CVE-2026-86330 — Noobaa-core: noobaa-core: os command injection in cluster_internal_api.set_hostname_internal
An OS command injection flaw was found in the set_hostname_internal function of NooBaa's cluster_internal_api. This component is responsible for managing the Multi-Cloud Object …
Published: 2026-09-28 · CVSS: 7.2 · CVSS 3.1
An OS command injection flaw was found in the set_hostname_internal function of NooBaa's cluster_internal_api. This component is responsible for managing the Multi-Cloud Object Gateway in OpenShift Data Foundation. The vulnerability occurs because the hostname parameter is passed directly to a shell command without proper sanitization. An authenticated attacker with administrative privileges can provide a specially crafted hostname containing shell metacharacters to execute arbitrary commands on the host system with the privileges of the NooBaa process.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7