gvproxy Auth Bypass Flaw Deletes Host Files on RHEL 10, Podman Desktop and Edge Manager

The National Vulnerability Database has recorded a critical path traversal vulnerability in gvproxy, a component of the gvisor-tap-vsock package. This flaw allows unauthenticated attackers to delete arbitrary files on the host system by exploiting insufficient input validation.

What happened

Researchers identified a path traversal weakness, classified as CWE-22, within gvproxy, which serves as the network forwarder for the gvisor-tap-vsock package. According to the NVD record, the vulnerability stems from the /services/forwarder/expose endpoint, which fails to validate the socket path supplied by the caller.

Because this endpoint does not require authentication, an attacker can send a request with a crafted path to trigger the deletion of any file on the host system that the process has permission to access. The issue is tracked as CVE-2026-107935 and has been assigned a CVSS score of 9.3, placing it in the critical severity range. The flaw affects the integrity of the host environment by enabling unauthorized file removal, which can disrupt services or compromise system stability.

Why it matters

This vulnerability impacts several Red Hat products, including Red Hat Enterprise Linux 10, Red Hat Build of Podman Desktop, Red Hat Edge Manager 1, and the Red Hat Certification Program for Red Hat Enterprise Linux 9. Organizations using these platforms for containerized workloads or edge computing are directly exposed. The unauthenticated nature of the endpoint lowers the barrier for exploitation, meaning attackers do not need credentials to initiate the attack.

For business leaders, this represents a significant operational risk, as the deletion of critical system files can lead to service outages or data loss. The high CVSS score reflects the severity of the impact, which includes complete loss of integrity on the host system. Security teams must assess their exposure across all deployments of the affected Red Hat software versions.

What to watch

• Monitor for unusual file deletion activity on hosts running gvproxy.
• Check if the /services/forwarder/expose endpoint is accessible from untrusted networks.
• Review access logs for unauthorized requests to the forwarder service.
• Verify if your organization uses any of the listed Red Hat affected products.

Background: CVSS score

CVSS provides a standardized vector for exploit difficulty and access requirements, not business value. A high score indicates an easy attack path, not necessarily significant damage. You must contextualize the score with your environment’s exposure, asset value, and compensating controls to determine true risk.

Read the full guide: CVSS Scores: Why High Numbers Mislead Your Risk Assessment

What to do and how to stay safe: gvproxy

• Audit network configurations to ensure the gvproxy forwarder endpoint is not exposed to untrusted networks.
• Implement network segmentation to restrict access to the /services/forwarder/expose endpoint to only necessary internal services.
• Monitor file system integrity on hosts running affected versions of Red Hat Enterprise Linux or Podman Desktop.
• Once the vendor provides an update, apply patches to mitigate the path traversal vulnerability.

General security guidance from the Firewall Chronicle newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-107935?

It is a critical path traversal vulnerability in gvproxy that allows unauthenticated attackers to delete arbitrary host files.

Which Red Hat products are affected?

Affected products include RHEL 10, Podman Desktop, Edge Manager 1, and the RHEL 9 Certification Program.

Is authentication required to exploit this bug?

No, the vulnerable endpoint is unauthenticated, allowing anyone with network access to exploit it.