{"id":"CVE-2026-4878","title":"A flaw was found in libcap","summary":"A flaw was found in libcap. A local unprivileged user can exploit a Time-of-check-to-time-of-use (TOCTOU) race condition in the `cap_set_file()` function. This allows an attacker with write access to a parent directory to redirect file c…","severity":"medium","cvss":6.7,"cvssVector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","cwe":["CWE-367"],"vendor":"libcap_project","product":"libcap","affected":["libcap","openshift_container_platform = 4.0","enterprise_linux = 8.0","enterprise_linux = 9.0","enterprise_linux = 10.0"],"patched":["openshift_container_platform 4.12","openshift_container_platform 4.13","openshift_container_platform 4.14","openshift_container_platform 4.15","openshift_container_platform 4.16","openshift_container_platform 4.17","openshift_container_platform 4.18","openshift_container_platform 4.19","enterprise_linux_appstream_eus_v_10_0","enterprise_linux_appstream_v_10","enterprise_linux_appstream_e4s_v_9_2","enterprise_linux_appstream_eus_v_9_4","enterprise_linux_appstream_eus_v_9_6","enterprise_linux_appstream_v_9","enterprise_linux_baseos_eus_v_10_0","enterprise_linux_baseos_v_10","enterprise_linux_baseos_v_8","enterprise_linux_baseos_aus_v_8_6","enterprise_linux_baseos_eus_extension_v_8_6","enterprise_linux_baseos_e4s_v_8_8","enterprise_linux_baseos_tus_v_8_8","enterprise_linux_baseos_e4s_v_9_2","enterprise_linux_baseos_eus_v_9_4","enterprise_linux_baseos_eus_v_9_6","enterprise_linux_baseos_v_9","cost_management 4","ai_inference_server 3.2","ai_inference_server 3.3","discovery 2","hardened_images","insights_proxy 1.5","openshift_distributed_tracing 3.9.3","update_infrastructure 5"],"published":"2026-04-09","updated":"2026-09-09","sourceUpdated":"2026-09-09T13:20:24.613","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-4878","references":[{"url":"https://access.redhat.com/errata/RHSA-2026:12423","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:12441","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:13285","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:14162","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:14937","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:19130","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:19346","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:19456","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:19458","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:20595","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:21254","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:21275","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:22634","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:22957","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:23233","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:23245","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:24346","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:25044","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:25096","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:25181","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:26542","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:27998","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:28887","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:29197","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:30078","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:30087","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:30088","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:30089","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:34098","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:39981","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:58981","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:59831","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:7473","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/security/cve/CVE-2026-4878","label":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2447554","label":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2451615","label":"secalert@redhat.com"},{"url":"http://www.openwall.com/lists/oss-security/2026/04/07/14","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.openwall.com/lists/oss-security/2026/04/07/4","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.openwall.com/lists/oss-security/2026/04/08/9","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.openwall.com/lists/oss-security/2026/04/09/5","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.openwall.com/lists/oss-security/2026/04/09/6","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2026:12423","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:12441","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:13285","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:14162","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:14937","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:19130","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:19346","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:19456","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:19458","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:20595","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:21254","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:21275","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:22634","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:22957","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:23233","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:23245","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:24346","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:25044","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:25096","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:25181","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:26542","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:27998","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:28887","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:29197","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:30078","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:30087","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:30088","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:30089","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:34098","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:39981","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:58981","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:59831","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:7473","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/security/cve/CVE-2026-4878","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2451615","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4878.json","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-4878"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-4878"}],"tags":["nvd","cve.org","csaf","vex","red-hat"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-04-09T00:00:00+00:00"},"epss":0.00201,"epssPercentile":0.10335,"ingestedAt":"2026-06-26T16:43:13.626Z","slug":"CVE-2026-4878","body":"## Overview\n\nA flaw was found in libcap. A local unprivileged user can exploit a Time-of-check-to-time-of-use (TOCTOU) race condition in the `cap_set_file()` function. This allows an attacker with write access to a parent directory to redirect file capability updates to an attacker-controlled file. By doing so, capabilities can be injected into or stripped from unintended executables, leading to privilege escalation.\n\n## Affected\n\n- `libcap`\n- `openshift_container_platform = 4.0`\n- `enterprise_linux = 8.0`\n- `enterprise_linux = 9.0`\n- `enterprise_linux = 10.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **RHSA-2026:59831** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.12 · released 2026-09-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:59831)\n- **RHSA-2026:26542** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.13 · released 2026-06-25 · [advisory](https://access.redhat.com/errata/RHSA-2026:26542)\n- **RHSA-2026:28887** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.14 · released 2026-07-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:28887)\n- **RHSA-2026:23233** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.15 · released 2026-06-11 · [advisory](https://access.redhat.com/errata/RHSA-2026:23233)\n- **RHSA-2026:25044** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.16 · released 2026-06-18 · [advisory](https://access.redhat.com/errata/RHSA-2026:25044)\n- **RHSA-2026:34098** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.17 · released 2026-07-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:34098)\n- **RHSA-2026:25181** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.18 · released 2026-06-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:25181)\n- **RHSA-2026:23245** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.19 · released 2026-06-10 · [advisory](https://access.redhat.com/errata/RHSA-2026:23245)\n- **RHSA-2026:19456** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux BaseOS EUS (v. 10.0) · released 2026-05-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:19456)\n- **RHSA-2026:12423** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10) · released 2026-04-30 · [advisory](https://access.redhat.com/errata/RHSA-2026:12423)\n- **RHSA-2026:19130** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10) · released 2026-05-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:19130)\n- **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat OpenShift Container Platform 4 · updated 2026-09-08 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4878.json)","depth":"sunlit","depthScore":37,"depthScoreParts":{"impact":36.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}