CVE-2026-18379

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-18379", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "PUBLISHED", "assignerShortName": "redhat", "dateReserved": "2026-07-30T11:14:12.635Z", "datePublished": "2026-11-12T18:49:34.253Z", "dateUpdated": "2026-11-12T23:25:09.829Z"}, "containers": {"cna": {"title": "Yggdrasil-worker-package-manager: yggdrasil-worker-package-manager: path traversal via unsanitized repo name in addrepo/removerepo", "metrics": [{"other": {"content": {"value": "Moderate", "namespace": "https://access.redhat.com/security/updates/classification/"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS"}], "descriptions": [{"lang": "en", "value": "A flaw was found in yggdrasil-worker-package-manager. An authenticated attacker can exploit this issue to achieve arbitrary file modification or potential privilege escalation. The vulnerability exists because repository management operations fail to sanitize directory traversal sequences (such as '../') within repository names. By supplying a crafted repository name, an attacker can manipulate the root-level worker process into creating or deleting files outside the intended directory, compromising host system integrity."}], "affected": [{"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "yggdrasil-worker-package-manager", "defaultStatus": "affected", "versions": [{"version": "0:0.2.3-7.el10_2.9", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/o:redhat:enterprise_linux:10.2"]}], "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:96082", "name": "RHSA-2026:96082", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/security/cve/CVE-2026-18379", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2546571", "name": "RHBZ#2546571", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "datePublic": "2026-11-06T00:00:00.000Z", "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "description": "Improper Limitation of a Pathname to a Restricted Directory", "lang": "en", "type": "CWE"}]}], "x_redhatCweChain": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory", "workarounds": [{"lang": "en", "value": "--- CME Mitigation Guidance (2026-11-06) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to sanitize repository names and enforce directory boundary validation to prevent traversal sequences from escaping /etc/yum.repos.d/ during file creation and deletion: upgrade to the fixed Yggdrasil Worker Package Manager builds, which apply the documented input check, closing crafted repository names containing directory traversal sequences. Until patched, this is a concern on Linux hosts running yggdrasil-worker-package-manager as root, so Restrict and audit authenticated access to dispatch directives through the management message broker to prevent malformed repository names from reaching the root worker. As a compensating measure, Configure auditd to log file creation, modification, and deletion syscalls initiated by the root worker across monitored system paths, Run SELinux in enforcing mode to confine the worker daemon and prevent writing or deleting files outside repository configuration file types, Deploy an EDR agent to monitor endpoint behavior and detect unauthorized file drops or suspicious cron and system modifications, Use Falco or eBPF runtime security to detect anomalous file write or unlink operations executed by the worker outside /etc/yum.repos.d/, and Deploy AIDE or file integrity monitoring to detect unauthorized modifications or deletions of critical system configuration files. These controls limit blast radius and contain exploitation, but they do not fix the underlying path-traversal defect \u2014 apply the upstream patch to fully remediate.\n\nHighest-impact CME: CME-1301 Path Traversal Prevention (Canonicalization) (high)"}], "timeline": [{"lang": "en", "time": "2026-10-06T11:23:16.902Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-11-06T00:00:00.000Z", "value": "Made public."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-11-12T23:25:09.829Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}}}

{}

{"affected": [{"affectedData": [{"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:10.2"], "defaultStatus": "affected", "packageName": "yggdrasil-worker-package-manager", "product": "Red Hat Enterprise Linux 10", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:0.2.3-7.el10_2.9", "versionType": "rpm"}]}], "source": "secalert@redhat.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A flaw was found in yggdrasil-worker-package-manager. An authenticated attacker can exploit this issue to achieve arbitrary file modification or potential privilege escalation. The vulnerability exists because repository management operations fail to sanitize directory traversal sequences (such as '../') within repository names. By supplying a crafted repository name, an attacker can manipulate the root-level worker process into creating or deleting files outside the intended directory, compromising host system integrity."}], "id": "CVE-2026-18379", "lastModified": "2026-11-13T00:20:14.900", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "secalert@redhat.com", "type": "Secondary"}]}, "published": "2026-11-12T19:17:04.040", "references": [{"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:96082"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/security/cve/CVE-2026-18379"}, {"source": "secalert@redhat.com", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2546571"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "secalert@redhat.com", "type": "Secondary"}]}

