CVE-2026-19278: Red Hat Advanced Cluster Security 4

Medium severity, CVSS 6.8. EPSS: 0.3% chance of exploitation in the next 30 days.

A flaw was found in StackRox/RHACS Central's Auth Machine-to-Machine (M2M) token exchange. When an administrator configures M2M role mappings, the system uses unanchored regular expressions for matching claim values. This allows an attacker with a valid OpenID Connect (OIDC) token, whose claim value is a superstring of a configured pattern, to gain unauthorized access to roles they were not intended to receive. This can lead to privilege escalation within the system.

Affected products

• Red Hat Red Hat Advanced Cluster Security 4

Published 2026-08-10. Last modified 2026-08-14.