Yggdrasil-worker-package-manager: yggdrasil-worker-package-manager: path traversal via unsanitized repo name in addrepo/removerepo
Summary
| CVE | CVE-2026-18379 |
|---|---|
| State | PUBLISHED |
| Assigner | redhat |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-11-12 19:17:04 UTC |
| Updated | 2026-11-13 00:20:14 UTC |
| Description | A flaw was found in yggdrasil-worker-package-manager. An authenticated attacker can exploit this issue to achieve arbitrary file modification or potential privilege escalation. The vulnerability exists because repository management operations fail to sanitize directory traversal sequences (such as '../') within repository names. By supplying a crafted repository name, an attacker can manipulate the root-level worker process into creating or deleting files outside the intended directory, compromising host system integrity. |
Risk And Classification
Primary CVSS: v3.1 8.8 HIGH from [email protected]
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Problem Types: CWE-22 | CWE-22 Improper Limitation of a Pathname to a Restricted Directory
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Secondary | 8.8 | HIGH | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| 3.1 | CNA | CVSS | 8.8 | HIGH | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
CVSS v3.1 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Red Hat | Red Hat Enterprise Linux 10 | unaffected 0:0.2.3-7.el10_2.9 * rpm | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| access.redhat.com/errata/RHSA-2026:96082 | [email protected] | access.redhat.com | |
| bugzilla.redhat.com/show_bug.cgi | [email protected] | bugzilla.redhat.com | |
| access.redhat.com/security/cve/CVE-2026-18379 | [email protected] | access.redhat.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Additional Advisory Data
| Source | Time | Event |
|---|---|---|
| CNA | 2026-10-06T11:23:16.902Z | Reported to Red Hat. |
| CNA | 2026-11-06T00:00:00.000Z | Made public. |
Workarounds
CNA: --- CME Mitigation Guidance (2026-11-06) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure. The highest-value action is to sanitize repository names and enforce directory boundary validation to prevent traversal sequences from escaping /etc/yum.repos.d/ during file creation and deletion: upgrade to the fixed Yggdrasil Worker Package Manager builds, which apply the documented input check, closing crafted repository names containing directory traversal sequences. Until patched, this is a concern on Linux hosts running yggdrasil-worker-package-manager as root, so Restrict and audit authenticated access to dispatch directives through the management message broker to prevent malformed repository names from reaching the root worker. As a compensating measure, Configure auditd to log file creation, modification, and deletion syscalls initiated by the root worker across monitored system paths, Run SELinux in enforcing mode to confine the worker daemon and prevent writing or deleting files outside repository configuration file types, Deploy an EDR agent to monitor endpoint behavior and detect unauthorized file drops or suspicious cron and system modifications, Use Falco or eBPF runtime security to detect anomalous file write or unlink operations executed by the worker outside /etc/yum.repos.d/, and Deploy AIDE or file integrity monitoring to detect unauthorized modifications or deletions of critical system configuration files. These controls limit blast radius and contain exploitation, but they do not fix the underlying path-traversal defect — apply the upstream patch to fully remediate. Highest-impact CME: CME-1301 Path Traversal Prevention (Canonicalization) (high)