{
  "threat_severity" : "Important",
  "public_date" : "2026-06-05T00:35:50Z",
  "bugzilla" : {
    "description" : "docker: Moby/Docker Engine: Arbitrary Code Execution via malicious container image and compressed archive upload",
    "id" : "2485356",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2485356"
  },
  "cvss3" : {
    "cvss3_base_score" : "7.5",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H",
    "status" : "verified"
  },
  "cwe" : "CWE-427",
  "details" : [ "Moby is an open source container framework. In versions prior to 29.5.1 and in moby/moby v2 prior to v2.0.0-beta.14, when a compressed archive is uploaded to a container via `PUT /containers/{id}/archive` or piped through `docker cp -`, the daemon resolves decompression binaries (such as `xz` or `unpigz`) from the container's filesystem rather than the host's due to incorrect ordering of operations. A malicious container image containing a trojanized decompression binary can achieve arbitrary code execution with full daemon privileges, including host root UID and unrestricted capabilities, when a user uploads a compressed (xz or gzip) archive into that container. This issue is fixed in Docker Engine 29.5.1 and moby/moby v2.0.0-beta.14. Workarounds include only running containers from trusted images, using authorization plugins to restrict access to the `PUT /containers/{id}/archive` endpoint, and avoiding piping compressed archives into containers created from untrusted images", "A flaw was found in Moby, the open-source container framework, and Docker Engine. A malicious container image can exploit this vulnerability to achieve arbitrary code execution with full daemon privileges, including host root access. This occurs when a user uploads a compressed archive to the container, as the daemon incorrectly uses decompression binaries from the container's filesystem. This allows an attacker to gain complete control over the affected system." ],
  "statement" : "This is an Important vulnerability. A flaw in Moby and Docker Engine allows for arbitrary code execution with host root privileges. This occurs when a user uploads a compressed archive to a container, as the daemon incorrectly uses decompression binaries from the container's filesystem. This could lead to a complete compromise of the host system if a malicious container image is utilized.",
  "affected_release" : [ {
    "product_name" : "Multicluster Global Hub 1.4.5",
    "release_date" : "2026-07-16T00:00:00Z",
    "advisory" : "RHSA-2026:41030",
    "cpe" : "cpe:/a:redhat:multicluster_globalhub:1.4::el9",
    "package" : "multicluster-globalhub/multicluster-globalhub-grafana-rhel9:1784060681"
  }, {
    "product_name" : "Multicluster Global Hub 1.5.6",
    "release_date" : "2026-07-21T00:00:00Z",
    "advisory" : "RHSA-2026:42852",
    "cpe" : "cpe:/a:redhat:multicluster_globalhub:1.5::el9",
    "package" : "multicluster-globalhub/multicluster-globalhub-grafana-rhel9:1784562060"
  }, {
    "product_name" : "Red Hat Openshift Data Foundation 4.22",
    "release_date" : "2026-07-09T00:00:00Z",
    "advisory" : "RHSA-2026:37387",
    "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.22::el9",
    "package" : "odf4/cephcsi-rhel9:1782932114"
  }, {
    "product_name" : "Red Hat Openshift Data Foundation 4.22",
    "release_date" : "2026-07-09T00:00:00Z",
    "advisory" : "RHSA-2026:37387",
    "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.22::el9",
    "package" : "odf4/cephcsi-rhel9-operator:1782931768"
  }, {
    "product_name" : "Red Hat Openshift Data Foundation 4.22",
    "release_date" : "2026-07-09T00:00:00Z",
    "advisory" : "RHSA-2026:37387",
    "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.22::el9",
    "package" : "odf4/devicefinder-rhel9:1782932104"
  }, {
    "product_name" : "Red Hat Openshift Data Foundation 4.22",
    "release_date" : "2026-07-09T00:00:00Z",
    "advisory" : "RHSA-2026:37387",
    "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.22::el9",
