CVE WATCH / VULNERABILITY DETAIL
CVE-2026-125672
MEDIUMCVSS 6.6NVD feed
Published 10 November 2026 · tracked since 11 November 2026
Description
A flaw was found in cockpit-storaged. A Tang keyserver address read from a clevis token in a LUKS header is concatenated into curl's argument vector without a "--" separator. An address beginning with "-" is parsed by curl as an option instead of a hostname, allowing an attacker who can attach a cra
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog
Latest tracked vulnerabilities
- CVE-2026-124937
- CVE-2026-124911
- CVE-2026-125745 MEDIUM 4.3
- CVE-2026-12573 HIGH 8.8
- CVE-2026-12572 HIGH 7.2
- CVE-2026-125715 MEDIUM 5.3
- CVE-2026-125712 HIGH 7.5
- CVE-2026-125706 MEDIUM 5.5
- CVE-2026-120326
- CVE-2026-95646 HIGH 8