Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-4878

CVE-2026-4878HIGH

Red Hat Red Hat Enterprise Linux 10 — Libcap: libcap: privilege escalation via toctou race condition in cap_set_file()

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   L   H   L   N  U  H  H  H    7.0   .0014    2.9     —

AFFECTED
  Product                                                                Versions     Fixed
  Red Hat Enterprise Linux 10                                            unspecified  0:2.69-7.el10_1.1
  Red Hat Enterprise Linux 10                                            unspecified  0:2.69-7.el10_2.1
  Red Hat Enterprise Linux 10.0 Extended Update Support                  unspecified  0:2.69-7.el10_0.1
  Red Hat Enterprise Linux 8                                             unspecified  0:2.48-6.el8_10.1
  Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support  unspecified  0:2.48-4.el8_6.1
  Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On  unspecified  0:2.48-4.el8_6.1
  Red Hat Enterprise Linux 8.8 Telecommunications Update Service         unspecified  0:2.48-5.el8_8.1
  Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions         unspecified  0:2.48-5.el8_8.1
  Red Hat Enterprise Linux 9                                             unspecified  0:2.48-10.el9_7.1
  Red Hat Enterprise Linux 9                                             unspecified  0:2.48-10.el9_8.1
  + 44 more

TIMELINE
  Mar 26  Reserved by redhat
  Apr 9   Published (CNA: redhat)
  Aug 17  EXPLOIT PUBLISHED — CVE-2026-4878 (Red Hat Enterprise Linux 10). Public exploit reference added.
  Aug 17  RESCORED — CVE-2026-4878 (Red Hat Enterprise Linux 10). CVSS 6.7 → 7 (NVD).
  Aug 24  EXPLOIT PUBLISHED — CVE-2026-4878 (Red Hat Enterprise Linux 10). Public exploit reference added.
  Aug 25  EXPLOIT PUBLISHED — CVE-2026-4878 (Red Hat Enterprise Linux 10). Public exploit reference added.
  Aug 31  EXPLOIT PUBLISHED — CVE-2026-4878 (Red Hat Enterprise Linux 10). Public exploit reference added.
  Sep 3   EXPLOIT PUBLISHED — CVE-2026-4878 (Red Hat Enterprise Linux 10). Public exploit reference added.
  Sep 4   EXPLOIT PUBLISHED — CVE-2026-4878 (Red Hat Enterprise Linux 10). Public exploit reference added.
  Sep 6   EXPLOIT PUBLISHED — CVE-2026-4878 (Red Hat Enterprise Linux 10). Public exploit reference added.
  Sep 7   EXPLOIT PUBLISHED — CVE-2026-4878 (Red Hat Enterprise Linux 10). Public exploit reference added.
  Sep 8   EXPLOIT PUBLISHED — CVE-2026-4878 (Red Hat Enterprise Linux 10). Public exploit reference added.
  Sep 9   EXPLOIT PUBLISHED — CVE-2026-4878 (Red Hat Enterprise Linux 10). Public exploit reference added.
  Sep 29  EXPLOIT PUBLISHED — CVE-2026-4878 (Red Hat Enterprise Linux 10). Public exploit reference added.
  Oct 2   EXPLOIT PUBLISHED — CVE-2026-4878 (Red Hat Enterprise Linux 10). Public exploit reference added.

CWE-367 · CNA: redhat · CVSS v3.1 · 44 references · NVD status: Modified

Description

A flaw was found in libcap. A local unprivileged user can exploit a Time-of-check-to-time-of-use (TOCTOU) race condition in the `cap_set_file()` function. This allows an attacker with write access to a parent directory to redirect file capability updates to an attacker-controlled file. By doing so, capabilities can be injected into or stripped from unintended executables, leading to privilege escalation.

Lifecycle

Complete event history — 15 events, chronological
Date	Event	Detail
March 26, 2026	Reserved	Reserved by redhat
April 9, 2026	Published	Published (CNA: redhat)
August 17, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2026-4878 (Red Hat Enterprise Linux 10). Public exploit reference added.
August 17, 2026	RESCORED	RESCORED — CVE-2026-4878 (Red Hat Enterprise Linux 10). CVSS 6.7 → 7 (NVD).
August 24, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2026-4878 (Red Hat Enterprise Linux 10). Public exploit reference added.
August 25, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2026-4878 (Red Hat Enterprise Linux 10). Public exploit reference added.
August 31, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2026-4878 (Red Hat Enterprise Linux 10). Public exploit reference added.
September 3, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2026-4878 (Red Hat Enterprise Linux 10). Public exploit reference added.
September 4, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2026-4878 (Red Hat Enterprise Linux 10). Public exploit reference added.
September 6, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2026-4878 (Red Hat Enterprise Linux 10). Public exploit reference added.
September 7, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2026-4878 (Red Hat Enterprise Linux 10). Public exploit reference added.
September 8, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2026-4878 (Red Hat Enterprise Linux 10). Public exploit reference added.
September 9, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2026-4878 (Red Hat Enterprise Linux 10). Public exploit reference added.
September 29, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2026-4878 (Red Hat Enterprise Linux 10). Public exploit reference added.
October 2, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2026-4878 (Red Hat Enterprise Linux 10). Public exploit reference added.

