An operating-system command injection flaw exists in NooBaa’s cluster_internal_api.set_hostname_internal. The hostname value provided by an attacker is passed directly to a shell command without sanitization (CWE-78), allowing an authenticated user with administrative privileges to inject shell metacharacters and execute arbitrary commands on the host system with the privileges of the NooBaa process. This results in full host-level compromise of confidentiality, integrity, and availability.

The vulnerability affects Red Hat Openshift Data Foundation 4, specifically the NooBaa core component that manages the Multi‑Cloud Object Gateway. No specific version numbers are listed in the CNA data, so all installed instances of the default 4.x release are considered potentially affected.

The CVSS score of 7.2 indicates high severity, but the EPSS score of 2% and the fact that the vulnerability is not listed in the CISA KEV catalog moderate the overall risk. The attack requires local administrative authentication, which limits the attack surface, yet once authenticated the attacker can obtain host‑level control and compromise the entire system. No official workaround exists.