CVE-2026-92615
Flightctl: flightctl: package-global go-git https transport mutated per-repo -- cross-tenant tls-config bleed
A flaw was found in flightctl. The configureRepoHTTPSClient() function in the device-render worker builds a per-repository tls.Config (which may include InsecureSkipVerify, a custom CA bundle, or tenant-supplied mTLS client certificates) and installs it into go-git's process-global client.Protocols map via gitclient.InstallProtocol("https", ...). Because the worker renders devices for multiple organizations concurrently from a shared goroutine pool, whichever tenant's repository configuration is written last wins for all in-flight git.Clone calls. This race condition can cause one tenant's TLS settings, including InsecureSkipVerify or mTLS client credentials, to leak into another tenant's git operations.
Fixes and workarounds
Workaround
There is no application-level workaround that fully eliminates this race condition without a code change. The following deployment-level measures reduce exposure in multi-tenant environments: - Avoid mTLS client certificates for git repositories: If tenant Repository resources do not supply client TLS certificates (httpConfig.tls.clientCertificate), the most sensitive data (client private key material) is absent from the global transport and cannot leak. - Avoid skipServerVerification: Do not set httpConfig.skipServerVerification: true on any Repository resource. This prevents a tenant's InsecureSkipVerify=true from propagating to other tenants' clones, which would otherwise allow an on-path attacker to serve malicious configuration.
Source: CNA: redhatAffected products and versions
| Product | Versions | Authority |
|---|---|---|
| RHEM 1.2 for RHEL 10 Red Hat flightctl
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:1.2.2-1.el10; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| RHEM 1.2 for RHEL 9 Red Hat flightctl
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:1.2.2-1.el9; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat Advanced Cluster Management for Kubernetes 2 Red Hat flightctl
https://access.redhat.com/downloads/content/package-browser/ |
Range not reported
Other versions: affected |
CNA: redhat |
Version ranges are source assertions. Check the vendor advisory and your installed configuration before determining exposure.
CVSS assessments
| Version / score | Vector | Authority |
|---|---|---|
| 3.1 / 6.6 medium |
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:N | CNA: redhat |
Exploit evidence
No exploit evidence in collected sources. This is not proof of no exploitation.
References
- https://access.redhat.com/errata/RHSA-2026:94632CNA: redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2026-92615CNA: redhat · vdb-entry, x_refsource_REDHAT
- https://bugzilla.redhat.com/show_bug.cgi?id=2518323CNA: redhat · issue-tracking, x_refsource_REDHAT
For agents and automation
Read public disclosures for free as Markdown or JSON. Compatible browsers also expose native WebMCP tools to search disclosures, read this page, and discover API access.
Use the ontology-linked Cyber API with x402 pay per request, or a Y2 Pro or Elite API key with the intel:cyber scope.
Endpoints and access details
https://api.y2.dev/api/v2/cyber/cveshttps://api.y2.dev/api/v2/cyber/cves/{cveId}
A workspace owner or admin can create a Pro or Elite API key. Send Authorization: Bearer <Y2_API_KEY> from your trusted agent runtime.
For x402, omit Authorization and read the HTTP 402 payment challenge before signing a retry. Public browser tools do not make payments.