Affected

Affected products and packages — 54 rows
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
Red Hat	Red Hat Enterprise Linux 10	—	—	0:2.69-7.el10_1.1
Red Hat	Red Hat Enterprise Linux 10	—	—	0:2.69-7.el10_2.1
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	—	—	0:2.69-7.el10_0.1
Red Hat	Red Hat Enterprise Linux 8	—	—	0:2.48-6.el8_10.1
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	—	—	0:2.48-4.el8_6.1
Red Hat	Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On	—	—	0:2.48-4.el8_6.1
Red Hat	Red Hat Enterprise Linux 8.8 Telecommunications Update Service	—	—	0:2.48-5.el8_8.1
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	—	—	0:2.48-5.el8_8.1
Red Hat	Red Hat Enterprise Linux 9	—	—	0:2.48-10.el9_7.1
Red Hat	Red Hat Enterprise Linux 9	—	—	0:2.48-10.el9_8.1
Red Hat	Red Hat Enterprise Linux 9	—	—	0:2.48-10.el9_7.1
Red Hat	Red Hat Enterprise Linux 9	—	—	0:2.48-10.el9_8.1
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	—	—	0:2.48-9.el9_2.1
Red Hat	Red Hat Enterprise Linux 9.4 Extended Update Support	—	—	0:2.48-9.el9_4.1
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	—	—	0:2.48-9.el9_6.1
Red Hat	Red Hat OpenShift Container Platform 4.12	—	—	412.86.202608241157-0
Red Hat	Red Hat OpenShift Container Platform 4.13	—	—	413.92.202606160406-0
Red Hat	Red Hat OpenShift Container Platform 4.14	—	—	414.92.202606231112-0
Red Hat	Red Hat OpenShift Container Platform 4.15	—	—	415.92.202606030318-0
Red Hat	Red Hat OpenShift Container Platform 4.16	—	—	416.94.202606051757-0
Red Hat	Red Hat OpenShift Container Platform 4.17	—	—	417.94.202606250942-0
Red Hat	Red Hat OpenShift Container Platform 4.18	—	—	418.94.202606051320-0
Red Hat	Red Hat OpenShift Container Platform 4.19	—	—	4.19.9.6.202606031700-0
Red Hat	Cert Manager support for Red Hat OpenShift release 1.20	—	—	1790598593
Red Hat	Cost Management 4	—	—	1780946239
Red Hat	Cost Management 4	—	—	1783539156
Red Hat	Red Hat AI Inference Server 3.2	—	—	1780681984
Red Hat	Red Hat AI Inference Server 3.3	—	—	1782352950
Red Hat	Red Hat AI Inference Server 3.3	—	—	1782352919
Red Hat	Red Hat AI Inference Server 3.3	—	—	1782353093
Red Hat	Red Hat AI Inference Server 3.3	—	—	1782352847
Red Hat	Red Hat Discovery 2	—	—	1778101579
Red Hat	Red Hat Discovery 2	—	—	1778156756
Red Hat	Red Hat Discovery 2	—	—	1782159791
Red Hat	Red Hat Discovery 2	—	—	1782166952
Red Hat	Red Hat Hardened Images	—	—	2.78-1.1.hum1
Red Hat	Red Hat Insights proxy 1.5	—	—	1780420428
Red Hat	Red Hat OpenShift AI 3.4	—	—	1790703542
Red Hat	Red Hat OpenShift distributed tracing 3.9.3	—	—	1778056267
Red Hat	Red Hat OpenShift distributed tracing 3.9.3	—	—	1778056233
Red Hat	Red Hat OpenShift distributed tracing 3.9.3	—	—	1778056245
Red Hat	Red Hat Update Infrastructure 5	—	—	1779798159
Red Hat	Red Hat Update Infrastructure 5	—	—	1779798164
Red Hat	Red Hat Update Infrastructure 5	—	—	1779798165
Red Hat	Red Hat Update Infrastructure 5	—	—	1779798222
Red Hat	Red Hat Update Infrastructure 5	—	—	1787241211
Red Hat	Red Hat Update Infrastructure 5	—	—	1787135742
Red Hat	Red Hat Update Infrastructure 5	—	—	1787241260
Red Hat	Red Hat Enterprise Linux 6	—	—	—
Red Hat	Red Hat Enterprise Linux 6	—	—	—
Red Hat	Red Hat Enterprise Linux 7	—	—	—
Red Hat	Red Hat Enterprise Linux 7	—	—	—
Red Hat	Red Hat OpenShift Container Platform 4	—	—	—
Red Hat	Red Hat OpenShift Container Platform 4	—	—	—

Weaknesses

CWE-367

References (44)

Authoritative record: CVE-2026-4878 at cve.org

Vendors: red hat

Weaknesses: CWE-367

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-4878 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.