{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-10079", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "PUBLISHED", "assignerShortName": "redhat", "dateReserved": "2026-05-29T10:07:21.654Z", "datePublished": "2026-07-31T09:08:20.223Z", "dateUpdated": "2026-07-31T09:08:20.223Z"}, "containers": {"cna": {"title": "Stackrox: stackrox: deploy-time policy enforcement and visibility bypass via label injection", "metrics": [{"other": {"content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.5, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N", "version": "3.1"}, "format": "CVSS"}], "descriptions": [{"lang": "en", "value": "A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). When processing Kubernetes Deployments, ACS replaces deployment identity metadata based on the openshift.io/encoded-deployment-config label. A user with permission to create Deployments can set this label to \"null\", causing ACS to treat the workload as having empty UID, name and labels and namespace \"default\". This bypasses deploy-time policy detection and enforcement visibility, prevents correct persistence in Central and breaks violation reporting and compliance correlation for the affected deployment."}], "affected": [{"vendor": "Red Hat", "product": "Red Hat Advanced Cluster Security 4", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "advanced-cluster-security/rhacs-main-rhel8", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:advanced_cluster_security:4"]}, {"vendor": "Red Hat", "product": "Red Hat Advanced Cluster Security 4", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "advanced-cluster-security/rhacs-roxctl-rhel8", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:advanced_cluster_security:4"]}, {"vendor": "Red Hat", "product": "Red Hat Advanced Cluster Security 4", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "advanced-cluster-security/rhacs-scanner-v4-rhel8", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:advanced_cluster_security:4"]}], "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-10079", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2483158", "name": "RHBZ#2483158", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "datePublic": "2026-07-31T09:00:41.441Z", "problemTypes": [{"descriptions": [{"cweId": "CWE-345", "description": "Insufficient Verification of Data Authenticity", "lang": "en", "type": "CWE"}]}], "x_redhatCweChain": "CWE-345: Insufficient Verification of Data Authenticity", "workarounds": [{"lang": "en", "value": "There is no complete mitigation other than installing the update once available."}], "timeline": [{"lang": "en", "time": "2026-05-29T07:18:12.497Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-07-31T09:00:41.441Z", "value": "Made public."}], "credits": [{"lang": "en", "value": "This issue was discovered by Moritz Clasmeier (Red Hat)."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-07-31T09:08:20.223Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}}}

{}

{}

{}

{}