CVE-2026-86330: NooBaa OS Command Injection RCE Vulnerability

CVE-2026-86330 Overview

CVE-2026-86330 is an OS command injection vulnerability in the set_hostname_internal function of NooBaa's cluster_internal_api. NooBaa provides the Multi-Cloud Object Gateway in Red Hat OpenShift Data Foundation. The flaw stems from passing the hostname parameter directly to a shell command without sanitization [CWE-78]. An authenticated attacker with administrative privileges can supply a crafted hostname containing shell metacharacters to execute arbitrary commands on the host with the privileges of the NooBaa process.

Critical Impact

Authenticated administrators can achieve arbitrary command execution on the NooBaa host, compromising confidentiality, integrity, and availability of the Multi-Cloud Object Gateway and underlying workloads.

Affected Products

• Red Hat OpenShift Data Foundation (Multi-Cloud Object Gateway)
• NooBaa cluster_internal_api component
• Deployments exposing the set_hostname_internal administrative function

Discovery Timeline

• 2026-09-28 - CVE-2026-86330 published to NVD
• 2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-86330

Vulnerability Analysis

The vulnerability resides in the set_hostname_internal function within NooBaa's cluster_internal_api. This administrative function accepts a hostname string from an authenticated caller and uses it to construct a shell command that configures the host identity of the cluster node.

Because the input is concatenated into a shell invocation without quoting or metacharacter filtering, operators such as ;, |, &&, backticks, and $() are interpreted by the shell. An attacker with cluster administrator privileges can therefore break out of the hostname context and run arbitrary commands.

Successful exploitation yields code execution in the security context of the NooBaa process, which typically runs with privileged access to object storage configuration, cloud provider credentials, and inter-node communication within OpenShift Data Foundation.

Root Cause

The root cause is improper neutralization of special elements used in an OS command [CWE-78]. The set_hostname_internal implementation trusts the hostname parameter and interpolates it into a shell command string rather than using a parameterized API, an exec-style call with argument arrays, or strict allow-list validation of hostname characters.

Attack Vector

Exploitation requires network access to the NooBaa management interface and authenticated administrative credentials. An attacker invokes the hostname-setting operation and supplies a value such as validhost; <command> or $(command) to append arbitrary shell commands. The commands execute on the NooBaa host as the NooBaa service account, enabling credential theft, lateral movement to other OpenShift Data Foundation components, and tampering with object storage data paths.

See the Red Hat CVE-2026-86330 Advisory and Red Hat Bug Report #2529295 for vendor technical details.

Detection Methods for CVE-2026-86330

Indicators of Compromise

• Unexpected child processes spawned by the NooBaa core process, especially shells such as /bin/sh, /bin/bash, or utilities like curl, wget, nc, or python.
• Audit entries for calls to set_hostname_internal where the hostname field contains shell metacharacters (;, |, &, `, $().
• Outbound network connections from NooBaa pods to unknown destinations shortly after administrative hostname changes.

Detection Strategies

• Instrument the Kubernetes audit log and NooBaa API logs to flag cluster_internal_api requests whose parameters contain non-RFC 1123 hostname characters.
• Deploy runtime workload monitoring on OpenShift nodes to alert on process-tree anomalies originating from the NooBaa container.
• Correlate administrator authentication events with subsequent process execution inside NooBaa pods to spot abuse of legitimate credentials.

Monitoring Recommendations

• Baseline the expected process tree of the NooBaa container and alert on any deviation.
• Forward NooBaa, Kubernetes API server, and node auditd logs into a centralized analytics platform for correlation.
• Monitor egress traffic from NooBaa pods and alert on connections outside the documented object storage endpoints.

How to Mitigate CVE-2026-86330

Immediate Actions Required

• Apply the NooBaa and OpenShift Data Foundation updates referenced in the Red Hat CVE-2026-86330 Advisory as soon as they are available for your channel.
• Rotate any credentials, cloud provider keys, and tokens accessible to the NooBaa service account if exploitation is suspected.
• Restrict access to NooBaa administrative APIs to a minimal set of trusted operators and dedicated jump hosts.

Patch Information

Red Hat tracks remediation guidance under Red Hat Bug Report #2529295 and the corresponding Red Hat CVE-2026-86330 Advisory. Consult the advisory for fixed component versions, errata identifiers, and upgrade paths for OpenShift Data Foundation.

Workarounds

• Limit NooBaa administrator role bindings to a small, audited group until the patch is deployed.
• Place the NooBaa management endpoint behind network policies that only allow traffic from authorized operator workstations or bastion hosts.
• Monitor and alert on any invocation of set_hostname_internal, treating hostname changes as high-risk administrative actions pending patching.

# Example NetworkPolicy restricting access to NooBaa management endpoints
# Replace selectors and CIDRs with values appropriate for your environment.
kubectl apply -f - <<EOF
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: noobaa-mgmt-restrict
  namespace: openshift-storage
spec:
  podSelector:
    matchLabels:
      app: noobaa
  policyTypes:
    - Ingress
  ingress:
    - from:
        - ipBlock:
            cidr: 10.0.0.0/24
      ports:
        - protocol: TCP
          port: 8443
EOF