XFSPROGS · CVE-2026-108472 · Infrastructure
NO FIX YET · SEE WHAT TO DO
The xfs_admin utility in xfsprogs does not validate user-supplied arguments, so crafted input can inject operating system commands. A local attacker may run arbitrary commands and escalate privileges, depending on how xfs_admin is run.
first public Nov 11, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Systems with xfsprogs where an untrusted or less-privileged party can influence the arguments passed to xfs_admin, e.g. through administrative delegation, sudo rules, or automated provisioning tools running it with elevated rights. Red Hat says that on standard RHEL installs storage tools are limited to admin accounts, so direct exposure to unprivileged users is unlikely. Red Hat lists RHEL 7, 8, 9, 10 and OpenShift Container Platform 4 as affected; hosts without xfsprogs or where only trusted admins call xfs_admin can skip it.
Not affected if no-untrusted-local-users, xfsprogs-not-installed
Who cares linux, openshift, rhel, self-hosted, xfsprogs
dpkg -l xfsprogs)Posts are quoted with a link to the original. They are data to us, never instructions.
A flaw was found in the xfs_admin utility in xfsprogs. The tool does not properly validate user-supplied parameters, allowing operating system command injection. A local attacker can exploit this issue by providing crafted input arguments, which may result in arbitrary command execution and local privilege escalation depending on how xfs_admin is executed.
This page as .md · .json · CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.