{"affected":[{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"dracut","product":"Red Hat Enterprise Linux 8","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:049-244.git20260529.el8_10","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"dracut","product":"Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:049-138.git20220131.el8_4.1","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"dracut","product":"Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:049-138.git20220131.el8_4.1","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"dracut","product":"Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:049-203.git20220511.el8_6.1","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"dracut","product":"Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:049-203.git20220511.el8_6.1","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"dracut","product":"Red Hat Enterprise Linux 8.8 Telecommunications Update Service","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:049-223.git20230119.el8_8.1","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"dracut","product":"Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:049-223.git20230119.el8_8.1","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhcos","product":"Red Hat OpenShift Container Platform 4.12","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"412.86.202610250235-0","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://catalog.redhat.com/software/containers/","packageName":"dracut-main","product":"Red Hat Hardened Images","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"109-7.hum1","versionType":"rpm"}]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"dracut","product":"Red Hat Enterprise Linux 10","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"dracut","product":"Red Hat Enterprise Linux 6","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"dracut","product":"Red Hat Enterprise Linux 7","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"dracut","product":"Red Hat Enterprise Linux 9","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"dracut","product":"Red Hat OpenShift Container Platform 5","source":"CNA: redhat","vendor":"Red Hat","versions":[]}],"cveId":"CVE-2026-16445","cwes":["CWE-78"],"description":"A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP options, such as a malicious root-path, next-server, or bootfile name, to a system using dracut's NetworkManager-based initrd network module. These options are improperly handled and written into a temporary shell script without proper escaping, leading to command injection. This allows the attacker to achieve root code execution within the initramfs during system boot.","epss":{"date":"2026-11-02","percentile":0.88234,"score":0.03222},"exploits":[],"kev":null,"metrics":[{"score":7.5,"severity":"high","source":"CNA: redhat","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}],"modifiedAt":1793643499443,"publishedAt":1784638268650,"references":[{"source":"CNA: redhat","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:26534"},{"source":"CNA: redhat","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:40700"},{"source":"CNA: redhat","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:61252"},{"source":"CNA: redhat","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:69118"},{"source":"CNA: redhat","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:69119"},{"source":"CNA: redhat","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:90272"},{"source":"CNA: redhat","tags":["vdb-entry","x_refsource_REDHAT"],"url":"https://access.redhat.com/security/cve/CVE-2026-16445"},{"source":"CNA: redhat","tags":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2459963"},{"source":"CNA: redhat","tags":["issue-tracking","x_refsource_REDHAT"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2503147"},{"source":"CNA: redhat","tags":[],"url":"https://github.com/dracutdevs/dracut/commit/e509c638e6"}],"remediation":[{"kind":"workaround","source":"CNA: redhat","text":"Avoid using the root=dhcp/netroot=dhcp/root=dhcp6/netroot=dhcp6 kernel command-line options — these cause dracut to trust the DHCP server's root-path option to determine the boot target. Configuring the netroot target explicitly on the kernel/PXE command line instead (e.g. netroot=nfs:<server>:<path> or netroot=iscsi:... with a literal value)."}],"revision":"1186508018ec07b304793604b80158922b08d9508ff0d94ade80599bb1b1d18d","sources":[{"modifiedAt":1793643499443,"name":"CNA: redhat","retrievedAt":1793646546879,"url":"https://www.cve.org/CVERecord?id=CVE-2026-16445"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793646553318,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-16445"}],"ssvc":{"assessedAt":1784743124376,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"total"},"status":"published","title":"Dracut: dracut: root code execution via dhcp options command injection in networkmanager initrd module","updatedAt":1793646553318}