Vulnerability-Lookup

RHSA-2026:96082

Vulnerability from csaf_redhat - Published: 2026-11-09 01:59 - Updated: 2026-11-12 23:25

Summary

Red Hat Security Advisory: yggdrasil-worker-package-manager security update

Severity

Moderate

Notes

Topic: An update for yggdrasil-worker-package-manager is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details: yggdrasil-worker-package-manager is a simple package manager yggd worker. It knows how to install and remove packages, add, remove, enable and disable repositories, and does rudimentary detection of the host it is running on to guess the package manager to use. It only installs packages that match one of the provided allow-pattern regular expressions. Security Fix(es): * yggdrasil-worker-package-manager: yggdrasil-worker-package-manager: path traversal via unsanitized repo name in AddRepo/RemoveRepo (CVE-2026-18379) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2026-18379

A flaw was found in yggdrasil-worker-package-manager. An authenticated attacker can exploit this issue to achieve arbitrary file modification or potential privilege escalation. The vulnerability exists because repository management operations fail to sanitize directory traversal sequences (such as '../') within repository names. By supplying a crafted repository name, an attacker can manipulate the root-level worker process into creating or deleting files outside the intended directory, compromising host system integrity.

8.8 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory

Affected products

Fixed 13 products

Product	Version	Remediation
Unresolved product id: AppStream-10.2.Z:yggdrasil-worker-package-manager-0:0.2.3-7.el10_2.9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:yggdrasil-worker-package-manager-0:0.2.3-7.el10_2.9.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:yggdrasil-worker-package-manager-0:0.2.3-7.el10_2.9.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:yggdrasil-worker-package-manager-0:0.2.3-7.el10_2.9.src	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:yggdrasil-worker-package-manager-0:0.2.3-7.el10_2.9.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:yggdrasil-worker-package-manager-debuginfo-0:0.2.3-7.el10_2.9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:yggdrasil-worker-package-manager-debuginfo-0:0.2.3-7.el10_2.9.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:yggdrasil-worker-package-manager-debuginfo-0:0.2.3-7.el10_2.9.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:yggdrasil-worker-package-manager-debuginfo-0:0.2.3-7.el10_2.9.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:yggdrasil-worker-package-manager-debugsource-0:0.2.3-7.el10_2.9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:yggdrasil-worker-package-manager-debugsource-0:0.2.3-7.el10_2.9.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:yggdrasil-worker-package-manager-debugsource-0:0.2.3-7.el10_2.9.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:yggdrasil-worker-package-manager-debugsource-0:0.2.3-7.el10_2.9.x86_64	—	Vendor Fix fix Workaround

