Skip to content
OpenAdvisories
Medium · 6.8 CVE-2026-19278 EUVD-2026-55617GHSA-7c5g-xvpm-qr5v

Stackrox: stackrox: privilege escalation via unanchored regular expressions in auth m2m role mappings

Published Aug 10, 2026 · Updated Aug 11, 2026 · Assigned by redhat

Description

A flaw was found in StackRox/RHACS Central's Auth Machine-to-Machine (M2M) token exchange. When an administrator configures M2M role mappings, the system uses unanchored regular expressions for matching claim values. This allows an attacker with a valid OpenID Connect (OIDC) token, whose claim value is a superstring of a configured pattern, to gain unauthorized access to roles they were not intended to receive. This can lead to privilege escalation within the system.

Affected products

VendorProductAffectedFixed
Red Hat Red Hat Advanced Cluster Security 4 — —

References