CVE-2026-19278
MediumCVSS 6.8Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
In StackRox/RHACS Central's M2M token exchange, unanchored regular expressions are used for matching claim values, allowing an attacker with a valid OIDC token to gain unauthorized access to roles.
Risk Assessment
An attacker can escalate privileges in the system, gaining access to roles they should not have, potentially leading to security breaches.
Recommendation
Update StackRox/RHACS Central to a version with a fix that uses anchored regular expressions in M2M role mappings.
Original NVD description (English source)
A flaw was found in StackRox/RHACS Central's Auth Machine-to-Machine (M2M) token exchange. When an administrator configures M2M role mappings, the system uses unanchored regular expressions for matching claim values. This allows an attacker with a valid OpenID Connect (OIDC) token, whose claim value is a superstring of a configured pattern, to gain unauthorized access to roles they were not intended to receive. This can lead to privilege escalation within the system.