    "package" : "odf4/mcg-core-rhel9:1783536000"
  }, {
    "product_name" : "Red Hat Openshift Data Foundation 4.22",
    "release_date" : "2026-07-09T00:00:00Z",
    "advisory" : "RHSA-2026:37387",
    "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.22::el9",
    "package" : "odf4/mcg-rhel9-operator:1783535989"
  }, {
    "product_name" : "Red Hat Openshift Data Foundation 4.22",
    "release_date" : "2026-07-09T00:00:00Z",
    "advisory" : "RHSA-2026:37387",
    "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.22::el9",
    "package" : "odf4/ocs-client-console-rhel9:1783536515"
  }, {
    "product_name" : "Red Hat Openshift Data Foundation 4.22",
    "release_date" : "2026-07-09T00:00:00Z",
    "advisory" : "RHSA-2026:37387",
    "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.22::el9",
    "package" : "odf4/ocs-client-rhel9-operator:1782932521"
  }, {
    "product_name" : "Red Hat Openshift Data Foundation 4.22",
    "release_date" : "2026-07-09T00:00:00Z",
    "advisory" : "RHSA-2026:37387",
    "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.22::el9",
    "package" : "odf4/ocs-metrics-exporter-rhel9:1783018461"
  }, {
    "product_name" : "Red Hat Openshift Data Foundation 4.22",
    "release_date" : "2026-07-09T00:00:00Z",
    "advisory" : "RHSA-2026:37387",
    "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.22::el9",
    "package" : "odf4/ocs-rhel9-operator:1783018421"
  }, {
    "product_name" : "Red Hat Openshift Data Foundation 4.22",
    "release_date" : "2026-07-09T00:00:00Z",
    "advisory" : "RHSA-2026:37387",
    "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.22::el9",
    "package" : "odf4/odf-blackbox-exporter-rhel9:1782932812"
  }, {
    "product_name" : "Red Hat Openshift Data Foundation 4.22",
    "release_date" : "2026-07-09T00:00:00Z",
    "advisory" : "RHSA-2026:37387",
    "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.22::el9",
    "package" : "odf4/odf-cli-rhel9:1783537001"
  }, {
    "product_name" : "Red Hat Openshift Data Foundation 4.22",
    "release_date" : "2026-07-09T00:00:00Z",
    "advisory" : "RHSA-2026:37387",
    "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.22::el9",
    "package" : "odf4/odf-cloudnative-pg-rhel9-operator:1782932919"
  }, {
    "product_name" : "Red Hat Openshift Data Foundation 4.22",
    "release_date" : "2026-07-09T00:00:00Z",
    "advisory" : "RHSA-2026:37387",
    "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.22::el9",
    "package" : "odf4/odf-console-rhel9:1783537586"
  }, {
    "product_name" : "Red Hat Openshift Data Foundation 4.22",
    "release_date" : "2026-07-09T00:00:00Z",
    "advisory" : "RHSA-2026:37387",
    "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.22::el9",
    "package" : "odf4/odf-cosi-sidecar-rhel9:1782932969"
  }, {
    "product_name" : "Red Hat Openshift Data Foundation 4.22",
    "release_date" : "2026-07-09T00:00:00Z",
    "advisory" : "RHSA-2026:37387",
    "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.22::el9",
    "package" : "odf4/odf-csi-addons-rhel9-operator:1782933015"
  }, {
    "product_name" : "Red Hat Openshift Data Foundation 4.22",
    "release_date" : "2026-07-09T00:00:00Z",
    "advisory" : "RHSA-2026:37387",
    "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.22::el9",
    "package" : "odf4/odf-csi-addons-sidecar-rhel9:1782933042"
  }, {
    "product_name" : "Red Hat Openshift Data Foundation 4.22",
    "release_date" : "2026-07-09T00:00:00Z",
    "advisory" : "RHSA-2026:37387",
    "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.22::el9",
    "package" : "odf4/odf-drbd-rhel9:1783537392"
  }, {
    "product_name" : "Red Hat Openshift Data Foundation 4.22",
    "release_date" : "2026-07-09T00:00:00Z",
    "advisory" : "RHSA-2026:37387",
    "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.22::el9",
    "package" : "odf4/odf-external-snapshotter-rhel9-operator:1782933235"
  }, {
    "product_name" : "Red Hat Openshift Data Foundation 4.22",
