Critical Security Update for Corosync: CVE-2026-81665 Vulnerability
Summary
RHSA-2026:69278: Red Hat Security Advisory: corosync security update. Affects corosync versions < 0:3.1.7-1.el8_8.2. Fixed in 0:3.1.7-1.el8_8.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Corosync is an open-source project that provides a cluster engine for high availability and distributed systems. It is widely used in various applications to ensure that services remain available even in the event of failures. The package includes features for messaging, membership management, and quorum calculations, making it essential for maintaining the integrity of clustered environments. However, a recently identified vulnerability poses significant risks to its security.
Vulnerability Detail
The vulnerability identified as CVE-2026-81665 affects the Corosync package, allowing unauthorized access to sensitive data and potential disruption of services. This issue arises from improper handling of certain requests, which could lead to information disclosure or denial of service. Attackers exploiting this vulnerability could gain access to critical system information, compromising the security and stability of the entire cluster.
How To Fix
Minimum fixed version
0:3.1.7-1.el8_8.2
This is the first release that contains the fix.
sudo dnf update corosyncTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can restrict access to the Corosync service by implementing firewall rules to limit connections to trusted IP addresses. This can help mitigate the risk of exploitation until the package is updated.
Conclusion
The CVE-2026-81665 vulnerability in the Corosync package poses significant risks to system security and stability. Users are strongly advised to update to the latest patched version to mitigate these risks. Implementing temporary workarounds can help protect systems until the update is applied.
See every vulnerability recorded for corosync →
FAQ
CVE-2026-81665 is a security vulnerability in the Corosync package that could allow unauthorized access to sensitive data.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, implement firewall rules to restrict access to the Corosync service as a temporary workaround.
Exploitation of this vulnerability could lead to unauthorized access to sensitive information and potential service disruptions.
The CVSS score for CVE-2026-81665 is 7.5, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for corosync.
