CVE-2026-19278: StackRox/RHACS Privilege Escalation Flaw

CVE-2026-19278 Overview

A privilege escalation flaw exists in StackRox/RHACS Central's Auth Machine-to-Machine (M2M) token exchange. The system uses unanchored regular expressions when matching OpenID Connect (OIDC) claim values against configured role mapping patterns. An attacker holding a valid OIDC token with a claim value that is a superstring of a configured pattern can obtain roles beyond their authorization scope. The weakness is classified under [CWE-625: Permissive Regular Expression].

Critical Impact

Attackers with a low-privilege but valid OIDC token can escalate privileges within StackRox/RHACS Central by exploiting unanchored regex matching in M2M role mappings.

Affected Products

• Red Hat Advanced Cluster Security for Kubernetes (RHACS)
• StackRox Central
• Deployments using Auth M2M token exchange with OIDC role mappings

Discovery Timeline

• 2026-08-10 - CVE-2026-19278 published to NVD
• 2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-19278

Vulnerability Analysis

StackRox/RHACS Central supports Machine-to-Machine (M2M) authentication by exchanging external OIDC tokens for internal API tokens. Administrators configure role mappings that assign roles based on values found in OIDC claims. The mapping engine compares claim values to configured patterns using regular expressions.

The flaw arises because the regex patterns are not anchored with ^ and $. As a result, any claim value that contains the configured pattern as a substring matches. An attacker whose token contains a claim value that extends a legitimate pattern receives roles intended only for the shorter, exact value.

Exploitation requires a valid OIDC token issued by a configured identity provider, so the attacker must already have some authenticated presence in the environment.

Root Cause

The root cause is permissive regular expression handling in the M2M role-mapping logic. Because patterns are evaluated without anchor metacharacters, the regex engine performs partial matching rather than full-string matching. Any claim value whose substring satisfies the pattern is accepted as a match, defeating the intended one-to-one binding between claim values and roles.

Attack Vector

An attacker obtains an OIDC token from the trusted identity provider with a claim value crafted to be a superstring of a legitimate mapping value. For example, if the administrator configures a mapping for the group dev-team, an attacker whose group claim contains dev-team-admin or x-dev-team also matches. The attacker then presents this token to Central's M2M token exchange endpoint and receives an API token bearing the elevated role.

No synthetic exploit code is provided. Refer to the Red Hat CVE Advisory for CVE-2026-19278 and Red Hat Bug Report #2512524 for authoritative technical details.

Detection Methods for CVE-2026-19278

Indicators of Compromise

• M2M token exchange requests where the resulting API token carries roles that do not match the exact claim value expected for the presenting identity.
• OIDC tokens presented to Central containing claim values that are longer variants of documented role-mapping patterns.
• Unexpected role assignments in Central audit logs following successful /v1/auth/m2m/exchange calls.

Detection Strategies

• Review Central audit logs for M2M token exchanges and correlate the OIDC subject and claim values against granted roles.
• Enumerate all configured M2M role mappings and test each pattern for anchor characters; flag any pattern missing ^ or $.
• Compare recently granted roles against the identity provider's directory to identify identities receiving roles outside their group membership.

Monitoring Recommendations

• Enable verbose audit logging on Central and forward events to a centralized log store for retention and search.
• Alert on any newly assigned high-privilege role (for example, Admin or Continuous Integration) issued through the M2M exchange path.
• Track and baseline the identity providers and client IDs that legitimately use M2M exchange, then alert on deviations.

How to Mitigate CVE-2026-19278

Immediate Actions Required

• Audit every M2M role mapping in Central and rewrite patterns to be fully anchored, for example ^dev-team$ instead of dev-team.
• Temporarily disable M2M token exchange configurations that grant high-privilege roles until patches are applied and mappings are reviewed.
• Rotate any API tokens issued through the M2M path since the vulnerability was introduced.

Patch Information

Red Hat has published advisory details for this issue. Consult the Red Hat CVE Advisory for CVE-2026-19278 for fixed versions of Red Hat Advanced Cluster Security for Kubernetes and apply the vendor-supplied updates to Central. Track remediation state through Red Hat Bug Report #2512524.

Workarounds

• Anchor all regex patterns in M2M role mappings with ^ and $ to enforce full-string matching.
• Restrict M2M configurations to identity providers and audiences under direct administrative control.
• Apply the principle of least privilege to role mappings so that any successful exploitation yields minimal additional access.

# Configuration example: anchor role-mapping patterns to prevent superstring matches
# Before (vulnerable): partial match allows dev-team-admin to satisfy dev-team
#   value: "dev-team"
# After (safe): full-string match
#   value: "^dev-team$"

# Example roxctl audit of existing mappings
roxctl central auth m2m list -o json \
  | jq '.configs[].mappings[] | select(.value | test("^\\^.*\\$$") | not)'