CVE-2026-12701

Отчет

This vulnerability is rated as Important severity because an authenticated administrator can achieve arbitrary file write outside the intended export directory with fully attacker-controlled content. The FilesystemExport API is restricted to admin-level users (in Satellite, authenticated via SSL certificate; in standalone RBAC deployments, admin role only). The Pulp process runs as the "pulp" system user (not root), and file permission bits cannot be controlled by the attacker. However, the "pulp" user typically has write access to service-critical paths, and attack vectors such as cron.d entries (text-parsed, no exec bit required) or overwriting Pulp configuration remain viable depending on filesystem permissions and SELinux policy. Red Hat Satellite and Red Hat Ansible Automation Hub ship pulpcore and are affected. RHUI is not affected because end users do not have access to Pulp content creation APIs.

Меры по смягчению последствий

There is no complete mitigation for this vulnerability. The following measures can reduce risk:

1. If FilesystemExport was never configured on your deployment, you are not affected by this issue.
2. If FilesystemExporters exist in the database, audit them for path traversal sequences ("../"). Existing malicious entries must be cleaned up manually, as the validation functions documented to raise ValidationError do not actually do so in all code paths.
3. Restrict admin-level access to the Pulp API to only trusted operators. Review and audit which accounts have administrator privileges.
4. Ensure SELinux is in enforcing mode on Satellite/Pulp servers to limit the directories the Pulp service user can write to.
5. Monitor filesystem changes outside of expected Pulp directories for signs of exploitation.