{"id":"CVE-2026-108472","kind":"vulnerability","aliases":["CVE-2026-108472"],"related":[],"title":"xfsprogs: xfs_admin input validation flaw allows local command execution","description":"A flaw was found in the xfs_admin utility in xfsprogs. The tool does not properly validate user-supplied parameters, allowing operating system command injection. A local attacker can exploit this issue by providing crafted input arguments, which may result in arbitrary command execution and local privilege escalation depending on how xfs_admin is executed.","summary":"The xfs_admin utility in xfsprogs does not validate user-supplied arguments, so crafted input can inject operating system commands. A local attacker may run arbitrary commands and escalate privileges, depending on how xfs_admin is run.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"xfsprogs","fixed":[],"affected":"unknown versions; Red Hat lists RHEL 7-10, OpenShift 4 as affected","ecosystem":"vendor"}],"ecosystems":[],"tags":["infrastructure","linux","openshift","rhel","self-hosted","xfsprogs"],"not_affected_if":["no-untrusted-local-users","xfsprogs-not-installed"],"how_to_check":"Check whether xfsprogs is installed (rpm -q xfsprogs or dpkg -l xfsprogs). Then look for scripts, sudoers rules, provisioning tools or cron jobs that call xfs_admin with externally supplied values (labels, UUIDs, device names). Fixed versions are not published yet; track https://access.redhat.com/security/cve/CVE-2026-108472.","fix":"No fixed xfsprogs version published as of 2026-11-11 (Red Hat Bugzilla 2548925 status NEW). Until then, do not pass untrusted input to xfs_admin and restrict who can run it.","status":"open","published_at":"2026-11-11T19:17:29+00:00","first_seen_at":"2026-11-11T19:28:44+00:00","triaged_at":"2026-11-11T19:29:59+00:00","updated_at":"2026-11-11T19:33:28+00:00","category":"infrastructure","confidence":0.75,"triage":{"at":"2026-11-11T19:29:59Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"xfsprogs: xfs_admin input validation flaw allows local command execution","impact":"high","summary":"The xfs_admin utility in xfsprogs does not validate user-supplied arguments, so crafted input can inject operating system commands. A local attacker may run arbitrary commands and escalate privileges, depending on how xfs_admin is run.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["linux","xfsprogs","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user runs arbitrary commands and escalates privileges as root","analyst_note":"Sources do not give affected or fixed xfsprogs versions or whether the flaw needs privileged invocation; check the NVD entry and the xfsprogs upstream changelog.","how_to_check":"- Check the installed version with `xfs_admin -V` and compare it with the fixed versions listed by the vendor (unknown in the sources).\n- Check whether `xfs_admin` is run by scripts, cron jobs or privileged tooling on the machine.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["xfsprogs-not-installed","no-untrusted-local-users"],"who_is_affected":"Systems that have xfsprogs installed and where local users or services can pass arguments to xfs_admin, especially when it runs with elevated privileges. Machines without xfsprogs or without untrusted local users are less exposed. The sources do not name the affected version range.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000743,"input_tokens":4547,"output_tokens":577,"severity_before":"high"},"analyst_status":"done","analyst_note":"Sources do not give affected or fixed xfsprogs versions or whether the flaw needs privileged invocation; check the NVD entry and the xfsprogs upstream changelog.","search":"'-108472':13A,16A '-2026':12A,15A 'admin':3A,28B,61B,71C,117C 'allow':7A,85C 'arbitrari':52B,106C 'argument':38B,101C 'attack':49B,92C 'command':9A,46B,53B,88C,107C 'craft':40B,99C 'cve':11A,14A 'depend':57B,113C 'escal':55B,112C 'execut':10A,108C,119C 'exploit':94C 'flaw':6A,65C 'found':67C 'host':24B 'infrastructur':18B 