What’s Vulnerable › Vulnerabilities

CVE-2026-92615: Flightctl: flightctl: package-global go-git https transport mutated per-repo -- cross-tenant tls-config bleed

• Severity: medium (CVSS 6.6 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-16 · updated 2026-09-17
• Weakness: CWE-413

Description

A flaw was found in flightctl. The configureRepoHTTPSClient() function in the device-render worker builds a per-repository tls.Config (which may include InsecureSkipVerify, a custom CA bundle, or tenant-supplied mTLS client certificates) and installs it into go-git's process-global client.Protocols map via gitclient.InstallProtocol("https", ...). Because the worker renders devices for multiple organizations concurrently from a shared goroutine pool, whichever tenant's repository configuration is written last wins for all in-flight git.Clone calls. This race condition can cause one tenant's TLS settings, including InsecureSkipVerify or mTLS client credentials, to leak into another tenant's git operations.

Affected products

• Red Hat Advanced Cluster Management for Kubernetes 2: all versions
• Red Hat Edge Manager 1: all versions

References

• https://access.redhat.com/security/cve/CVE-2026-92615
• https://bugzilla.redhat.com/show_bug.cgi?id=2518323

Get alerted when CVE-2026-92615 or the next vulnerability affects your stack