Threats

Impact Moderate

References

8 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:96082	self
https://access.redhat.com/security/updates/classi…	external
https://bugzilla.redhat.com/show_bug.cgi?id=2546571	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2026-18379	self
https://bugzilla.redhat.com/show_bug.cgi?id=2546571	external
https://www.cve.org/CVERecord?id=CVE-2026-18379	external
https://nvd.nist.gov/vuln/detail/CVE-2026-18379	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for yggdrasil-worker-package-manager is now available for Red Hat Enterprise Linux 10.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "yggdrasil-worker-package-manager is a simple package manager yggd worker. It knows how to install and remove packages, add, remove, enable and disable repositories, and does rudimentary detection of the host it is running on to guess the package manager to use. It only installs packages that match one of the provided allow-pattern regular expressions.\n\nSecurity Fix(es):\n\n* yggdrasil-worker-package-manager: yggdrasil-worker-package-manager: path traversal via unsanitized repo name in AddRepo/RemoveRepo (CVE-2026-18379)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:96082",
        "url": "https://access.redhat.com/errata/RHSA-2026:96082"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "2546571",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2546571"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_96082.json"
      }
    ],
    "title": "Red Hat Security Advisory: yggdrasil-worker-package-manager security update",
    "tracking": {
      "current_release_date": "2026-11-12T23:25:05+00:00",
      "generator": {
        "date": "2026-11-12T23:25:05+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.6"
        }
      },
      "id": "RHSA-2026:96082",
      "initial_release_date": "2026-11-09T01:59:48+00:00",
      "revision_history": [
        {
          "date": "2026-11-09T01:59:48+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-11-09T01:59:48+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-11-12T23:25:05+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AppStream (v. 10)",
                "product": {
                  "name": "Red Hat Enterprise Linux AppStream (v. 10)",
                  "product_id": "AppStream-10.2.Z",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:10.2"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "yggdrasil-worker-package-manager-0:0.2.3-7.el10_2.9.src",
                "product": {
                  "name": "yggdrasil-worker-package-manager-0:0.2.3-7.el10_2.9.src",
                  "product_id": "yggdrasil-worker-package-manager-0:0.2.3-7.el10_2.9.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/yggdrasil-worker-package-manager@0.2.3-7.el10_2.9?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "yggdrasil-worker-package-manager-0:0.2.3-7.el10_2.9.aarch64",
                "product": {
                  "name": "yggdrasil-worker-package-manager-0:0.2.3-7.el10_2.9.aarch64",
                  "product_id": "yggdrasil-worker-package-manager-0:0.2.3-7.el10_2.9.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/yggdrasil-worker-package-manager@0.2.3-7.el10_2.9?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "yggdrasil-worker-package-manager-debugsource-0:0.2.3-7.el10_2.9.aarch64",
                "product": {
                  "name": "yggdrasil-worker-package-manager-debugsource-0:0.2.3-7.el10_2.9.aarch64",
                  "product_id": "yggdrasil-worker-package-manager-debugsource-0:0.2.3-7.el10_2.9.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/yggdrasil-worker-package-manager-debugsource@0.2.3-7.el10_2.9?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "yggdrasil-worker-package-manager-debuginfo-0:0.2.3-7.el10_2.9.aarch64",
                "product": {
                  "name": "yggdrasil-worker-package-manager-debuginfo-0:0.2.3-7.el10_2.9.aarch64",
                  "product_id": "yggdrasil-worker-package-manager-debuginfo-0:0.2.3-7.el10_2.9.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/yggdrasil-worker-package-manager-debuginfo@0.2.3-7.el10_2.9?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "yggdrasil-worker-package-manager-0:0.2.3-7.el10_2.9.ppc64le",
                "product": {
                  "name": "yggdrasil-worker-package-manager-0:0.2.3-7.el10_2.9.ppc64le",
