The vulnerability CVE-2026-3184 affects the util-linux package's login(1) utility in Red Hat Hardened Images. When the login utility is invoked with the -h option, it improperly canonicalizes the supplied remote hostname, modifying it before setting the PAM_RHOST environment variable. This can be exploited by a remote attacker who provides a specially crafted hostname to bypass host-based Pluggable Authentication Modules (PAM) access control rules that depend on fully qualified domain names. The issue is classified as low severity with a CVSS score of 3.7, reflecting network attack vector with high attack complexity and no privileges required. The Red Hat advisory does not explicitly confirm a patch or remediation level for this vulnerability.

The vulnerability could allow unauthorized access by bypassing host-based PAM access control rules that rely on fully qualified domain names. However, the impact is limited to integrity (I:L) with no confidentiality or availability impact. There are no known exploits in the wild, and the attack complexity is high, requiring a specially crafted hostname. The overall severity is low.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-3184 for current remediation guidance. The advisory linked does not explicitly mention an available fix or update for this vulnerability. Users should monitor Red Hat's official channels for updates. No specific mitigations are provided by the vendor advisory at this time.