CVE-2026-54552
Description
A flaw was found in sh, a Python library for process launching. When sh runs from an elevated process and launches a command with the _uid option set to an unprivileged user, the child process may retain the parent process's supplementary groups. This incomplete privilege drop can allow the child process to retain access to files or resources granted to privileged groups, leading to unauthorized access and potential privilege escalation.
Statement
A flaw of IMPORTANT severity was found in the sh Python library for process launching, which is bundled in the OpenShift Virtualization ocp-virt-validation-checkup-rhel9 container image (cnv-4.22 update stream). The _uid option in sh performs an incomplete privilege drop on Linux and Unix-like systems: when sh runs from an elevated process and launches a command with _uid set to an unprivileged user, the child process changes its UID but can retain the parent process's supplementary groups, because the privilege-drop sequence does not fully establish the target user's UID, primary GID, and supplementary groups. As a result, the child process can retain access to files and resources granted to privileged groups such as root, docker, disk, shadow, or sudo, violating the expected _uid privilege boundary and allowing unauthorized access and potential privilege escalation. Exploitation requires local access to an already-elevated process that uses the _uid option (CVSS 7.9, CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N), which matches the upstream severity. Within Red Hat, only the OpenShift Virtualization component listed above is flagged as affected; its resolution is delegated to the OpenShift Virtualization team, whose assessment concluded that the vulnerable code is not in the execute path for that container. Other Red Hat offerings that bundle sh, the Insights host-inventory service and the subscription-central-automation container image, are not affected because the sh versions they ship are outside the affected range (vulnerable code not present).
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.9 | N/A | 7.9 |
| Attack Vector | Local | N/A | Local |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | High | N/A | High |
| User Interaction | None | N/A | None |
| Scope | Changed | N/A | Changed |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
cve.org: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
Understanding the Weakness (CWE)
Access Control
Technical Impact: Gain Privileges or Assume Identity
If privileges are not dropped, neither are access rights of the user. Often these rights can be prevented from being dropped.
Access Control,Non-Repudiation
Technical Impact: Gain Privileges or Assume Identity; Hide Activities
If privileges are not dropped, in some cases the system may record actions as the user which is being impersonated rather than the impersonator.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