                  "product_id": "yggdrasil-worker-package-manager-0:0.2.3-7.el10_2.9.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/yggdrasil-worker-package-manager@0.2.3-7.el10_2.9?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "yggdrasil-worker-package-manager-debugsource-0:0.2.3-7.el10_2.9.ppc64le",
                "product": {
                  "name": "yggdrasil-worker-package-manager-debugsource-0:0.2.3-7.el10_2.9.ppc64le",
                  "product_id": "yggdrasil-worker-package-manager-debugsource-0:0.2.3-7.el10_2.9.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/yggdrasil-worker-package-manager-debugsource@0.2.3-7.el10_2.9?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "yggdrasil-worker-package-manager-debuginfo-0:0.2.3-7.el10_2.9.ppc64le",
                "product": {
                  "name": "yggdrasil-worker-package-manager-debuginfo-0:0.2.3-7.el10_2.9.ppc64le",
                  "product_id": "yggdrasil-worker-package-manager-debuginfo-0:0.2.3-7.el10_2.9.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/yggdrasil-worker-package-manager-debuginfo@0.2.3-7.el10_2.9?arch=ppc64le"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "yggdrasil-worker-package-manager-0:0.2.3-7.el10_2.9.x86_64",
                "product": {
                  "name": "yggdrasil-worker-package-manager-0:0.2.3-7.el10_2.9.x86_64",
                  "product_id": "yggdrasil-worker-package-manager-0:0.2.3-7.el10_2.9.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/yggdrasil-worker-package-manager@0.2.3-7.el10_2.9?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "yggdrasil-worker-package-manager-debugsource-0:0.2.3-7.el10_2.9.x86_64",
                "product": {
                  "name": "yggdrasil-worker-package-manager-debugsource-0:0.2.3-7.el10_2.9.x86_64",
                  "product_id": "yggdrasil-worker-package-manager-debugsource-0:0.2.3-7.el10_2.9.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/yggdrasil-worker-package-manager-debugsource@0.2.3-7.el10_2.9?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "yggdrasil-worker-package-manager-debuginfo-0:0.2.3-7.el10_2.9.x86_64",
                "product": {
                  "name": "yggdrasil-worker-package-manager-debuginfo-0:0.2.3-7.el10_2.9.x86_64",
                  "product_id": "yggdrasil-worker-package-manager-debuginfo-0:0.2.3-7.el10_2.9.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/yggdrasil-worker-package-manager-debuginfo@0.2.3-7.el10_2.9?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "yggdrasil-worker-package-manager-0:0.2.3-7.el10_2.9.s390x",
                "product": {
                  "name": "yggdrasil-worker-package-manager-0:0.2.3-7.el10_2.9.s390x",
                  "product_id": "yggdrasil-worker-package-manager-0:0.2.3-7.el10_2.9.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/yggdrasil-worker-package-manager@0.2.3-7.el10_2.9?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "yggdrasil-worker-package-manager-debugsource-0:0.2.3-7.el10_2.9.s390x",
                "product": {
                  "name": "yggdrasil-worker-package-manager-debugsource-0:0.2.3-7.el10_2.9.s390x",
                  "product_id": "yggdrasil-worker-package-manager-debugsource-0:0.2.3-7.el10_2.9.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/yggdrasil-worker-package-manager-debugsource@0.2.3-7.el10_2.9?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "yggdrasil-worker-package-manager-debuginfo-0:0.2.3-7.el10_2.9.s390x",
                "product": {
                  "name": "yggdrasil-worker-package-manager-debuginfo-0:0.2.3-7.el10_2.9.s390x",
                  "product_id": "yggdrasil-worker-package-manager-debuginfo-0:0.2.3-7.el10_2.9.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/yggdrasil-worker-package-manager-debuginfo@0.2.3-7.el10_2.9?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "yggdrasil-worker-package-manager-0:0.2.3-7.el10_2.9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.2.Z:yggdrasil-worker-package-manager-0:0.2.3-7.el10_2.9.aarch64"
        },
        "product_reference": "yggdrasil-worker-package-manager-0:0.2.3-7.el10_2.9.aarch64",
        "relates_to_product_reference": "AppStream-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "yggdrasil-worker-package-manager-0:0.2.3-7.el10_2.9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.2.Z:yggdrasil-worker-package-manager-0:0.2.3-7.el10_2.9.ppc64le"
        },
        "product_reference": "yggdrasil-worker-package-manager-0:0.2.3-7.el10_2.9.ppc64le",
        "relates_to_product_reference": "AppStream-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "yggdrasil-worker-package-manager-0:0.2.3-7.el10_2.9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.2.Z:yggdrasil-worker-package-manager-0:0.2.3-7.el10_2.9.s390x"
