CVE-2026-88834: Observable Discrepancy in Red Hat Red Hat Hardened Images
Description
A flaw was found in BusyBox's httpd web server. When configured with system password authentication, a user existence oracle may exist in certain build configurations. An attacker could distinguish existing from non-existing usernames by observing authentication failure behavior. Impact is limited to username enumeration and requires non-default compile options or uncommon password file states; default BusyBox builds with shadow password support are not affected.
CVSS v3.1
Score 3.7low
Affected software
Red Hat
Red Hat Hardened Images
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
A flaw in BusyBox's httpd web server can lead to a user existence oracle when system password authentication is enabled under certain build configurations. This allows an attacker to distinguish existing usernames from non-existing ones by analyzing authentication failure responses. The vulnerability is limited to username enumeration and requires specific non-default compile-time options or unusual password file states. Default BusyBox builds with shadow password support are not vulnerable.
Potential Impact
The impact is limited to information disclosure through username enumeration. There is no confidentiality, integrity, or availability impact beyond this. Exploitation requires specific build configurations and password file states that are not common in default deployments.
Mitigation Recommendations
No explicit patch or remediation status is provided in the vendor advisory. Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-88834 for current remediation guidance. Users should verify their BusyBox httpd build configurations and avoid non-default compile options that enable this behavior. Default BusyBox builds with shadow password support are not affected.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- redhat
- Date Reserved
- 2026-09-10T09:42:04.559Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2026-88834","vendor":"Red Hat"}]
Threat ID: 6ace649b2cdf04f6568af141
Added to database: 10/13/2026, 17:04:27 UTC
Last enriched: 10/13/2026, 17:19:08 UTC
Last updated: 10/13/2026, 17:34:13 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.