CVE-2026-115424: UNIX Symbolic Link (Symlink) Following in Red Hat Red Hat OpenShift Container Platform 4

The vulnerability in the OpenShift client 'oc' involves improper sanitization of symbolic and hard link targets during container image layer extraction. Specifically, links that reference absolute paths or sibling directories outside the extraction target are not correctly handled, enabling an attacker to embed malicious links and file entries in a container image. When extracted, these can cause files to be written outside the intended directory, with the permissions of the user executing 'oc image extract'. This can lead to unauthorized file modification on the host system.

An attacker who can supply a malicious container image can exploit this vulnerability to write attacker-controlled content to arbitrary locations on the host filesystem. The impact is file modification outside the intended extraction directory, executed with the privileges of the user running the 'oc' command. This could lead to integrity violations of the host system files but does not directly affect confidentiality or availability according to the CVSS vector.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-115424 for current remediation guidance. Until a fix is applied, users should exercise caution when extracting container images from untrusted sources and consider running the extraction command with minimal privileges.