        },
        "product_reference": "yggdrasil-worker-package-manager-0:0.2.3-7.el10_2.9.s390x",
        "relates_to_product_reference": "AppStream-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "yggdrasil-worker-package-manager-0:0.2.3-7.el10_2.9.src as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.2.Z:yggdrasil-worker-package-manager-0:0.2.3-7.el10_2.9.src"
        },
        "product_reference": "yggdrasil-worker-package-manager-0:0.2.3-7.el10_2.9.src",
        "relates_to_product_reference": "AppStream-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "yggdrasil-worker-package-manager-0:0.2.3-7.el10_2.9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.2.Z:yggdrasil-worker-package-manager-0:0.2.3-7.el10_2.9.x86_64"
        },
        "product_reference": "yggdrasil-worker-package-manager-0:0.2.3-7.el10_2.9.x86_64",
        "relates_to_product_reference": "AppStream-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "yggdrasil-worker-package-manager-debuginfo-0:0.2.3-7.el10_2.9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.2.Z:yggdrasil-worker-package-manager-debuginfo-0:0.2.3-7.el10_2.9.aarch64"
        },
        "product_reference": "yggdrasil-worker-package-manager-debuginfo-0:0.2.3-7.el10_2.9.aarch64",
        "relates_to_product_reference": "AppStream-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "yggdrasil-worker-package-manager-debuginfo-0:0.2.3-7.el10_2.9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.2.Z:yggdrasil-worker-package-manager-debuginfo-0:0.2.3-7.el10_2.9.ppc64le"
        },
        "product_reference": "yggdrasil-worker-package-manager-debuginfo-0:0.2.3-7.el10_2.9.ppc64le",
        "relates_to_product_reference": "AppStream-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "yggdrasil-worker-package-manager-debuginfo-0:0.2.3-7.el10_2.9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.2.Z:yggdrasil-worker-package-manager-debuginfo-0:0.2.3-7.el10_2.9.s390x"
        },
        "product_reference": "yggdrasil-worker-package-manager-debuginfo-0:0.2.3-7.el10_2.9.s390x",
        "relates_to_product_reference": "AppStream-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "yggdrasil-worker-package-manager-debuginfo-0:0.2.3-7.el10_2.9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.2.Z:yggdrasil-worker-package-manager-debuginfo-0:0.2.3-7.el10_2.9.x86_64"
        },
        "product_reference": "yggdrasil-worker-package-manager-debuginfo-0:0.2.3-7.el10_2.9.x86_64",
        "relates_to_product_reference": "AppStream-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "yggdrasil-worker-package-manager-debugsource-0:0.2.3-7.el10_2.9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.2.Z:yggdrasil-worker-package-manager-debugsource-0:0.2.3-7.el10_2.9.aarch64"
        },
        "product_reference": "yggdrasil-worker-package-manager-debugsource-0:0.2.3-7.el10_2.9.aarch64",
        "relates_to_product_reference": "AppStream-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "yggdrasil-worker-package-manager-debugsource-0:0.2.3-7.el10_2.9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.2.Z:yggdrasil-worker-package-manager-debugsource-0:0.2.3-7.el10_2.9.ppc64le"
        },
        "product_reference": "yggdrasil-worker-package-manager-debugsource-0:0.2.3-7.el10_2.9.ppc64le",
        "relates_to_product_reference": "AppStream-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "yggdrasil-worker-package-manager-debugsource-0:0.2.3-7.el10_2.9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.2.Z:yggdrasil-worker-package-manager-debugsource-0:0.2.3-7.el10_2.9.s390x"
        },
        "product_reference": "yggdrasil-worker-package-manager-debugsource-0:0.2.3-7.el10_2.9.s390x",
        "relates_to_product_reference": "AppStream-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "yggdrasil-worker-package-manager-debugsource-0:0.2.3-7.el10_2.9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.2.Z:yggdrasil-worker-package-manager-debugsource-0:0.2.3-7.el10_2.9.x86_64"
        },
        "product_reference": "yggdrasil-worker-package-manager-debugsource-0:0.2.3-7.el10_2.9.x86_64",
        "relates_to_product_reference": "AppStream-10.2.Z"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-18379",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory"
      },
