RHSA-2026:60428: Important: iscsi-initiator-utils security, bug fix, and enhancement update
Important: iscsi-initiator-utils security, bug fix, and enhancement update
Other sources
The iscsi-initiator-utils packages provide the server daemon for the Internet Small Computer System Interface (iSCSI) protocol, as well as the utility programs used to manage it. The iSCSI protocol is a protocol for distributed disk access using SCSI commands sent over Internet Protocol (IP) networks.Security Fix(es): open-iscsi: open-iscsi: Authentication bypass in iscsiuio control socket (CVE-2026-44944) open-iscsi: open-iscsi: Privilege Escalation via Path Traversal (CVE-2026-44943) Bug Fix(es) and Enhancement(s): [FJ9.7 Bug][REG]: iscsiadm reports node.discoverytype as "fw", although it should be "static". [rhel-9.6.z] (JIRA:RHEL-191896) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/iscsi-initiator-utilsto a version that resolves this vulnerability.Fixed in 6.2.1.9-1.gita65a472.el9_6.3 - Upgrade
Upgrade
redhat/iscsi-initiator-utils-debuginfoto a version that resolves this vulnerability.Fixed in 6.2.1.9-1.gita65a472.el9_6.3 - Upgrade
Upgrade
redhat/iscsi-initiator-utils-debugsourceto a version that resolves this vulnerability.Fixed in 6.2.1.9-1.gita65a472.el9_6.3 - Upgrade
Upgrade
redhat/iscsi-initiator-utils-iscsiuioto a version that resolves this vulnerability.Fixed in 6.2.1.9-1.gita65a472.el9_6.3 - Upgrade
Upgrade
redhat/iscsi-initiator-utils-iscsiuio-debuginfoto a version that resolves this vulnerability.Fixed in 6.2.1.9-1.gita65a472.el9_6.3 - Upgrade
Upgrade
redhat/python3-iscsi-initiator-utilsto a version that resolves this vulnerability.Fixed in 6.2.1.9-1.gita65a472.el9_6.3 - Upgrade
Upgrade
redhat/python3-iscsi-initiator-utils-debuginfoto a version that resolves this vulnerability.Fixed in 6.2.1.9-1.gita65a472.el9_6.3 - Upgrade
Upgrade
redhat/iscsi-initiator-utilsto a version that resolves this vulnerability.Fixed in 6.2.1.9-1.gita65a472.el9_6.3.aa - Upgrade
Upgrade
redhat/iscsi-initiator-utils-debuginfoto a version that resolves this vulnerability.Fixed in 6.2.1.9-1.gita65a472.el9_6.3.aa - Upgrade
Upgrade
redhat/iscsi-initiator-utils-debugsourceto a version that resolves this vulnerability.Fixed in 6.2.1.9-1.gita65a472.el9_6.3.aa - Upgrade
Upgrade
redhat/iscsi-initiator-utils-iscsiuioto a version that resolves this vulnerability.Fixed in 6.2.1.9-1.gita65a472.el9_6.3.aa - Upgrade
Upgrade
redhat/iscsi-initiator-utils-iscsiuio-debuginfoto a version that resolves this vulnerability.Fixed in 6.2.1.9-1.gita65a472.el9_6.3.aa - Upgrade
Upgrade
redhat/python3-iscsi-initiator-utilsto a version that resolves this vulnerability.Fixed in 6.2.1.9-1.gita65a472.el9_6.3.aa - Upgrade
Upgrade
redhat/python3-iscsi-initiator-utils-debuginfoto a version that resolves this vulnerability.Fixed in 6.2.1.9-1.gita65a472.el9_6.3.aa - Upgrade
Upgrade
open-iscsito a version that resolves this vulnerability.Fixed in rhel-9.6.zPatch JIRA:RHEL-191896 - Upgrade
Upgrade
iscsi-initiator-utilsto a version that resolves this vulnerability.Fixed in rhel-9.6.zPatch JIRA:RHEL-191896
Event History
Frequently Asked Questions
Which security issues are addressed by this update?
The update addresses CVE-2026-44944, an authentication bypass in the iscsiuio control socket, and CVE-2026-44943, a privilege-escalation issue involving path traversal.
What components are included in the affected package set?
The advisory covers iscsi-initiator-utils and related packages, including iscsiuio, Python utilities, debuginfo, and debugsource packages. It is listed for Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle.
Does this update include non-security changes?
Yes. It corrects iscsiadm reporting node.discovery_type as "fw" when it should be "static" for the referenced RHEL 9.6.z issue.