'inject':43B,89C 'input':4A,41B,100C 'issu':96C 'linux':19B 'local':8A,48B,91C,110C 'may':50B,103C 'openshift':20B 'oper':44B,86C 'paramet':84C 'privileg':56B,111C 'proper':79C 'provid':98C 'result':104C 'rhel':21B 'run':51B,63B 'self':23B 'self-host':22B 'suppli':37B,83C 'system':45B,87C 'tool':76C 'user':36B,82C 'user-suppli':35B,81C 'util':29B,72C 'valid':5A,34B,80C 'xfs':2A,27B,60B,70C,116C 'xfsprog':1A,25B,31B,74C 'xfsprogs':17A","nicknames":[],"mitigations":[],"who_affected":"Systems with xfsprogs where an untrusted or less-privileged party can influence the arguments passed to xfs_admin, e.g. through administrative delegation, sudo rules, or automated provisioning tools running it with elevated rights. Red Hat says that on standard RHEL installs storage tools are limited to admin accounts, so direct exposure to unprivileged users is unlikely. Red Hat lists RHEL 7, 8, 9, 10 and OpenShift Container Platform 4 as affected; hosts without xfsprogs or where only trusted admins call xfs_admin can skip it.","tier":"B","verified":{"mitigations":{"at":"2026-11-11T19:33:28Z","by":"analyst","doc":"https://access.redhat.com/security/cve/CVE-2026-108472","run_id":3590},"who_affected":{"at":"2026-11-11T19:33:28Z","by":"analyst","doc":"https://access.redhat.com/security/cve/CVE-2026-108472","run_id":3590}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["xfsprogs"],"ptokens":["xfsprogs"],"labels":["high","infrastructure","linux","openshift","rhel","selfhosted","xfsprogs"],"campaign_type":null,"search_a":"'-108472':13A,16A '-2026':12A,15A 'admin':3A 'allow':7A 'command':9A 'cve':11A,14A 'execut':10A 'flaw':6A 'input':4A 'local':8A 'valid':5A 'xfs':2A 'xfsprog':1A 'xfsprogs':17A","search_b":"'admin':28B,61B 'arbitrari':52B 'argument':38B 'attack':49B 'command':46B,53B 'craft':40B 'depend':57B 'escal':55B 'host':24B 'infrastructur':18B 'inject':43B 'input':41B 'linux':19B 'local':48B 'may':50B 'openshift':20B 'oper':44B 'privileg':56B 'rhel':21B 'run':51B,63B 'self':23B 'self-host':22B 'suppli':37B 'system':45B 'user':36B 'user-suppli':35B 'util':29B 'valid':34B 'xfs':27B,60B 'xfsprog':25B,31B","search_c":"'admin':71C,117C 'allow':85C 'arbitrari':106C 'argument':101C 'attack':92C 'command':88C,107C 'craft':99C 'depend':113C 'escal':112C 'execut':108C,119C 'exploit':94C 'flaw':65C 'found':67C 'inject':89C 'input':100C 'issu':96C 'local':91C,110C 'may':103C 'oper':86C 'paramet':84C 'privileg':111C 'proper':79C 'provid':98C 'result':104C 'suppli':83C 'system':87C 'tool':76C 'user':82C 'user-suppli':81C 'util':72C 'valid':80C 'xfs':70C,116C 'xfsprog':74C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T19:17:29+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-108472","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108472","severity":null,"published_at":"2026-11-11T19:17:29+00:00","modified_at":"2026-11-11T19:17:29+00:00","first_seen_at":"2026-11-11T19:28:44+00:00","fetched_at":"2026-11-11T19:28:44+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-108472:3590","url":"https://access.redhat.com/security/cve/CVE-2026-108472","severity":null,"published_at":"2026-11-11T19:33:28+00:00","modified_at":"2026-11-11T19:33:28+00:00","first_seen_at":"2026-11-11T19:33:28+00:00","fetched_at":"2026-11-11T19:33:28+00:00","note":"Red Hat advisory+Bugzilla read: no fixed version published yet (bug status NEW), no mitigation per Red Hat. Rated Important; exposure needs untrusted input passed to xfs_admin (delegation/provisioning tools). Upstream xfsprogs fix not found.","cites":["https://access.redhat.com/security/cve/CVE-2026-108472","https://bugzilla.redhat.com/show_bug.cgi?id=2548925"]}],"documents":[{"id":128332,"url":"https://access.redhat.com/security/cve/CVE-2026-108472","title":"Red Hat CVE-2026-108472","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":128333,"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2548925","title":"Red Hat Bugzilla 2548925","kind":"issue","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}