    "release_date" : "2026-07-09T00:00:00Z",
    "advisory" : "RHSA-2026:37387",
    "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.22::el9",
    "package" : "odf4/odf-external-snapshotter-sidecar-rhel9:1782933251"
  }, {
    "product_name" : "Red Hat Openshift Data Foundation 4.22",
    "release_date" : "2026-07-09T00:00:00Z",
    "advisory" : "RHSA-2026:37387",
    "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.22::el9",
    "package" : "odf4/odf-multicluster-console-rhel9:1783537955"
  }, {
    "product_name" : "Red Hat Openshift Data Foundation 4.22",
    "release_date" : "2026-07-09T00:00:00Z",
    "advisory" : "RHSA-2026:37387",
    "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.22::el9",
    "package" : "odf4/odf-multicluster-rhel9-operator:1782933417"
  }, {
    "product_name" : "Red Hat Openshift Data Foundation 4.22",
    "release_date" : "2026-07-09T00:00:00Z",
    "advisory" : "RHSA-2026:37387",
    "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.22::el9",
    "package" : "odf4/odf-must-gather-rhel9:1783537742"
  }, {
    "product_name" : "Red Hat Openshift Data Foundation 4.22",
    "release_date" : "2026-07-09T00:00:00Z",
    "advisory" : "RHSA-2026:37387",
    "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.22::el9",
    "package" : "odf4/odf-rhel9-operator:1782933602"
  }, {
    "product_name" : "Red Hat Openshift Data Foundation 4.22",
    "release_date" : "2026-07-09T00:00:00Z",
    "advisory" : "RHSA-2026:37387",
    "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.22::el9",
    "package" : "odf4/odr-rhel9-operator:1783019377"
  }, {
    "product_name" : "Red Hat Openshift Data Foundation 4.22",
    "release_date" : "2026-07-09T00:00:00Z",
    "advisory" : "RHSA-2026:37387",
    "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.22::el9",
    "package" : "odf4/odr-volsync-plugin-mover-rhel9:1782934054"
  }, {
    "product_name" : "Red Hat Openshift Data Foundation 4.22",
    "release_date" : "2026-07-09T00:00:00Z",
    "advisory" : "RHSA-2026:37387",
    "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.22::el9",
    "package" : "odf4/odr-volsync-plugin-rhel9-operator:1782934036"
  }, {
    "product_name" : "Red Hat Openshift Data Foundation 4.22",
    "release_date" : "2026-07-09T00:00:00Z",
    "advisory" : "RHSA-2026:37387",
    "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.22::el9",
    "package" : "odf4/rook-ceph-rhel9-operator:1782934284"
  } ],
  "package_state" : [ {
    "product_name" : "Exploit Intelligence",
    "fix_state" : "Affected",
    "package_name" : "exploit-intelligence-tech-preview/agent-client-rhel9",
    "cpe" : "cpe:/a:redhat:exploit_intelligence:0"
  }, {
    "product_name" : "Multicluster Engine for Kubernetes",
    "fix_state" : "Affected",
    "package_name" : "multicluster-engine/assisted-service-8-rhel8",
    "cpe" : "cpe:/a:redhat:multicluster_engine"
  }, {
    "product_name" : "Multicluster Engine for Kubernetes",
    "fix_state" : "Affected",
    "package_name" : "multicluster-engine/assisted-service-9-rhel9",
    "cpe" : "cpe:/a:redhat:multicluster_engine"
  }, {
    "product_name" : "Multicluster Engine for Kubernetes",
    "fix_state" : "Affected",
    "package_name" : "multicluster-engine/cluster-api-provider-azure-rhel9",
    "cpe" : "cpe:/a:redhat:multicluster_engine"
  }, {
    "product_name" : "OpenShift Lightspeed",
    "fix_state" : "Affected",
    "package_name" : "openshift-lightspeed/lightspeed-rhel9-operator",
    "cpe" : "cpe:/a:redhat:openshift_lightspeed"
  }, {
    "product_name" : "OpenShift Source-to-Image (S2I)",
    "fix_state" : "Affected",
    "package_name" : "source-to-image/source-to-image-rhel8",
    "cpe" : "cpe:/a:redhat:source_to_image:1"
  }, {
    "product_name" : "OpenShift Source-to-Image (S2I)",
    "fix_state" : "Affected",
    "package_name" : "source-to-image/source-to-image-rhel9",
    "cpe" : "cpe:/a:redhat:source_to_image:1"
  }, {
    "product_name" : "Red Hat Advanced Cluster Management for Kubernetes 2",