{"affected_release": [{"advisory": "RHSA-2026:96082", "cpe": "cpe:/o:redhat:enterprise_linux:10.2", "package": "yggdrasil-worker-package-manager-0:0.2.3-7.el10_2.9", "product_name": "Red Hat Enterprise Linux 10", "release_date": "2026-11-09T00:00:00Z"}], "bugzilla": {"description": "yggdrasil-worker-package-manager: yggdrasil-worker-package-manager: path traversal via unsanitized repo name in AddRepo/RemoveRepo", "id": "2546571", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2546571"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.8", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "verified"}, "cwe": "CWE-22", "details": ["A flaw was found in yggdrasil-worker-package-manager. An authenticated attacker can exploit this issue to achieve arbitrary file modification or potential privilege escalation. The vulnerability exists because repository management operations fail to sanitize directory traversal sequences (such as '../') within repository names. By supplying a crafted repository name, an attacker can manipulate the root-level worker process into creating or deleting files outside the intended directory, compromising host system integrity."], "mitigation": {"lang": "en:us", "value": "--- CME Mitigation Guidance (2026-11-06) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\nThe highest-value action is to sanitize repository names and enforce directory boundary validation to prevent traversal sequences from escaping /etc/yum.repos.d/ during file creation and deletion: upgrade to the fixed Yggdrasil Worker Package Manager builds, which apply the documented input check, closing crafted repository names containing directory traversal sequences. Until patched, this is a concern on Linux hosts running yggdrasil-worker-package-manager as root, so Restrict and audit authenticated access to dispatch directives through the management message broker to prevent malformed repository names from reaching the root worker. As a compensating measure, Configure auditd to log file creation, modification, and deletion syscalls initiated by the root worker across monitored system paths, Run SELinux in enforcing mode to confine the worker daemon and prevent writing or deleting files outside repository configuration file types, Deploy an EDR agent to monitor endpoint behavior and detect unauthorized file drops or suspicious cron and system modifications, Use Falco or eBPF runtime security to detect anomalous file write or unlink operations executed by the worker outside /etc/yum.repos.d/, and Deploy AIDE or file integrity monitoring to detect unauthorized modifications or deletions of critical system configuration files. These controls limit blast radius and contain exploitation, but they do not fix the underlying path-traversal defect \u2014 apply the upstream patch to fully remediate.\nHighest-impact CME: CME-1301 Path Traversal Prevention (Canonicalization) (high)"}, "name": "CVE-2026-18379", "public_date": "2026-11-06T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-18379\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-18379"], "statement": "Red Hat rates this vulnerability as Moderate impact because successful exploitation relies on dispatching malformed directives through the message broker, which requires prior access to the management control plane. Although the package manager worker executes with root privileges and could permit unauthorized file modifications or deletions outside the designated repository directory, it cannot be invoked directly by unauthenticated remote actors. In standard deployments, risk is constrained to systems connected to a compromised or untrusted broker infrastructure.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0:0.2.3-7.el10_2.9,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Red Hat Enterprise Linux 10", "source": "cna", "vendor": "Red Hat"}, "product": "enterprise_linux", "vendor": "red_hat"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0:0.2.3-7.el10_2.9,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Red Hat Enterprise Linux 10", "source": "cna", "vendor": "Red Hat"}, "product": "enterprise_linux", "vendor": "redhat"}], "created": "2026-11-13T06:00:08.632337+00:00", "updated": "2026-11-13T06:00:08.632391+00:00", "vendors": ["red_hat", "red_hat$PRODUCT$enterprise_linux", "redhat", "redhat$PRODUCT$enterprise_linux"]}