      "discovery_date": "2026-10-06T11:23:16.902000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2546571"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in yggdrasil-worker-package-manager. An authenticated attacker can exploit this issue to achieve arbitrary file modification or potential privilege escalation. The vulnerability exists because repository management operations fail to sanitize directory traversal sequences (such as \u0027../\u0027) within repository names. By supplying a crafted repository name, an attacker can manipulate the root-level worker process into creating or deleting files outside the intended directory, compromising host system integrity.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "yggdrasil-worker-package-manager: yggdrasil-worker-package-manager: path traversal via unsanitized repo name in AddRepo/RemoveRepo",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat rates this vulnerability as Moderate impact because successful exploitation relies on dispatching malformed directives through the message broker, which requires prior access to the management control plane. Although the package manager worker executes with root privileges and could permit unauthorized file modifications or deletions outside the designated repository directory, it cannot be invoked directly by unauthenticated remote actors. In standard deployments, risk is constrained to systems connected to a compromised or untrusted broker infrastructure.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.2.Z:yggdrasil-worker-package-manager-0:0.2.3-7.el10_2.9.aarch64",
          "AppStream-10.2.Z:yggdrasil-worker-package-manager-0:0.2.3-7.el10_2.9.ppc64le",
          "AppStream-10.2.Z:yggdrasil-worker-package-manager-0:0.2.3-7.el10_2.9.s390x",
          "AppStream-10.2.Z:yggdrasil-worker-package-manager-0:0.2.3-7.el10_2.9.src",
          "AppStream-10.2.Z:yggdrasil-worker-package-manager-0:0.2.3-7.el10_2.9.x86_64",
          "AppStream-10.2.Z:yggdrasil-worker-package-manager-debuginfo-0:0.2.3-7.el10_2.9.aarch64",
          "AppStream-10.2.Z:yggdrasil-worker-package-manager-debuginfo-0:0.2.3-7.el10_2.9.ppc64le",
          "AppStream-10.2.Z:yggdrasil-worker-package-manager-debuginfo-0:0.2.3-7.el10_2.9.s390x",
          "AppStream-10.2.Z:yggdrasil-worker-package-manager-debuginfo-0:0.2.3-7.el10_2.9.x86_64",
          "AppStream-10.2.Z:yggdrasil-worker-package-manager-debugsource-0:0.2.3-7.el10_2.9.aarch64",
          "AppStream-10.2.Z:yggdrasil-worker-package-manager-debugsource-0:0.2.3-7.el10_2.9.ppc64le",
          "AppStream-10.2.Z:yggdrasil-worker-package-manager-debugsource-0:0.2.3-7.el10_2.9.s390x",
          "AppStream-10.2.Z:yggdrasil-worker-package-manager-debugsource-0:0.2.3-7.el10_2.9.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-18379"
        },
        {
          "category": "external",
          "summary": "RHBZ#2546571",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2546571"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-18379",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-18379"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-18379",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-18379"
        }
      ],
      "release_date": "2026-11-06T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-09T01:59:48+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.2.Z:yggdrasil-worker-package-manager-0:0.2.3-7.el10_2.9.aarch64",
            "AppStream-10.2.Z:yggdrasil-worker-package-manager-0:0.2.3-7.el10_2.9.ppc64le",
            "AppStream-10.2.Z:yggdrasil-worker-package-manager-0:0.2.3-7.el10_2.9.s390x",
            "AppStream-10.2.Z:yggdrasil-worker-package-manager-0:0.2.3-7.el10_2.9.src",
            "AppStream-10.2.Z:yggdrasil-worker-package-manager-0:0.2.3-7.el10_2.9.x86_64",
            "AppStream-10.2.Z:yggdrasil-worker-package-manager-debuginfo-0:0.2.3-7.el10_2.9.aarch64",
            "AppStream-10.2.Z:yggdrasil-worker-package-manager-debuginfo-0:0.2.3-7.el10_2.9.ppc64le",
            "AppStream-10.2.Z:yggdrasil-worker-package-manager-debuginfo-0:0.2.3-7.el10_2.9.s390x",
            "AppStream-10.2.Z:yggdrasil-worker-package-manager-debuginfo-0:0.2.3-7.el10_2.9.x86_64",
            "AppStream-10.2.Z:yggdrasil-worker-package-manager-debugsource-0:0.2.3-7.el10_2.9.aarch64",
            "AppStream-10.2.Z:yggdrasil-worker-package-manager-debugsource-0:0.2.3-7.el10_2.9.ppc64le",
            "AppStream-10.2.Z:yggdrasil-worker-package-manager-debugsource-0:0.2.3-7.el10_2.9.s390x",
            "AppStream-10.2.Z:yggdrasil-worker-package-manager-debugsource-0:0.2.3-7.el10_2.9.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:96082"
