CVE-2026-105326: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') in Red Hat Red Hat Enterprise Linux 10

An argument injection flaw exists in the CUPS scheduler component of Red Hat Enterprise Linux 10. When printer subscription requests include a mailto notify-recipient-uri, the recipient address is passed to the sendmail program without proper sanitization. An attacker able to supply a recipient address beginning with a dash ('-') can influence sendmail's command-line options, potentially causing execution of arbitrary commands with the CUPS service user's privileges. Exploitation depends on the mail transfer agent installed and network exposure of the CUPS service.

Successful exploitation could allow an attacker with access to the CUPS service to execute arbitrary commands with the privileges of the CUPS service user. However, the impact is limited by the low privileges of the service user and the requirement for local or network access with high attack complexity. The confidentiality impact is low, with no integrity or availability impact reported.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-105326 for current remediation guidance. Until a patch is applied, restrict network access to the CUPS service to trusted users only and avoid configuring email notifications that use the mailto notify-recipient-uri if possible.