Race Condition Vulnerability in Flight Control Application Affecting Red Hat
CVE-2026-92615

6.6MEDIUM

Key Information:

Vendor

Red Hat
Status
Red Hat Advanced Cluster Management For Kubernetes 2
Red Hat Edge Manager 1
Vendor
CVE Published:
16 September 2026

What is CVE-2026-92615?

A race condition exists in the Flight Control application, specifically within the configureRepoHTTPSClient() function of the device-render worker. This flaw can lead to unintended leakage of TLS settings, including InsecureSkipVerify or mTLS client certificates, among tenants. Since the application processes multiple tenant repositories concurrently using a shared goroutine pool, the last written repository configuration can override previous settings. This behavior compromises the security of tenant-specific operations during git cloning, potentially exposing sensitive data across different organizations.

References

https://access.redhat.com/security/cve/CVE-2026-92615
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2518323
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
6.6
Severity:
MEDIUM
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.