Homepage

OS Command Injection The advisory has been revoked - it doesn't affect any version of package rhcos  (opens in a new tab)

Threat Intelligence

EPSS
0.37% (32nd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RHEL9-RHCOS-18593662
  • published8 Aug 2026
  • disclosed5 Aug 2026
Report a new vulnerability Found a mistake?

Introduced: 5 Aug 2026

CVE-2026-15816  (opens in a new tab)
CWE-78  (opens in a new tab)

Amendment

The Red Hat security team deemed this advisory irrelevant for RHEL:9.

NVD Description

Note: Versions mentioned in the description apply only to the upstream rhcos package and not the rhcos package as distributed by RHEL.

A flaw was found in dracut. The die() error-handling function writes its message into a shell script under the initramfs emergency-hook directory without properly shell-quoting it. When the message contains data derived from the DHCP ROOT_PATH option, an attacker on the adjacent network who controls a rogue DHCP server can inject a command-substitution sequence that executes as root the next time dracut sources its emergency hook scripts during standard boot-failure handling.

References