{"id":"CVE-2018-10931","kind":"vulnerability","aliases":["CVE-2018-10931","GHSA-8787-63px-3m23"],"related":[],"title":"Cobbler has Exposed Dangerous Method or Function","description":"It was found that cobbler 2.6.x exposed all functions from its CobblerXMLRPCInterface class over XMLRPC. A remote, unauthenticated attacker could use this flaw to gain high privileges within cobbler, upload files to arbitrary location in the context of the daemon.","summary":"Cobbler 2.6.x exposed every function of its XMLRPC interface class, so anyone who can reach the service can call them. An unauthenticated remote attacker can gain high privileges in Cobbler and upload files to arbitrary locations as the daemon user.","severity":"critical","cvss":9.8,"epss":0.68083,"exploited":false,"exploited_at":null,"products":[{"name":"cobbler","fixed":["3.0.0"],"affected":">= 2.6.0, < 3.0.0","ecosystem":"pypi"},{"name":"cobbler project cobbler","fixed":[],"affected":">= 2.6.0, <= 2.6.11","ecosystem":"vendor"},{"name":"redhat satellite","fixed":[],"affected":"= 5.6","ecosystem":"vendor"},{"name":"redhat satellite","fixed":[],"affected":"= 5.7","ecosystem":"vendor"},{"name":"redhat satellite","fixed":[],"affected":"= 5.8","ecosystem":"vendor"}],"ecosystems":["pypi","vendor"],"tags":["cobbler","cwe-749","package","provisioning","python","self-hosted"],"not_affected_if":["cobbler-3.0.0-or-later","xmlrpc-not-reachable"],"how_to_check":"- Run `cobbler version` or check the installed pypi:cobbler version and confirm whether it is at least `2.6.0` and below `3.0.0`\n- Check whether the Cobbler XMLRPC service is reachable from untrusted networks (default port 25151)","fix":"- Upgrade pypi:cobbler to `3.0.0` or later","status":"open","published_at":"2018-08-09T20:29:00+00:00","first_seen_at":"2026-10-27T16:20:27+00:00","triaged_at":"2026-10-27T16:21:24+00:00","updated_at":"2026-10-27T16:33:07+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-27T16:21:24Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade pypi:cobbler to `3.0.0` or later","reach":"network","title":"Cobbler: unauthenticated XMLRPC exposes dangerous functions, allowing file upload","impact":"high","summary":"Cobbler 2.6.x exposed every function of its XMLRPC interface class, so anyone who can reach the service can call them. An unauthenticated remote attacker can gain high privileges in Cobbler and upload files to arbitrary locations as the daemon user.","category":"package","nicknames":[],"who_cares":["cobbler","self-hosted","python","provisioning"],"confidence":0.8,"needs_auth":"no","worst_case":"Unauthenticated attacker gains high privileges and writes arbitrary files as the daemon","analyst_note":"","how_to_check":"- Run `cobbler version` or check the installed pypi:cobbler version and confirm whether it is at least `2.6.0` and below `3.0.0`\n- Check whether the Cobbler XMLRPC service is reachable from untrusted networks (default port 25151)","needs_analyst":false,"not_affected_if":["cobbler-3.0.0-or-later","xmlrpc-not-reachable"],"who_is_affected":"Teams running Cobbler 2.6.x (installed from pypi:cobbler) with the XMLRPC API reachable over the network are exposed, since the flaw needs no login. Systems running Cobbler 3.0.0 or later, or Cobbler not installed, are not affected.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"critical"},"cost_usd":0.000612,"input_tokens":3354,"output_tokens":554,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-10931':10A,19A '-2018':9A,18A '-63':13A '-749':32B '-8787':12A '2.6':40B,85C '3m23':16A 'anyon':51B 'arbitrari':74B,113C 'attack':63B,99C 'call':58B 'class':49B,93C 'cobbler':1A,20A,21A,23A,30B,39B,69B,84C,109C 'cobblerxmlrpcinterfac':92C 'context':117C 'could':100C 'cve':8A,17A 'cwe':31B 'daemon':78B,120C 'danger':4A 'everi':43B 'expos':3A,42B,87C 'file':72B,111C 'flaw':103C 'found':82C 'function':7A,44B,89C 'gain':65B,105C 'ghsa':11A 'high':66B,106C 'host':38B 'interfac':48B 'locat':75B,114C 'method':5A 'packag':33B 'privileg':67B,107C 'project':22A 'provis':34B 'px':15A 'px-3m23':14A 'python':35B 'reach':54B 'redhat':24A,26A,28A 'remot':62B,97C 'satellite':25A,27A,29A 'self':37B 'self-host':36B 'servic':56B 'unauthent':61B,98C 'upload':71B,110C 'use':101C 'user':79B 'within':108C 'x':41B,86C 'xmlrpc':47B,95C","nicknames":[],"mitigations":[],"who_affected":"Teams running Cobbler 2.6.x (installed from pypi:cobbler) with the XMLRPC API reachable over the network are exposed, since the flaw needs no login. Systems running Cobbler 3.0.0 or later, or Cobbler not installed, are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2018-08-09T20:29:00+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-8787-63px-3m23","url":"https://github.com/advisories/GHSA-8787-63px-3m23","severity":"critical","published_at":"2022-05-13T01:54:14+00:00","modified_at":"2026-10-27T16:17:55+00:00","first_seen_at":"2026-10-27T16:20:27+00:00","fetched_at":"2026-10-27T16:20:27+00:00","note":null},{"source":"nvd","external_id":"CVE-2018-10931","url":"https://nvd.nist.gov/vuln/detail/CVE-2018-10931","severity":null,"published_at":"2018-08-09T20:29:00+00:00","modified_at":"2026-06-17T01:34:57+00:00","first_seen_at":"2026-10-27T16:33:07+00:00","fetched_at":"2026-10-27T16:33:07+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}