CVE-2026-3184

Published: Apr 3, 2026Modified: Jul 21, 2026

5.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Exploitability: 3.9 / Impact: 1.4

Source: NVD

Description

A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.

Affected (2)

Products: Kernel: Util Linux · Redhat: Hardened Images

1 product

1 product

Hardened Images

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Kernel Util Linux	All versions
Redhat Hardened Images	All versions

Related CWEs

Authentication Bypass by Alternate Name

The product performs authentication based on the name of a resource being accessed, or the name of the actor performing the access, but it does not properly check all possible names for that resource or actor.

References (3)

https://access.redhat.com/errata/RHSA-2026:7180

Source: secalert@redhat.com

Third Party Advisory

https://access.redhat.com/security/cve/CVE-2026-3184

Source: secalert@redhat.com

Third Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=2442570

Source: secalert@redhat.com

Issue TrackingThird Party Advisory

Timeline

No history available yet.