    "fix_state" : "Affected",
    "package_name" : "rhacm2/acm-grafana-rhel9",
    "cpe" : "cpe:/a:redhat:acm:2"
  }, {
    "product_name" : "Red Hat Ceph Storage 5",
    "fix_state" : "Fix deferred",
    "package_name" : "rhceph/rhceph-5-dashboard-rhel8",
    "cpe" : "cpe:/a:redhat:ceph_storage:5"
  }, {
    "product_name" : "Red Hat Ceph Storage 7",
    "fix_state" : "Fix deferred",
    "package_name" : "rhceph/grafana-rhel9",
    "cpe" : "cpe:/a:redhat:ceph_storage:7"
  }, {
    "product_name" : "Red Hat Ceph Storage 8",
    "fix_state" : "Fix deferred",
    "package_name" : "rhceph/grafana-rhel9",
    "cpe" : "cpe:/a:redhat:ceph_storage:8"
  }, {
    "product_name" : "Red Hat Ceph Storage 9",
    "fix_state" : "Fix deferred",
    "package_name" : "rhceph/grafana-rhel10",
    "cpe" : "cpe:/a:redhat:ceph_storage:9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 10",
    "fix_state" : "Affected",
    "package_name" : "skopeo",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Affected",
    "package_name" : "skopeo",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  }, {
    "product_name" : "Red Hat Hardened Images",
    "fix_state" : "Not affected",
    "package_name" : "buildah",
    "cpe" : "cpe:/a:redhat:hummingbird:1"
  }, {
    "product_name" : "Red Hat Hardened Images",
    "fix_state" : "Affected",
    "package_name" : "containers-common",
    "cpe" : "cpe:/a:redhat:hummingbird:1"
  }, {
    "product_name" : "Red Hat Hardened Images",
    "fix_state" : "Not affected",
    "package_name" : "grype",
    "cpe" : "cpe:/a:redhat:hummingbird:1"
  }, {
    "product_name" : "Red Hat Hardened Images",
    "fix_state" : "Affected",
    "package_name" : "opentelemetry-collector",
    "cpe" : "cpe:/a:redhat:hummingbird:1"
  }, {
    "product_name" : "Red Hat Hardened Images",
    "fix_state" : "Affected",
    "package_name" : "opentelemetry-collector-contrib",
    "cpe" : "cpe:/a:redhat:hummingbird:1"
  }, {
    "product_name" : "Red Hat Hardened Images",
    "fix_state" : "Not affected",
    "package_name" : "podman",
    "cpe" : "cpe:/a:redhat:hummingbird:1"
  }, {
    "product_name" : "Red Hat Hardened Images",
    "fix_state" : "Not affected",
    "package_name" : "skopeo",
    "cpe" : "cpe:/a:redhat:hummingbird:1"
  }, {
    "product_name" : "Red Hat Hardened Images",
    "fix_state" : "Not affected",
    "package_name" : "syft",
    "cpe" : "cpe:/a:redhat:hummingbird:1"
  }, {
    "product_name" : "Red Hat Hardened Images",
    "fix_state" : "Affected",
    "package_name" : "trivy",
    "cpe" : "cpe:/a:redhat:hummingbird:1"
  }, {
    "product_name" : "Red Hat OpenShift AI (RHOAI)",
    "fix_state" : "Fix deferred",
    "package_name" : "rhoai/odh-data-science-pipelines-argo-argoexec-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_ai",
    "impact" : "low"
  }, {
    "product_name" : "Red Hat OpenShift AI (RHOAI)",
    "fix_state" : "Fix deferred",
    "package_name" : "rhoai/odh-data-science-pipelines-argo-workflowcontroller-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_ai",
    "impact" : "low"
  }, {
    "product_name" : "Red Hat OpenShift AI (RHOAI)",
    "fix_state" : "Fix deferred",
    "package_name" : "rhoai/odh-kserve-agent-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_ai",
    "impact" : "low"
  }, {
    "product_name" : "Red Hat OpenShift AI (RHOAI)",
    "fix_state" : "Fix deferred",
    "package_name" : "rhoai/odh-kserve-controller-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_ai",
    "impact" : "low"
  }, {
    "product_name" : "Red Hat OpenShift AI (RHOAI)",
    "fix_state" : "Fix deferred",
    "package_name" : "rhoai/odh-kserve-llmisvc-controller-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_ai",
    "impact" : "low"
  }, {
    "product_name" : "Red Hat OpenShift AI (RHOAI)",
    "fix_state" : "Fix deferred",
    "package_name" : "rhoai/odh-kserve-router-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_ai",
    "impact" : "low"
  }, {
