CVE-2026-35255: Oracle Cloud Native Environment CLI RCE

CVE-2026-35255 Overview

CVE-2026-35255 is a code injection vulnerability [CWE-94] in the Oracle Cloud Native Environment Command Line Interface (CLI), part of Oracle Open Source Projects. The flaw affects version 2.3.2 and allows an unauthenticated local attacker to execute arbitrary code by supplying a malicious environment variable. Exploitation requires user interaction but no prior authentication to the target system. Successful attacks compromise both the confidentiality and integrity of the affected component.

Critical Impact
Local attackers can execute arbitrary code in the context of the Oracle Cloud Native Environment CLI by influencing environment variables consumed during CLI execution.

Affected Products

Oracle Cloud Native Environment Command Line Interface 2.3.2
Oracle Open Source Projects component cloud_native_environment_command_line_interface
Deployments invoking the affected CLI binary on Linux hosts

Discovery Timeline

2026-05-06 - CVE-2026-35255 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-35255

Vulnerability Analysis

The vulnerability resides in how the Oracle Cloud Native Environment CLI processes one or more environment variables at runtime. An attacker who can influence the process environment, for example through a shared host, a manipulated shell profile, or a poisoned automation script, can inject content that the CLI later interprets as code or commands. This maps to CWE-94, Improper Control of Generation of Code (Code Injection).

Exploitation requires that a legitimate user invoke the CLI after the malicious environment variable has been set. Because the attacker operates locally with low privileges and the victim performs the invocation, the impact is bounded by the privileges of the user running the olcnectl CLI. In environments where administrators run the CLI with elevated rights to manage Kubernetes clusters, the resulting code execution can pivot into cluster control plane operations.

Root Cause

The CLI fails to validate or sanitize attacker-controlled environment variable values before using them in a context where they influence executed code. Trusting untrusted environment input for command construction or interpreter behavior enables arbitrary code execution within the CLI process.

Attack Vector

The attack vector is local and requires user interaction. An attacker with low-privileged access to the same host plants a crafted environment variable, then waits for an authorized operator to run the Oracle Cloud Native Environment CLI. When the CLI reads the poisoned variable, the injected payload executes with the operator's privileges. Refer to the Oracle CVE Security Alerts for additional vendor context.

Detection Methods for CVE-2026-35255

Indicators of Compromise

Unexpected child processes spawned by the olcnectl binary, especially shells, interpreters, or networking utilities.
Modifications to user shell profiles such as ~/.bashrc, ~/.profile, or /etc/environment preceding CLI invocations.
Environment variables containing shell metacharacters, command substitutions, or executable paths set in operator sessions.

Detection Strategies

Audit process execution telemetry for olcnectl parent-child relationships that deviate from normal Kubernetes management workflows.
Compare runtime environment snapshots of CLI invocations against a known-good baseline to identify injected variables.
Alert on writes to shell initialization files on hosts that run the Oracle Cloud Native Environment CLI.

Monitoring Recommendations

Forward shell history, audit daemon (auditd) execve events, and CLI invocation logs to a central analytics platform for correlation.
Track non-administrative users that modify environment files on management hosts.
Review automation pipelines and CI/CD jobs that export variables before calling olcnectl.

How to Mitigate CVE-2026-35255

Immediate Actions Required

Restrict access to hosts running the Oracle Cloud Native Environment CLI to trusted administrators only.
Inventory all systems with cloud_native_environment_command_line_interface version 2.3.2 installed and prioritize them for remediation.
Reset and validate shell initialization files and system-wide environment configurations on affected hosts.

Patch Information

Consult the Oracle CVE Security Alerts page for the current fixed version and apply the vendor-supplied update for the Oracle Cloud Native Environment Command Line Interface as soon as it is available in your change window.

Workarounds

Run the CLI only inside clean, ephemeral sessions where the environment is explicitly defined by the operator.
Prevent shared or low-privileged accounts from writing to environment configuration files used by CLI operators.
Invoke the CLI with env -i style sanitized environments in automation, passing only the variables required for the operation.

bash

# Configuration example: invoke olcnectl with a minimal, controlled environment
env -i PATH=/usr/local/bin:/usr/bin HOME="$HOME" \
    KUBECONFIG="$HOME/.kube/config" \
    olcnectl module instances --config-file ~/.olcne/myenv.yaml