHSA-2026:57580
https://access.redhat.com/errata/RHSA-2026:57775
https://access.redhat.com/errata/RHSA-2026:57772
https://access.redhat.com/errata/RHSA-2026:57785
https://access.redhat.com/errata/RHSA-2026:61252
https://access.redhat.com/errata/RHSA-2026:62269
https://access.redhat.com/errata/RHSA-2026:63044
https://access.redhat.com/errata/RHSA-2026:62549
https://access.redhat.com/errata/RHSA-2026:62409
https://access.redhat.com/errata/RHSA-2026:65851
https://access.redhat.com/errata/RHSA-2026:65839
https://access.redhat.com/errata/RHSA-2026:69118
https://access.redhat.com/errata/RHSA-2026:69119
https://access.redhat.com/errata/RHSA-2026:67857
https://access.redhat.com/errata/RHSA-2026:74499
https://access.redhat.com/errata/RHSA-2026:70586
https://access.redhat.com/errata/RHSA-2026:70615