CVE-2026-84292VulnerabilityPublished 8 Oct 2026Updated 29 Oct 2026

Red Hat Security Advisory: General availability of the satellite/iop-remediations-rhel9 container image

Affects Red HatSource GCVE Database

Compare

Not known to be exploited.

Data as of 29 Oct 2026, 10:37 UTC

Severity

High

Rated by Threat Radar · CVSS not yet scored by NVD

EPSS: 0.2% chance of exploitation in 30 days – higher than 14% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

Exploitation evidence

Disclosed: evidence found.
CVE published 8 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 29 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

AI-suggested

Currently, no mitigation or patch is available that meets Red Hat Product Security's criteria for ease of deployment, applicability, or stability. Users should monitor Red Hat advisories for future updates. Red Hat recommends consulting the Red Hat Satellite documentation for installation and configuration guidance. Customers with a Technical Account Manager (TAM) can review this CVE directly with their TAM for tailored advice.

Description

A vulnerability (CVE-2026-84292) exists in the fast-uri component used by Red Hat Lightspeed in Satellite, where improper serialization of the URI port component allows an attacker to inject authority delimiters. This can cause the intended host to be demoted to user information and redirect authority to an attacker-controlled host, potentially leading to information disclosure and redirection of network traffic. No patch or mitigation currently meets Red Hat's criteria for deployment. The issue is rated as important and has a high severity impact on integrity.

Impact

The vulnerability allows remote attackers to redirect network traffic by injecting authority delimiters into the URI port component, causing applications to treat attacker-controlled hosts as legitimate. This compromises the integrity of communications and may lead to information disclosure. There is no indication of impact on confidentiality or availability. The flaw affects applications using the fast-uri library in Red Hat environments, specifically Red Hat Lightspeed in Satellite.

CWE-140Improper Neutralization of Delimiters (opens in a new tab)
Base weakness
The product does not neutralize or incorrectly neutralizes delimiters.
Implementation · Input Validation
Developers should anticipate that delimiters will be injected/removed/manipulated in the input vectors of their product. Use an appropriate combination of denylists and allowlists to ensure only valid, expected and appropriate input is processed by the system.
Implementation · Input Validation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
Implementation · Output Encoding
While it is risky to use dynamically-generated query strings, code, or commands that mix control and data together, sometimes it may be unavoidable. Properly quote arguments and escape any special characters within those arguments.
OWASP Cheat Sheets
Abuse Case (opens in a new tab)
Deserialization (opens in a new tab)
Server Side Request Forgery Prevention (opens in a new tab)
Unvalidated Redirects and Forwards (opens in a new tab)
Cross Site Scripting Prevention (opens in a new tab)
OWASP ASVS 4.0.3
V1.5.1 (opens in a new tab)
V5.2.2 (opens in a new tab)
Attack patterns
Command Delimiters (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-1289Improper Validation of Unsafe Equivalence in Input (opens in a new tab)
Base weakness
The product receives an input value that is used as a resource identifier or other type of reference, but it does not validate or incorrectly validates that the input is equivalent to a potentially-unsafe value.
Implementation · Input Validation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
OWASP Cheat Sheets
XML Security (opens in a new tab)
Mass Assignment (opens in a new tab)
OWASP ASVS 4.0.3
V13.3.1 (opens in a new tab)
V5.1.4 (opens in a new tab)
V5.1.3 (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Description

AI analysisMachine-generated, updated 29 Oct 2026, 10:07 UTC

WeaknessesCWE-140, CWE-1289

Technical details

References

Community reviews

Related threats