CVE-2026-76595

{}

{}

{}

{"bugzilla": {"description": "advisor-backend: Unsafe YAML deserialization of associate-editable Task playbook (yaml.Loader)", "id": "2519653", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2519653"}, "csaw": false, "cwe": "CWE-502", "details": ["A flaw was found in advisor-backend. Multiple code paths within the application deserialize YAML (YAML Ain't Markup Language) with an unsafe full Loader, which can instantiate arbitrary Python objects via YAML tags. An unauthenticated remote attacker can exploit this by submitting specially crafted YAML input, leading to remote code execution (RCE) within the `advisor-backend` pod. This compromise could allow access to shared database credentials and impact all tenants."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-76595", "public_date": "2026-09-02T13:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-76595\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-76595"], "statement": "This Critical vulnerability in Red Hat Insights advisor-backend enables unauthenticated remote code execution. An attacker can exploit an unsafe YAML deserialization flaw, chained with an unauthenticated content import path, to execute arbitrary code within the multi-tenant advisor-backend pod. This allows for compromise of shared database credentials and tenant data, justifying the Critical impact due to the unauthenticated RCE.", "threat_severity": "Critical"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}]}, "product": "advisor-backend", "vendor": "advisor-backend"}], "created": "2026-09-03T13:45:04.962133+00:00", "updated": "2026-10-04T20:48:09.461968+00:00", "vendors": ["advisor-backend", "advisor-backend$PRODUCT$advisor-backend"]}