RHSA-2026:61679: Important: iscsi-initiator-utils security, bug fix, and enhancement update
Important: iscsi-initiator-utils security, bug fix, and enhancement update
Other sources
The iscsi-initiator-utils packages provide the server daemon for the Internet Small Computer System Interface (iSCSI) protocol, as well as the utility programs used to manage it. The iSCSI protocol is a protocol for distributed disk access using SCSI commands sent over Internet Protocol (IP) networks.Security Fix(es): open-iscsi: open-iscsi: Privilege Escalation via Path Traversal (CVE-2026-44943) Bug Fix(es) and Enhancement(s): [FJ10.1 Bug]: iscsiadm reports node.discoverytype as "fw", although it should be "static". [rhel-10.0.z] (JIRA:RHEL-191898) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/iscsi-initiator-utilsto a version that resolves this vulnerability.Fixed in 6.2.1.9-22.gita65a472.el10_0.1 - Upgrade
Upgrade
redhat/iscsi-initiator-utils-debuginfoto a version that resolves this vulnerability.Fixed in 6.2.1.9-22.gita65a472.el10_0.1 - Upgrade
Upgrade
redhat/iscsi-initiator-utils-debugsourceto a version that resolves this vulnerability.Fixed in 6.2.1.9-22.gita65a472.el10_0.1 - Upgrade
Upgrade
redhat/iscsi-initiator-utils-iscsiuioto a version that resolves this vulnerability.Fixed in 6.2.1.9-22.gita65a472.el10_0.1 - Upgrade
Upgrade
redhat/iscsi-initiator-utils-iscsiuio-debuginfoto a version that resolves this vulnerability.Fixed in 6.2.1.9-22.gita65a472.el10_0.1 - Upgrade
Upgrade
redhat/python3-iscsi-initiator-utilsto a version that resolves this vulnerability.Fixed in 6.2.1.9-22.gita65a472.el10_0.1 - Upgrade
Upgrade
redhat/python3-iscsi-initiator-utils-debuginfoto a version that resolves this vulnerability.Fixed in 6.2.1.9-22.gita65a472.el10_0.1 - Upgrade
Upgrade
redhat/iscsi-initiator-utilsto a version that resolves this vulnerability.Fixed in 6.2.1.9-22.gita65a472.el10_0.1.aa - Upgrade
Upgrade
redhat/iscsi-initiator-utils-debuginfoto a version that resolves this vulnerability.Fixed in 6.2.1.9-22.gita65a472.el10_0.1.aa - Upgrade
Upgrade
redhat/iscsi-initiator-utils-debugsourceto a version that resolves this vulnerability.Fixed in 6.2.1.9-22.gita65a472.el10_0.1.aa - Upgrade
Upgrade
redhat/iscsi-initiator-utils-iscsiuioto a version that resolves this vulnerability.Fixed in 6.2.1.9-22.gita65a472.el10_0.1.aa - Upgrade
Upgrade
redhat/iscsi-initiator-utils-iscsiuio-debuginfoto a version that resolves this vulnerability.Fixed in 6.2.1.9-22.gita65a472.el10_0.1.aa - Upgrade
Upgrade
redhat/python3-iscsi-initiator-utilsto a version that resolves this vulnerability.Fixed in 6.2.1.9-22.gita65a472.el10_0.1.aa - Upgrade
Upgrade
redhat/python3-iscsi-initiator-utils-debuginfoto a version that resolves this vulnerability.Fixed in 6.2.1.9-22.gita65a472.el10_0.1.aa - Upgrade
Upgrade
open-iscsi/iscsi-initiator-utils (open-iscsi package)to a version that resolves this vulnerability.Patch CVE-2026-44943 - Upgrade
Upgrade
iscsi-initiator-utils (Red Hat Enterprise Linux 10.0.z)to a version that resolves this vulnerability.Fixed in rhel-10.0.zPatch JIRA:RHEL-191898
Event History
Frequently Asked Questions
Which components are covered by this update?
The update covers iscsi-initiator-utils and related packages, including iscsiuio, Python 3 bindings, debuginfo packages, and debugsource packages. It is listed for Red Hat Enterprise Linux for x86_64 with Extended Update Support.
What type of security issue is addressed?
The update addresses CVE-2026-44943, described as a privilege-escalation issue in open-iscsi caused by path traversal. The associated CWE classification is Path Traversal.
Are there non-security changes in this advisory?
Yes. It corrects iscsiadm reporting node.discovery_type as "fw" when it should report "static".