CVE-2026-19278: Stackrox: stackrox: privilege escalation via unanchored regular expressions in auth m2m role mappings
A flaw was found in StackRox/RHACS Central's Auth Machine-to-Machine (M2M) token exchange. When an administrator configures M2M role mappings, the system uses unanchored regular expressions for matching claim values. This allows an attacker with a valid OpenID Connect (OIDC) token, whose claim value is a superstring of a configured pattern, to gain unauthorized access to roles they were not intended to receive. This can lead to privilege escalation within the system.
Other sources
A flaw was found in StackRox/RHACS Central's Auth Machine-to-Machine (M2M) token exchange. When an administrator configures M2M role mappings, the valueExpression is compiled into a regular expression without anchoring (no ^ or $ delimiters). Because Go's regexp.MatchString performs substring matching, a mapping intended to match an exact claim value instead matches any token claim that contains that value as a substring. An identity whose claim value is a superstring of the configured pattern (e.g. a branch named "main-poc" matching a mapping for "main") can exchange its third-party OIDC token for a Central access token carrying a role it was never intended to receive. The token exchange endpoint (ExchangeAuthMachineToMachineToken) is unauthenticated.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update M2M role mappings so valueExpression is anchored (use ^...$) because the system currently compiles valueExpression into a regular expression without anchoring, and Go regexp.MatchString performs substring matching.
StackRox/RHACS Central Auth Machine-to-Machine (M2M) role mappings valueExpression (claim-value regex used for matching) = Require anchored regular expressions (add ^ and $ anchors) so the configured pattern matches the exact claim value rather than substrings. - Compensating control
Restrict network access to the unauthenticated token exchange endpoint ExchangeAuthMachineToMachineToken (e.g., via firewall/ingress rules/ACL so it is only reachable from trusted systems).
Event History
Frequently Asked Questions
What is CVE-2026-19278?
CVE-2026-19278 is a vulnerability in Stackrox/RHACS Central's Auth Machine-to-Machine (M2M) token exchange that allows privilege escalation via unanchored regular expressions in role mappings.
What is the severity of CVE-2026-19278?
The severity of CVE-2026-19278 is medium, rated at 6.8 on the CVSS scale.
How do I fix CVE-2026-19278?
To mitigate CVE-2026-19278, ensure that role mappings do not use unanchored regular expressions for matching claim values.
What systems are affected by CVE-2026-19278?
CVE-2026-19278 affects StackRox/RHACS Central's Auth Machine-to-Machine (M2M) token exchange.
What is the risk level associated with CVE-2026-19278?
CVE-2026-19278 has a risk level of 52, indicating a potential risk of exploiting the privilege escalation flaw.