RLSA-2026:98539: Important: ignition security update
Ignition is a utility used to manipulate systems during the initramfs. This includes partitioning disks, formatting partitions, writing files (regular files, systemd units, etc.), and configuring users. On first boot, Ignition reads its configuration from a source of truth (remote URL, network metadata service, hypervisor bridge, etc.) and applies the configuration.
Security Fix(es):
crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates (CVE-2026-111943)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rocky-linux/ignitionto a version that resolves this vulnerability.Fixed in 0:2.26.0-2.el9_9.1 - Upgrade
Upgrade
rocky-linux/ignition-debuginfoto a version that resolves this vulnerability.Fixed in 0:2.26.0-2.el9_9.1 - Upgrade
Upgrade
rocky-linux/ignition-debugsourceto a version that resolves this vulnerability.Fixed in 0:2.26.0-2.el9_9.1 - Upgrade
Upgrade
rocky-linux/ignition-edgeto a version that resolves this vulnerability.Fixed in 0:2.26.0-2.el9_9.1 - Upgrade
Upgrade
rocky-linux/ignition-grubto a version that resolves this vulnerability.Fixed in 0:2.26.0-2.el9_9.1 - Upgrade
Upgrade
rocky-linux/ignition-validateto a version that resolves this vulnerability.Fixed in 0:2.26.0-2.el9_9.1 - Upgrade
Upgrade
rocky-linux/ignition-validate-debuginfoto a version that resolves this vulnerability.Fixed in 0:2.26.0-2.el9_9.1
Event History
Frequently Asked Questions
What must an attacker be able to do to exploit this issue?
An attacker would need to perform a man-in-the-middle attack against certificate validation involving an untrusted intermediate certificate. Exploitation also requires user interaction, according to the CVSS vector.
Which systems are most exposed?
Systems using Ignition to retrieve first-boot configuration from a remote URL, network metadata service, or hypervisor bridge are the relevant exposure points. Ignition can partition disks, write files and systemd units, and configure users, so compromise of its retrieved configuration can have high confidentiality and integrity impact.
Are availability impacts indicated?
No availability impact is indicated in the supplied CVSS vector. The stated impacts are high confidentiality and high integrity.