        },
        {
          "category": "workaround",
          "details": "--- CME Mitigation Guidance (2026-11-06) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to sanitize repository names and enforce directory boundary validation to prevent traversal sequences from escaping /etc/yum.repos.d/ during file creation and deletion: upgrade to the fixed Yggdrasil Worker Package Manager builds, which apply the documented input check, closing crafted repository names containing directory traversal sequences. Until patched, this is a concern on Linux hosts running yggdrasil-worker-package-manager as root, so Restrict and audit authenticated access to dispatch directives through the management message broker to prevent malformed repository names from reaching the root worker. As a compensating measure, Configure auditd to log file creation, modification, and deletion syscalls initiated by the root worker across monitored system paths, Run SELinux in enforcing mode to confine the worker daemon and prevent writing or deleting files outside repository configuration file types, Deploy an EDR agent to monitor endpoint behavior and detect unauthorized file drops or suspicious cron and system modifications, Use Falco or eBPF runtime security to detect anomalous file write or unlink operations executed by the worker outside /etc/yum.repos.d/, and Deploy AIDE or file integrity monitoring to detect unauthorized modifications or deletions of critical system configuration files. These controls limit blast radius and contain exploitation, but they do not fix the underlying path-traversal defect \u2014 apply the upstream patch to fully remediate.\n\nHighest-impact CME: CME-1301 Path Traversal Prevention (Canonicalization) (high)",
          "product_ids": [
            "AppStream-10.2.Z:yggdrasil-worker-package-manager-0:0.2.3-7.el10_2.9.aarch64",
            "AppStream-10.2.Z:yggdrasil-worker-package-manager-0:0.2.3-7.el10_2.9.ppc64le",
            "AppStream-10.2.Z:yggdrasil-worker-package-manager-0:0.2.3-7.el10_2.9.s390x",
            "AppStream-10.2.Z:yggdrasil-worker-package-manager-0:0.2.3-7.el10_2.9.src",
            "AppStream-10.2.Z:yggdrasil-worker-package-manager-0:0.2.3-7.el10_2.9.x86_64",
            "AppStream-10.2.Z:yggdrasil-worker-package-manager-debuginfo-0:0.2.3-7.el10_2.9.aarch64",
            "AppStream-10.2.Z:yggdrasil-worker-package-manager-debuginfo-0:0.2.3-7.el10_2.9.ppc64le",
            "AppStream-10.2.Z:yggdrasil-worker-package-manager-debuginfo-0:0.2.3-7.el10_2.9.s390x",
            "AppStream-10.2.Z:yggdrasil-worker-package-manager-debuginfo-0:0.2.3-7.el10_2.9.x86_64",
            "AppStream-10.2.Z:yggdrasil-worker-package-manager-debugsource-0:0.2.3-7.el10_2.9.aarch64",
            "AppStream-10.2.Z:yggdrasil-worker-package-manager-debugsource-0:0.2.3-7.el10_2.9.ppc64le",
            "AppStream-10.2.Z:yggdrasil-worker-package-manager-debugsource-0:0.2.3-7.el10_2.9.s390x",
            "AppStream-10.2.Z:yggdrasil-worker-package-manager-debugsource-0:0.2.3-7.el10_2.9.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.2.Z:yggdrasil-worker-package-manager-0:0.2.3-7.el10_2.9.aarch64",
            "AppStream-10.2.Z:yggdrasil-worker-package-manager-0:0.2.3-7.el10_2.9.ppc64le",
            "AppStream-10.2.Z:yggdrasil-worker-package-manager-0:0.2.3-7.el10_2.9.s390x",
            "AppStream-10.2.Z:yggdrasil-worker-package-manager-0:0.2.3-7.el10_2.9.src",
            "AppStream-10.2.Z:yggdrasil-worker-package-manager-0:0.2.3-7.el10_2.9.x86_64",
            "AppStream-10.2.Z:yggdrasil-worker-package-manager-debuginfo-0:0.2.3-7.el10_2.9.aarch64",
            "AppStream-10.2.Z:yggdrasil-worker-package-manager-debuginfo-0:0.2.3-7.el10_2.9.ppc64le",
            "AppStream-10.2.Z:yggdrasil-worker-package-manager-debuginfo-0:0.2.3-7.el10_2.9.s390x",
            "AppStream-10.2.Z:yggdrasil-worker-package-manager-debuginfo-0:0.2.3-7.el10_2.9.x86_64",
            "AppStream-10.2.Z:yggdrasil-worker-package-manager-debugsource-0:0.2.3-7.el10_2.9.aarch64",
            "AppStream-10.2.Z:yggdrasil-worker-package-manager-debugsource-0:0.2.3-7.el10_2.9.ppc64le",
            "AppStream-10.2.Z:yggdrasil-worker-package-manager-debugsource-0:0.2.3-7.el10_2.9.s390x",
            "AppStream-10.2.Z:yggdrasil-worker-package-manager-debugsource-0:0.2.3-7.el10_2.9.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "yggdrasil-worker-package-manager: yggdrasil-worker-package-manager: path traversal via unsanitized repo name in AddRepo/RemoveRepo"
    }
  ]
}

