https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T14:08:10.769857+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-21153 EUVD-2026-21153 2026-10-03T14:08:10.908780+00:00 EUVD-2026-21153 https://cve.radiocsirt.org/vuln/fkie_cve-2021-3917 fkie_cve-2021-3917 2026-10-03T14:08:10.908821+00:00

A flaw was found in the coreos-installer, where it writes the Ignition config to the target system with world-readable access permissions. This flaw allows a local attacker to have read access to potentially sensitive data. The highest threat from this vulnerability is to confidentiality.

 https://cve.radiocsirt.org/vuln/ghsa-862g-9h5m-m3qv GHSA-862g-9h5m-m3qv — coreos-installer < 0.10.0 writes world-readable Ignition config to installed system 2026-10-03T14:08:10.908855+00:00

Affected: crates.io: coreos-installer

### Impact On systems installed with coreos-installer before 0.10.0, the user-provided Ignition config was written to `/boot/ignition/config.ign` with world-readable permissions, granting unprivileged users access to any secrets included in the config.

Default configurations of Fedora CoreOS and RHEL CoreOS do not include any unprivileged user accounts. In addition, instances launched from a cloud image, and systems provisioned with the `ignition.config.url` kernel argument, do not use the `config.ign` file and are unaffected.

### Patches coreos-installer 0.10.0 and later [writes](https://github.com/coreos/coreos-installer/pull/571) the Ignition config with restricted permissions.

### Workarounds

On Fedora CoreOS systems installed from version 34.20210711.3.0 (stable), 34.20210711.2.0 (testing), 34.20210711.1.1 (next) and later, the `/boot/ignition` directory and its contents are removed after provisioning is complete. All Fedora CoreOS systems that have updated to these versions or later have automatically removed the `/boot/ignition` directory and no action is required.

On other systems, `/boot/ignition/config.ign` can be removed manually, as it is not used after provisioning is complete:

``` sudo mount -o remount,rw /boot sudo rm -rf /boot/ignition ```

### References For more information, see https://github.com/coreos/fedora-coreos-tracker/issues/889.

### For more information If you have any questions or comments about this advisory, [open an issue in coreos-inst…

 https://cve.radiocsirt.org/vuln/gsd-2021-3917 gsd-2021-3917 2026-10-03T14:08:10.908899+00:00 gsd-2021-3917 https://cve.radiocsirt.org/vuln/rhsa-2021:3758 RHSA-2021:3758 — Red Hat Security Advisory: OpenShift Container Platform 4.9.0 packages and security update 2026-10-03T14:08:10.908913+00:00

coreos-installer: restrict access permissions on /boot/ignition{,/config.ign} jetty: requests to the ConcatServlet and WelcomeFilter are able to access protected resources within the WEB-INF directory golang: archive/zip: malformed archive may cause panic or memory exhaustion jetty: SessionListener can prevent a session from being invalidated breaking logout openvswitch: use-after-free in decode_NXAST_RAW_ENCAP during the decoding of a RAW_ENCAP action