---
id: "CVE-2026-108472"
page: "https://infrastack.ai/live/CVE-2026-108472"
kind: "vulnerability"
aliases: ["CVE-2026-108472"]
title: "xfsprogs: xfs_admin input validation flaw allows local command execution"
severity: "high"
cvss: 7.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "xfsprogs", "fixed": [], "affected": "unknown versions; Red Hat lists RHEL 7-10, OpenShift 4 as affected", "ecosystem": "vendor"}]
ecosystems: []
tags: ["infrastructure", "linux", "openshift", "rhel", "self-hosted", "xfsprogs"]
not_affected_if: ["no-untrusted-local-users", "xfsprogs-not-installed"]
published_at: "2026-11-11T19:17:29+00:00"
first_seen_at: "2026-11-11T19:28:44+00:00"
updated_at: "2026-11-11T19:33:28+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108472", "first_seen_at": "2026-11-11T19:28:44+00:00"}, {"source": "analyst", "url": "https://access.redhat.com/security/cve/CVE-2026-108472", "first_seen_at": "2026-11-11T19:33:28+00:00", "cites": ["https://access.redhat.com/security/cve/CVE-2026-108472", "https://bugzilla.redhat.com/show_bug.cgi?id=2548925"]}]
exploit_sources: []
---

# xfsprogs: xfs_admin input validation flaw allows local command execution

Link for people: https://infrastack.ai/live/CVE-2026-108472 (this .md is for agents)

The xfs_admin utility in xfsprogs does not validate user-supplied arguments, so crafted input can inject operating system commands. A local attacker may run arbitrary commands and escalate privileges, depending on how xfs_admin is run.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:xfsprogs affected unknown versions; Red Hat lists RHEL 7-10, OpenShift 4 as affected fixed no fixed version listed

## How to check

Check whether xfsprogs is installed (rpm -q xfsprogs or dpkg -l xfsprogs). Then look for scripts, sudoers rules, provisioning tools or cron jobs that call xfs_admin with externally supplied values (labels, UUIDs, device names). Fixed versions are not published yet; track https://access.redhat.com/security/cve/CVE-2026-108472.

## Fix

No fixed xfsprogs version published as of 2026-11-11 (Red Hat Bugzilla 2548925 status NEW). Until then, do not pass untrusted input to xfs_admin and restrict who can run it.

## Timeline

- 2026-11-11T19:28:44+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-108472
- 2026-11-11T19:33:28+00:00 analyst https://access.redhat.com/security/cve/CVE-2026-108472 — Red Hat advisory+Bugzilla read: no fixed version published yet (bug status NEW), no mitigation per Red Hat. Rated Important; exposure needs untrusted input passed to xfs_admin (delegation/provisioning tools). Upstream xfsprogs fix not found.

## Documents

- [advisory] Red Hat CVE-2026-108472 https://access.redhat.com/security/cve/CVE-2026-108472
- [describes] Red Hat Bugzilla 2548925 https://bugzilla.redhat.com/show_bug.cgi?id=2548925

## From the sources

A flaw was found in the xfs_admin utility in xfsprogs. The tool does not properly validate user-supplied parameters, allowing operating system command injection. A local attacker can exploit this issue by providing crafted input arguments, which may result in arbitrary command execution and local privilege escalation depending on how xfs_admin is executed.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_