Authentication Bypass Vulnerability in BusyBox HTTP Daemon
CVE-2026-124738

5.3MEDIUM

Key Information:

Vendor

Red Hat
Status
Red Hat Enterprise Linux 6
Red Hat Hardened Images
Vendor
CVE Published:
11 November 2026

What is CVE-2026-124738?

A flaw was identified in the BusyBox HTTP daemon where, under specific conditions with pre-compressed file support enabled, the authentication checks are only verified against the requested URL path. This inconsistency can allow a remote attacker to exploit the vulnerability by requesting an uncompressed file path and manipulating gzip encoding, effectively bypassing the password protections implemented for compressed files. This exploitation could lead to unauthorized access to sensitive information stored within the affected files.

References

https://access.redhat.com/security/cve/CVE-2026-124738
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2571610
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank ducanhluu for reporting this issue.
.