Vulnerability Description
A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.
CVSS Score
LOW
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Kernel | Util-Linux | - |
| Redhat | Hardened Images | - |
Related Weaknesses (CWE)
References
- https://access.redhat.com/errata/RHSA-2026:7180Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-3184Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2442570Issue TrackingThird Party Advisory
FAQ
What is CVE-2026-3184?
CVE-2026-3184 is a vulnerability with a CVSS score of 3.7 (LOW). A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A r...
How severe is CVE-2026-3184?
CVE-2026-3184 has been rated LOW with a CVSS base score of 3.7/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-3184?
Check the references section above for vendor advisories and patch information. Affected products include: Kernel Util-Linux, Redhat Hardened Images.