CVE-2026-19278

Name of the Vulnerable Software and Affected Versions StackRox/RHACS Central (affected versions not specified)

Description A flaw exists in the Auth Machine-to-Machine (M2M) token exchange. The system employs unanchored regular expressions when matching claim values during the configuration of M2M role mappings. An attacker possessing a valid OpenID Connect (OIDC) token—where the claim value is a superstring of a configured pattern—can obtain unauthorized access to roles, resulting in privilege escalation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.