Threats tagged 'ghsa-7vw6-56j5-6r97'

CVE-2026-125672 is a vulnerability in cockpit-storaged where a Tang keyserver address read from a clevis token in a LUKS header is concatenated into curl's argument vector without a proper '--' separator. This allows an attacker who can attach a crafted LUKS/clevis block device to cause curl to interpret an address starting with '-' as an option, leading to curl option injection. Exploitation requires a local unprivileged user with console or desktop login access and an administratively-privileged Cockpit user to interact with the affected device's Tang keyserver settings. The flaw can lead to arbitrary file read or write as the Cockpit session user. No complete mitigation exists without a code fix, but restricting local interactive access and verifying keyserver addresses can partially mitigate risk.