    "product_name" : "Red Hat OpenShift AI (RHOAI)",
    "fix_state" : "Fix deferred",
    "package_name" : "rhoai/odh-mlflow-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_ai",
    "impact" : "low"
  }, {
    "product_name" : "Red Hat OpenShift AI (RHOAI)",
    "fix_state" : "Fix deferred",
    "package_name" : "rhoai/odh-mod-arch-model-registry-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_ai",
    "impact" : "low"
  }, {
    "product_name" : "Red Hat OpenShift AI (RHOAI)",
    "fix_state" : "Fix deferred",
    "package_name" : "rhoai/odh-model-metadata-collection-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_ai",
    "impact" : "low"
  }, {
    "product_name" : "Red Hat OpenShift AI (RHOAI)",
    "fix_state" : "Fix deferred",
    "package_name" : "rhoai/odh-model-registry-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_ai",
    "impact" : "low"
  }, {
    "product_name" : "Red Hat OpenShift AI (RHOAI)",
    "fix_state" : "Fix deferred",
    "package_name" : "rhoai/odh-must-gather-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_ai",
    "impact" : "low"
  }, {
    "product_name" : "Red Hat OpenShift AI (RHOAI)",
    "fix_state" : "Fix deferred",
    "package_name" : "rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_ai",
    "impact" : "low"
  }, {
    "product_name" : "Red Hat OpenShift AI (RHOAI)",
    "fix_state" : "Fix deferred",
    "package_name" : "rhoai/odh-pipeline-runtime-minimal-cpu-py312-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_ai",
    "impact" : "low"
  }, {
    "product_name" : "Red Hat OpenShift AI (RHOAI)",
    "fix_state" : "Fix deferred",
    "package_name" : "rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_ai",
    "impact" : "low"
  }, {
    "product_name" : "Red Hat OpenShift AI (RHOAI)",
    "fix_state" : "Fix deferred",
    "package_name" : "rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_ai",
    "impact" : "low"
  }, {
    "product_name" : "Red Hat OpenShift AI (RHOAI)",
    "fix_state" : "Fix deferred",
    "package_name" : "rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_ai",
    "impact" : "low"
  }, {
    "product_name" : "Red Hat OpenShift AI (RHOAI)",
    "fix_state" : "Fix deferred",
    "package_name" : "rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_ai",
    "impact" : "low"
  }, {
    "product_name" : "Red Hat OpenShift AI (RHOAI)",
    "fix_state" : "Fix deferred",
    "package_name" : "rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_ai",
    "impact" : "low"
  }, {
    "product_name" : "Red Hat OpenShift AI (RHOAI)",
    "fix_state" : "Fix deferred",
    "package_name" : "rhoai/odh-th06-cpu-torch210-py312-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_ai",
    "impact" : "low"
  }, {
    "product_name" : "Red Hat OpenShift AI (RHOAI)",
    "fix_state" : "Fix deferred",
    "package_name" : "rhoai/odh-th06-cpu-torch291-py312-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_ai",
    "impact" : "low"
  }, {
    "product_name" : "Red Hat OpenShift AI (RHOAI)",
    "fix_state" : "Fix deferred",
    "package_name" : "rhoai/odh-th06-cuda130-torch210-py312-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_ai",
    "impact" : "low"
  }, {
    "product_name" : "Red Hat OpenShift AI (RHOAI)",
    "fix_state" : "Fix deferred",
    "package_name" : "rhoai/odh-th06-cuda130-torch291-py312-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_ai",
    "impact" : "low"
  }, {
    "product_name" : "Red Hat OpenShift AI (RHOAI)",
    "fix_state" : "Fix deferred",
    "package_name" : "rhoai/odh-th06-rocm64-torch291-py312-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_ai",
    "impact" : "low"
  }, {
    "product_name" : "Red Hat OpenShift AI (RHOAI)",
    "fix_state" : "Fix deferred",
    "package_name" : "rhoai/odh-training-cuda128-torch29-py312-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_ai",
    "impact" : "low"
  }, {
    "product_name" : "Red Hat OpenShift AI (RHOAI)",
    "fix_state" : "Fix deferred",
