CVE-2026-19278

The record

A flaw was found in StackRox/RHACS Central's Auth Machine-to-Machine (M2M) token exchange. When an administrator configures M2M role mappings, the system uses unanchored regular expressions for matching claim values. This allows an attacker with a valid OpenID Connect (OIDC) token, whose claim value is a superstring of a configured pattern, to gain unauthorized access to roles they were not intended to receive. This can lead to privilege escalation within the system.

Affected packages

Related vulnerabilities

• CVE-2026-79965 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions… CWE-625
• CVE-2026-83617 xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and… CWE-625
• CVE-2026-83618 xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and… CWE-625
• CVE-2026-83609 xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and… CWE-625
• CVE-2026-82726 Permissive Regular Expression vulnerability in ash-project ash_phoenix lets a remote… CWE-625
• CVE-2026-55536 PraisonAI is a multi-agent teams system. CWE-625
• CVE-2026-64940 Tegalog -Fumy Otegaru Memo Logger- provided by Nishishi Factory contains a vulnerability… CWE-625
• CVE-2026-37737 sanic-cors version 2.2.0 and prior contains an improper regular expression in the… CWE-625