Critical Security Update for TFTP Package: CVE-2026-85234
Summary
RHSA-2026:82280: Red Hat Security Advisory: tftp security update. Affects tftp versions < 0:5.2-50.el10_2. Fixed in 0:5.2-50.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Trivial File Transfer Protocol (TFTP) is a simple protocol used to transfer files over a network. It is commonly utilized in environments where minimal overhead is required, such as booting diskless workstations or transferring firmware to network devices. The TFTP package in Red Hat Enterprise Linux 10.2 has been identified to have a security vulnerability that could potentially expose systems to risks.
Vulnerability Detail
CVE-2026-85234 is a vulnerability in the TFTP package that allows unauthorized access to sensitive files, potentially leading to data breaches or system compromise. The vulnerability arises from improper handling of certain requests, which could be exploited by an attacker to read files outside the intended directory. This could have severe ramifications, especially in environments where sensitive data is stored or transmitted.
How To Fix
Minimum fixed version
0:5.2-50.el10_2
This is the first release that contains the fix.
sudo dnf update tftpTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict access to the TFTP service by configuring firewall rules to limit which IP addresses can connect to the TFTP server. This can be done using the following command:
sudo firewall-cmd --add-rich-rule='rule family=ipv4 source address=<trusted_ip> accept' --permanent' followed by 'sudo firewall-cmd --reload
Replace <trusted_ip> with the IP address you wish to allow.
Conclusion
The TFTP package in Red Hat Enterprise Linux 10.2 has a critical vulnerability (CVE-2026-85234) that requires immediate attention. Updating to the patched version is essential to secure your systems against potential exploits. Implementing firewall rules can serve as a temporary measure while updates are applied.
See every vulnerability recorded for tftp →
FAQ
CVE-2026-85234 is a security vulnerability in the TFTP package that allows unauthorized access to files.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability.
The risks include unauthorized access to sensitive files, potential data breaches, and system compromise.
You can update the TFTP package by running 'sudo yum update tftp' in your terminal.
Yes, you can restrict access using firewall rules to limit connections to trusted IP addresses.
Related vulnerabilities
Recent vulnerabilities recorded for tftp.
