---
id: "CVE-2026-115424"
kind: "vulnerability"
aliases: ["CVE-2026-115424"]
title: "OpenShift oc: malicious image layers can write files outside extraction directory"
severity: "medium"
cvss: 5.5
epss: 0.00164
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["ci-cd", "containers", "infrastructure", "oc-cli", "openshift"]
not_affected_if: ["no-image-extract-usage", "trusted-images-only"]
published_at: "2026-10-22T22:18:06+00:00"
first_seen_at: "2026-10-23T21:57:32+00:00"
updated_at: "2026-10-25T04:10:42+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115424", "first_seen_at": "2026-10-23T21:57:32+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-115424", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# OpenShift oc: malicious image layers can write files outside extraction directory

The OpenShift client oc does not sanitize symlink and hardlink targets when running oc image extract, so a crafted container image can place links pointing to absolute paths or sibling directories. An attacker can then write attacker-controlled content to arbitrary host locations with the privileges of the user running the command.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `oc version --client` to find the installed client version and compare it against the fixed release listed in the NVD or vendor entry
- Check whether any scripts or pipelines run `oc image extract` against images from untrusted registries

## Fix

- Upgrade the oc client to a release that includes the fix for CVE-2026-115424 (fixed version: unknown)
- Until upgraded, only run `oc image extract` on images from trusted sources, into a dedicated empty directory

## Timeline

- 2026-10-23T21:57:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115424
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-115424

## From the sources

A flaw was found in the OpenShift client oc. When extracting container image layers with oc image extract, the application fails to properly sanitize symbolic and hard link targets pointing to absolute paths or to sibling directories of the extraction destination. An attacker who supplies a malicious container image can exploit this vulnerability by embedding links, and a chained file entry, that reference locations outside the intended extraction directory. This allows the attacker to write attacker-controlled content to arbitrary locations on the host filesystem with the privileges of the user running the command, potentially leading to file modification outside the destination directory.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_