CVE-2026-120399 Vulnerability Allows Unauthenticated Blocking of New Connections (CVSS 7.5)

This article reflects information as of November 11, 2026, 00:37 JST. The information may have been updated since then; check the official source for the latest.

Conclusion: Vulnerability Disclosed in flightctl Allowing Unauthenticated Denial of New Connections

Red Hat has disclosed CVE-2026-120399 in flightctl. During HTTP server connection handling, TLS handshakes are executed synchronously without a timeout; therefore, an unauthenticated client reachable via the network can stall the handshake, preventing affected listeners from accepting new connections. (Sources: Red Hat CVE-2026-120399 , NVD Record (JSON) )

The CVSS v3.1 base score is 7.5 (Severity: High). The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, with the impact limited solely to availability (service continuity).

Details: Due to the lack of a timeout for TLS handshakes, unauthenticated clients can stop the acceptance of new connections. The weakness type is CWE-1322 (Use of Blocking Code in Single-Threaded, Non-blocking Processing).

Exploitation conditions: The attacker must be able to reach the agent endpoint over the network. Even after exploitation, existing established connections are reportedly not affected.

Affected products: In the NVD record, the following four packages of Red Hat Edge Manager 1 are listed as affected:

Affected products: In the NVD record, the following four packages of Red Hat Edge Manager 1 are listed as affected:

rhem/flightctl-api-rhel10

rhem/flightctl-api-rhel10

rhem/flightctl-api-rhel9

rhem/flightctl-remote-access-rhel10

rhem/flightctl-remote-access-rhel9

The publication date and time of the NVD record is 2026-11-10T14:17 (UTC), and its status is "Awaiting Analysis."

How to Check If You Are Affected

Check whether you are using the flightctl-api or flightctl-remote-access container packages in Red Hat Edge Manager 1.

Check who can reach the agent endpoint over the network (whether access is restricted to internal devices or open externally). Exploitation reportedly requires network reachability to this endpoint.

The symptom of the stoppage is that "new connections can no longer be accepted." Existing connections are reportedly not affected.

Workarounds and Recovery (Red Hat Documentation)

Recovery: Service can reportedly be restored by restarting the server and blocking the malicious device at the network level.

Temporary workaround: A method is cited of periodically inspecting the receive queue (Recv-Q) of the listening socket (listener) and terminating idle connections that have received almost no data whenever the queue is not empty.

What Is Not Known in This Article

Fixed version numbers and release timing: The body of Red Hat's CVE page does not specify the version numbers of fixes or their release timing.

CVSS status: Red Hat's page states that these CVSS metrics and score are provisional and subject to review. The NVD evaluation is currently "Awaiting Analysis."

Whether there are real-world exploitation cases is not stated in the body of Red Hat's CVE page.

The scope of impact by version for upstream flightctl (open-source side) is not specified in the records reviewed for this article.