CVE-2026-107174: UNIX Symbolic Link (Symlink) Following in Red Hat OpenShift Serverless
Description
A flaw was found in source-to-image. When unpacking archive files, the application fails to properly sanitize symbolic links pointing to absolute file paths. An attacker who supplies a malicious builder image can exploit this vulnerability by embedding links pointing outside the extraction directory. This allows the attacker to bypass sandbox boundaries, potentially leading to unauthorized information disclosure or file modification on the host system.
CVSS v3.1
Score 6.4medium
Affected software
Red Hat
OpenShift Serverless
Red Hat
OpenShift Source-to-Image (S2I)
Red Hat
Red Hat OpenShift Container Platform 4
Red Hat
Red Hat Web Terminal
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in Red Hat OpenShift Serverless's source-to-image occurs when unpacking archive files that contain symbolic links. The application does not properly sanitize symbolic links that point to absolute file paths outside the extraction directory. An attacker who provides a malicious builder image can embed such symlinks, enabling them to escape the sandbox environment. This can result in unauthorized disclosure or modification of files on the host system. The vulnerability is tracked as CVE-2026-107174 with a CVSS 3.1 score of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N).
Potential Impact
Successful exploitation allows an attacker with the ability to supply a malicious builder image to bypass sandbox boundaries in OpenShift Serverless. This can lead to unauthorized information disclosure or modification of files on the host system. The impact is limited to confidentiality and integrity with no availability impact. The attack requires network access and low complexity with low privileges but no user interaction.
Mitigation Recommendations
Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-107174 for current remediation guidance. Until an official fix is available, restrict the ability to supply builder images to trusted sources only to reduce risk.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- redhat
- Date Reserved
- 2026-10-07T12:26:30.460Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2026-107174","vendor":"Red Hat"}]
Threat ID: 6ac65be92cdf04f656586d73
Added to database: 10/07/2026, 14:49:13 UTC
Last enriched: 10/07/2026, 15:03:24 UTC
Last updated: 10/07/2026, 18:56:10 UTC
Views: 18
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.