CVE-2026-18379 (GCVE-0-2026-18379)

Vulnerability from cvelistv5 – Published: 2026-11-12 18:49 – Updated: 2026-11-12 23:25

Title

Yggdrasil-worker-package-manager: yggdrasil-worker-package-manager: path traversal via unsanitized repo name in addrepo/removerepo

Summary

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory

Assigner

redhat CNA under the redhat root

CNA scorecard B 82/100 over 1206 records in the last 180 days details

References

3 references

URL	Tags
https://access.redhat.com/errata/RHSA-2026:96082	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2026-18379	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2546571	issue-trackingx_refsource_REDHAT

Impacted products

1 product

Vendor	Product	Version
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:0.2.3-7.el10_2.9 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2

Date Public

2026-11-06 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10.2"
          ],
          "defaultStatus": "affected",
          "packageName": "yggdrasil-worker-package-manager",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:0.2.3-7.el10_2.9",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "datePublic": "2026-11-06T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in yggdrasil-worker-package-manager. An authenticated attacker can exploit this issue to achieve arbitrary file modification or potential privilege escalation. The vulnerability exists because repository management operations fail to sanitize directory traversal sequences (such as \u0027../\u0027) within repository names. By supplying a crafted repository name, an attacker can manipulate the root-level worker process into creating or deleting files outside the intended directory, compromising host system integrity."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Moderate"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "Improper Limitation of a Pathname to a Restricted Directory",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-12T23:25:09.829Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2026:96082",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:96082"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-18379"
        },
        {
          "name": "RHBZ#2546571",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2546571"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-06T11:23:16.902Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-11-06T00:00:00.000Z",
          "value": "Made public."
        }
      ],
      "title": "Yggdrasil-worker-package-manager: yggdrasil-worker-package-manager: path traversal via unsanitized repo name in addrepo/removerepo",
      "workarounds": [
        {
          "lang": "en",
          "value": "--- CME Mitigation Guidance (2026-11-06) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to sanitize repository names and enforce directory boundary validation to prevent traversal sequences from escaping /etc/yum.repos.d/ during file creation and deletion: upgrade to the fixed Yggdrasil Worker Package Manager builds, which apply the documented input check, closing crafted repository names containing directory traversal sequences. Until patched, this is a concern on Linux hosts running yggdrasil-worker-package-manager as root, so Restrict and audit authenticated access to dispatch directives through the management message broker to prevent malformed repository names from reaching the root worker. As a compensating measure, Configure auditd to log file creation, modification, and deletion syscalls initiated by the root worker across monitored system paths, Run SELinux in enforcing mode to confine the worker daemon and prevent writing or deleting files outside repository configuration file types, Deploy an EDR agent to monitor endpoint behavior and detect unauthorized file drops or suspicious cron and system modifications, Use Falco or eBPF runtime security to detect anomalous file write or unlink operations executed by the worker outside /etc/yum.repos.d/, and Deploy AIDE or file integrity monitoring to detect unauthorized modifications or deletions of critical system configuration files. These controls limit blast radius and contain exploitation, but they do not fix the underlying path-traversal defect \u2014 apply the upstream patch to fully remediate.\n\nHighest-impact CME: CME-1301 Path Traversal Prevention (Canonicalization) (high)"
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-18379",
    "datePublished": "2026-11-12T18:49:34.253Z",
    "dateReserved": "2026-07-30T11:14:12.635Z",
    "dateUpdated": "2026-11-12T23:25:09.829Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted