CVE-2026-4360 is a vulnerability in the Python Tarfile.extract() function where the filter parameter is not properly enforced when extracting untrusted tar files containing hardlinks. This flaw allows a local attacker to cause files to be written with unexpected ownership, potentially leading to unauthorized modifications or privilege escalation. The issue affects Red Hat Hardened Images python3 packages. Red Hat has issued security updates for python3.14 packages to fix this vulnerability.

The vulnerability allows a local attacker with low privileges to cause files to be written with unintended user or group ownership by exploiting specially crafted tar files with hardlinks. This can result in unauthorized file modifications and potentially compromise system integrity. No confidentiality or availability impacts are reported. There are no known exploits in the wild at this time.

Red Hat has released updated python3.14 RPM packages (version 3.14.6-2.1.hum1) that fix this vulnerability. Users should apply these official security updates to mitigate the issue. No additional mitigations are specified or required beyond applying the vendor-provided patches.