    "package_name" : "rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_ai",
    "impact" : "low"
  }, {
    "product_name" : "Red Hat OpenShift AI (RHOAI)",
    "fix_state" : "Fix deferred",
    "package_name" : "rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_ai",
    "impact" : "low"
  }, {
    "product_name" : "Red Hat OpenShift AI (RHOAI)",
    "fix_state" : "Fix deferred",
    "package_name" : "rhoai/odh-workbench-jupyter-minimal-cpu-py312-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_ai",
    "impact" : "low"
  }, {
    "product_name" : "Red Hat OpenShift AI (RHOAI)",
    "fix_state" : "Fix deferred",
    "package_name" : "rhoai/odh-workbench-jupyter-minimal-cuda-py312-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_ai",
    "impact" : "low"
  }, {
    "product_name" : "Red Hat OpenShift AI (RHOAI)",
    "fix_state" : "Fix deferred",
    "package_name" : "rhoai/odh-workbench-jupyter-minimal-rocm-py312-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_ai",
    "impact" : "low"
  }, {
    "product_name" : "Red Hat OpenShift AI (RHOAI)",
    "fix_state" : "Fix deferred",
    "package_name" : "rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_ai",
    "impact" : "low"
  }, {
    "product_name" : "Red Hat OpenShift AI (RHOAI)",
    "fix_state" : "Fix deferred",
    "package_name" : "rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_ai",
    "impact" : "low"
  }, {
    "product_name" : "Red Hat OpenShift AI (RHOAI)",
    "fix_state" : "Fix deferred",
    "package_name" : "rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_ai",
    "impact" : "low"
  }, {
    "product_name" : "Red Hat OpenShift AI (RHOAI)",
    "fix_state" : "Fix deferred",
    "package_name" : "rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_ai",
    "impact" : "low"
  }, {
    "product_name" : "Red Hat OpenShift AI (RHOAI)",
    "fix_state" : "Fix deferred",
    "package_name" : "rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_ai",
    "impact" : "low"
  }, {
    "product_name" : "Red Hat OpenShift AI (RHOAI)",
    "fix_state" : "Fix deferred",
    "package_name" : "rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_ai",
    "impact" : "low"
  }, {
    "product_name" : "Red Hat OpenShift AI (RHOAI)",
    "fix_state" : "Fix deferred",
    "package_name" : "rhoai/rhai-cli-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_ai",
    "impact" : "low"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Not affected",
    "package_name" : "openshift4/ose-agent-installer-api-server-rhel8",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Not affected",
    "package_name" : "openshift4/ose-agent-installer-api-server-rhel9",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Affected",
    "package_name" : "openshift4/ose-azure-cluster-api-controllers-rhel9",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Affected",
    "package_name" : "openshift4/ose-gcp-cluster-api-controllers-rhel9",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Not affected",
    "package_name" : "openshift4/ose-openstack-cluster-api-controllers-rhel9",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift distributed tracing 3",
    "fix_state" : "Affected",
    "package_name" : "rhosdt/opentelemetry-collector-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_distributed_tracing:3"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2026-41567\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-41567\nhttps://github.com/moby/moby/security/advisories/GHSA-x86f-5xw2-fm2r" ],
  "name" : "CVE-2026-41567",
  "mitigation" : {
    "value" : "To mitigate this issue, Red Hat recommends only running containers from trusted images. Additionally, users should avoid piping compressed archives into containers created from untrusted images. For environments utilizing authorization plugins, restricting access to the `PUT /containers/{id}/archive` endpoint can further reduce exposure.",
    "lang" : "en:us"
  },
  "csaw" : false
}