RLSA-2026:91720: Important: ignition security update
Ignition is a utility used to manipulate systems during the initramfs. This includes partitioning disks, formatting partitions, writing files (regular files, systemd units, etc.), and configuring users. On first boot, Ignition reads its configuration from a source of truth (remote URL, network metadata service, hypervisor bridge, etc.) and applies the configuration.
Security Fix(es):
crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates (CVE-2026-111943)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rocky-linux/ignitionto a version that resolves this vulnerability.Fixed in 0:2.26.0-3.el10_2.4
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The CVSS vector indicates network access is required, attack complexity is high, no attacker privileges are required, and user interaction is required. The advisory identifies the issue as a man-in-the-middle weakness involving untrusted intermediate certificates.
What is the potential impact if exploitation succeeds?
The listed CVSS vector rates confidentiality and integrity impact as high. Availability impact is listed as none.
Are default Ignition configurations known to be affected?
The advisory does not identify any specific default configuration, affected configuration source, or affected software version. Ignition can obtain first-boot configuration from sources such as remote URLs, network metadata services, and hypervisor bridges, but the advisory does not state which of these are confirmed affected.