Flaw in OpenShift Sandboxed Containers by Red Hat Leading to Security Risks
CVE-2026-121876

7.9HIGH

Key Information:

Vendor

Red Hat
Status
Red Hat Enterprise Linux 10
Red Hat Enterprise Linux 6
Red Hat Enterprise Linux 7
Red Hat Enterprise Linux 8
Vendor
CVE Published:
12 November 2026

What is CVE-2026-121876?

A security flaw has been identified in the interaction between systemd-gpt-auto-generator and confidential computing guest VM images in OpenShift Sandboxed Containers. This vulnerability allows a malicious host to inject unauthorized partitions into the guest's virtual disk without user confirmation. Particularly concerning is the injection of a swap partition, which compromises the confidentiality of TEE-encrypted memory by enabling the guest kernel to write sensitive data to a host-controlled block device. The default configuration does not prevent the auto-discovery and mounting of non-root partitions, leaving critical data vulnerable. Moreover, the existing remote attestation mechanisms fail to detect modifications to the partition table, further exacerbating the risk of data exposure.

References

https://access.redhat.com/security/cve/CVE-2026-121876
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2558210
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
7.9
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank Spyros Seimenis (Edgeless Systems) for reporting this issue.
.