CVE-2026-96581
Description
A flaw was found in ash. In multitenant configurations, record creation actions configured to update existing entries (upsert) do not properly verify that conflicting records belong to the requesting tenant. An authenticated user can exploit this vulnerability by submitting a record identifier from another tenant during an upsert operation. This allows the attacker to bypass authorization controls, inspect sensitive information, overwrite data, and reassign ownership of records belonging to other tenants.
Statement
This vulnerability is rated as an Important severity flaw because an authenticated tenant can cross isolation boundaries to read, alter, or claim ownership of records belonging to other tenants, compromising both confidentiality and data integrity. The issue only manifests in multitenant application deployments utilizing upsert actions on primary keys or global identities. Red Hat Enterprise Linux and other supported Red Hat software do not package or deploy the Ash framework, so default Red Hat environments are not exposed to this risk.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
