Live › vulnerability › CVE-2018-10931
Go to dashboardCobbler 2.6.x exposed every function of its XMLRPC interface class, so anyone who can reach the service can call them. An unauthenticated remote attacker can gain high privileges in Cobbler and upload files to arbitrary locations as the daemon user.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 16:20 UTC, 0h before NVD. All times on this page are UTC.
Teams running Cobbler 2.6.x (installed from pypi:cobbler) with the XMLRPC API reachable over the network are exposed, since the flaw needs no login. Systems running Cobbler 3.0.0 or later, or Cobbler not installed, are not affected.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| cobbler | pypi | >= 2.6.0, < 3.0.0 | 3.0.0 |
| cobbler project cobbler | vendor | >= 2.6.0, <= 2.6.11 | – |
| redhat satellite | vendor | = 5.6 | – |
| redhat satellite | vendor | = 5.7 | – |
| redhat satellite | vendor | = 5.8 | – |
cobbler version or check the installed pypi:cobbler version and confirm whether it is at least 2.6.0 and below 3.0.03.0.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
It was found that cobbler 2.6.x exposed all functions from its CobblerXMLRPCInterface class over XMLRPC. A remote, unauthenticated attacker could use this flaw to gain high privileges within cobbler, upload files to arbitrary location in the context of the daemon.
This page as .md · .json · in your agent: get_signal("CVE-2018-10931")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.