RHSA-2026:98539: Important: ignition security update
Ignition is a utility used to manipulate systems during the initramfs. This includes partitioning disks, formatting partitions, writing files (regular files, systemd units, etc.), and configuring users. On first boot, Ignition reads its configuration from a source of truth (remote URL, network metadata service, hypervisor bridge, etc.) and applies the configuration.Security Fix(es): crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates (CVE-2026-111943) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/ignitionto a version that resolves this vulnerability.Fixed in 2.26.0-2.el9_9.1 - Upgrade
Upgrade
redhat/ignition-debuginfoto a version that resolves this vulnerability.Fixed in 2.26.0-2.el9_9.1 - Upgrade
Upgrade
redhat/ignition-debugsourceto a version that resolves this vulnerability.Fixed in 2.26.0-2.el9_9.1 - Upgrade
Upgrade
redhat/ignition-edgeto a version that resolves this vulnerability.Fixed in 2.26.0-2.el9_9.1 - Upgrade
Upgrade
redhat/ignition-grubto a version that resolves this vulnerability.Fixed in 2.26.0-2.el9_9.1 - Upgrade
Upgrade
redhat/ignition-validateto a version that resolves this vulnerability.Fixed in 2.26.0-2.el9_9.1 - Upgrade
Upgrade
redhat/ignition-validate-debuginfoto a version that resolves this vulnerability.Fixed in 2.26.0-2.el9_9.1 - Upgrade
Upgrade
redhat/ignitionto a version that resolves this vulnerability.Fixed in 2.26.0-2.el9_9.1.aa - Upgrade
Upgrade
redhat/ignition-debuginfoto a version that resolves this vulnerability.Fixed in 2.26.0-2.el9_9.1.aa - Upgrade
Upgrade
redhat/ignition-debugsourceto a version that resolves this vulnerability.Fixed in 2.26.0-2.el9_9.1.aa - Upgrade
Upgrade
redhat/ignition-edgeto a version that resolves this vulnerability.Fixed in 2.26.0-2.el9_9.1.aa - Upgrade
Upgrade
redhat/ignition-grubto a version that resolves this vulnerability.Fixed in 2.26.0-2.el9_9.1.aa - Upgrade
Upgrade
redhat/ignition-validateto a version that resolves this vulnerability.Fixed in 2.26.0-2.el9_9.1.aa - Upgrade
Upgrade
redhat/ignition-validate-debuginfoto a version that resolves this vulnerability.Fixed in 2.26.0-2.el9_9.1.aa
Event History
Frequently Asked Questions
Which systems are most exposed to this issue?
Systems that use Ignition to retrieve first-boot configuration from a remote URL, network metadata service, hypervisor bridge, or another external source are the relevant exposure cases. Ignition uses that configuration to perform initramfs-stage actions such as disk partitioning, file writes, and user configuration.
What would an attacker need to exploit this vulnerability?
The issue is described as a man-in-the-middle attack involving untrusted intermediate certificates in crypto/x509. Exploitation therefore involves intercepting or influencing certificate validation for a connection used to obtain configuration, though the advisory does not provide further prerequisites.
How can I determine whether a system needs the update?
Identify systems with any of the listed Red Hat Ignition packages installed, including ignition, ignition-edge, ignition-grub, or ignition-validate. Systems that use Ignition during first boot and obtain configuration from an external source should be prioritized.