CVE-2026-92615 Overview
A race condition in the flightctl device-render worker allows one tenant's Transport Layer Security (TLS) configuration to leak into another tenant's Git operations. The configureRepoHTTPSClient() function builds a per-repository tls.Config and installs it into go-git's process-global client.Protocols map through gitclient.InstallProtocol("https", ...). Because the worker renders devices for multiple organizations concurrently from a shared goroutine pool, the last-written repository configuration wins for all in-flight git.Clone calls. This can cause InsecureSkipVerify flags, custom Certificate Authority (CA) bundles, or tenant-supplied mutual TLS (mTLS) client credentials to cross tenant boundaries. The flaw is tracked as [CWE-413: Improper Resource Locking].
Critical Impact
Tenant TLS credentials, including mTLS client certificates and certificate validation settings, can leak between organizations sharing the same flightctl worker pool.
Affected Products
- Red Hat flightctl (device management service)
- Deployments using the flightctl device-render worker with multi-tenant repositories
- Environments relying on go-git's HTTPS protocol handler through configureRepoHTTPSClient()
Discovery Timeline
- 2026-09-16 - CVE CVE-2026-92615 published to the National Vulnerability Database (NVD)
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-92615
Vulnerability Analysis
The flightctl device-render worker processes Git-backed device configurations for multiple organizations from a shared goroutine pool. For each repository, configureRepoHTTPSClient() constructs a tls.Config that may contain InsecureSkipVerify, a custom CA bundle, or tenant-supplied mTLS client certificates. The function then registers that configuration into go-git's process-global client.Protocols map by calling gitclient.InstallProtocol("https", ...).
Because client.Protocols is a package-level singleton in go-git, every concurrent git.Clone invocation reads from the same handler. The worker performs no locking or per-request isolation before or after each clone. When two tenants render simultaneously, the goroutine that writes last silently overrides the HTTPS transport used by all in-flight clones.
The result is cross-tenant configuration bleed. A tenant whose repository allows insecure TLS can force another tenant's clone to skip certificate validation. A tenant with mTLS credentials can send those credentials to a different tenant's Git endpoint.
Root Cause
The root cause is improper resource locking on a shared, mutable global state. The go-git protocol registry is a process-wide map, but flightctl treats it as request-local. There is no mutex, no snapshot per goroutine, and no scoped HTTP transport passed to git.Clone.
Attack Vector
Exploitation requires an authenticated tenant with permission to define a repository configuration and timing that overlaps another tenant's render operation. The attacker submits a repository with attacker-controlled TLS parameters. When their configuration wins the race, a victim tenant's clone uses those parameters. The Common Vulnerabilities and Exposures (CVE) record scores the attack complexity as high and privileges required as high, reflecting the timing and access prerequisites.
The vulnerability enables downgrade of TLS verification for victim clones and unintended transmission of victim mTLS certificates to attacker-influenced endpoints. Refer to the Red Hat CVE-2026-92615 Advisory and Red Hat Bug Report #2518323 for vendor-specific technical details.
Detection Methods for CVE-2026-92615
Indicators of Compromise
- Unexpected Git clone connections from flightctl workers to tenant repository endpoints that do not match the tenant being rendered
- TLS handshake logs showing client certificates presented to hosts that were not configured for mTLS by the owning tenant
- Repository configurations that enable InsecureSkipVerify correlated in time with clone failures or certificate warnings for unrelated tenants
Detection Strategies
- Correlate flightctl worker logs against per-tenant repository allowlists to identify Git operations targeting cross-tenant endpoints
- Monitor for repeated InstallProtocol calls in worker traces occurring during overlapping render jobs
- Alert on TLS validation being disabled for repository fetches that historically enforced certificate pinning
Monitoring Recommendations
- Ingest flightctl worker logs, Git audit events, and outbound TLS metadata into a centralized analytics platform for cross-tenant correlation
- Baseline the set of Git hosts each tenant contacts and alert on deviations
- Track configuration changes to repository resources that toggle InsecureSkipVerify or introduce new client certificates
How to Mitigate CVE-2026-92615
Immediate Actions Required
- Apply the Red Hat security update for flightctl once available in the Red Hat CVE-2026-92615 Advisory
- Audit repository configurations for InsecureSkipVerify settings and remove them where possible
- Rotate any mTLS client certificates that may have been transmitted to unintended endpoints during concurrent render operations
Patch Information
Refer to the Red Hat CVE-2026-92615 Advisory for fixed package versions. The fix must eliminate reliance on go-git's process-global client.Protocols map by scoping HTTP transports per clone operation, for example by passing a per-call http.Client through go-git's transport.Client interface rather than mutating global state.
Workarounds
- Reduce the device-render worker concurrency to a single goroutine so that only one tenant's TLS configuration is active at a time
- Segregate flightctl worker pools by tenant or organization to eliminate shared global state across trust boundaries
- Disallow tenant-supplied InsecureSkipVerify and custom CA bundles until the patched version is deployed
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.