Flightctl TLS Config Race Leak: InsecureSkipVerify or mTLS Hijack
CVE-2026-92615 Published on September 16, 2026
Flightctl: flightctl: package-global go-git https transport mutated per-repo -- cross-tenant tls-config bleed
A flaw was found in flightctl. The configureRepoHTTPSClient() function in the device-render worker builds a per-repository tls.Config (which may include InsecureSkipVerify, a custom CA bundle, or tenant-supplied mTLS client certificates) and installs it into go-git's process-global client.Protocols map via gitclient.InstallProtocol("https", ...). Because the worker renders devices for multiple organizations concurrently from a shared goroutine pool, whichever tenant's repository configuration is written last wins for all in-flight git.Clone calls.
This race condition can cause one tenant's TLS settings, including InsecureSkipVerify or mTLS client credentials, to leak into another tenant's git operations.
Vulnerability Analysis
CVE-2026-92615 can be exploited with network access, and requires user privileges. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity, and no impact on availability.
Timeline
Reported to Red Hat.
Made public. 77 days later.
Weakness Type
Improper Resource Locking
The software does not lock or does not correctly lock a resource when the software must have exclusive access to the resource. When a resource is not properly locked, an attacker could modify the resource while it is being operated on by the software. This might violate the software's assumption that the resource will not change, potentially leading to unexpected behaviors.
Products Associated with CVE-2026-92615
stack.watch emails you whenever new vulnerabilities are published in Red Hat Acm or Red Hat Edge Manager. Just hit a watch button to start following.
