CVE-2026-19278
Received Received - Intake

Unauthorized Privilege Escalation in StackRox RHACS Central via M2M Token Exchange

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: Red Hat, Inc.

Description
A flaw was found in StackRox/RHACS Central's Auth Machine-to-Machine (M2M) token exchange. When an administrator configures M2M role mappings, the system uses unanchored regular expressions for matching claim values. This allows an attacker with a valid OpenID Connect (OIDC) token, whose claim value is a superstring of a configured pattern, to gain unauthorized access to roles they were not intended to receive. This can lead to privilege escalation within the system.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-19278
EUVD
EUVD-2026-55617

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
redhat stackrox_rhacs_central *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-625 The product uses a regular expression that does not sufficiently restrict the set of allowed values.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in StackRox/RHACS Central's Auth Machine-to-Machine (M2M) token exchange. It occurs when administrators configure role mappings using unanchored regular expressions. Instead of exact matching, the system performs substring matching, allowing attackers with valid OIDC tokens to gain unauthorized access to roles by having claim values that are superstrings of configured patterns. This leads to privilege escalation.

Detection Guidance

Review Auth M2M role mappings in StackRox/RHACS Central for unanchored regular expressions in valueExpression fields. Check if patterns lack ^ or $ delimiters. Inspect OIDC token claims for values that could be superstrings of configured patterns.

Impact Analysis

An attacker could exploit this to gain elevated privileges within the system by exchanging their OIDC token for a Central access token with unauthorized roles. This requires the attacker to have access to a trusted identity provider and an admin-configured M2M mapping with an unanchored pattern. The impact includes potential unauthorized access, data breaches, and system compromise.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating confidentiality and integrity requirements in GDPR and HIPAA. Unauthorized privilege escalation may result in non-compliance with access control and data protection regulations, potentially leading to legal and financial penalties.

Mitigation Strategies

Update Auth M2M role mappings to anchor regular expressions with ^ and $ delimiters for exact matching. Reload the configuration or restart the Central service to apply changes. Ensure the token exchange endpoint is properly authenticated.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19278. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart