---
id: "CVE-2018-10931"
kind: "vulnerability"
aliases: ["CVE-2018-10931", "GHSA-8787-63px-3m23"]
title: "Cobbler has Exposed Dangerous Method or Function"
severity: "critical"
cvss: 9.8
epss: 0.68083
exploited: false
status: "open"
category: "package"
products: [{"name": "cobbler", "fixed": ["3.0.0"], "affected": ">= 2.6.0, < 3.0.0", "ecosystem": "pypi"}, {"name": "cobbler project cobbler", "fixed": [], "affected": ">= 2.6.0, <= 2.6.11", "ecosystem": "vendor"}, {"name": "redhat satellite", "fixed": [], "affected": "= 5.6", "ecosystem": "vendor"}, {"name": "redhat satellite", "fixed": [], "affected": "= 5.7", "ecosystem": "vendor"}, {"name": "redhat satellite", "fixed": [], "affected": "= 5.8", "ecosystem": "vendor"}]
ecosystems: ["pypi", "vendor"]
tags: ["cobbler", "cwe-749", "package", "provisioning", "python", "self-hosted"]
not_affected_if: ["cobbler-3.0.0-or-later", "xmlrpc-not-reachable"]
published_at: "2018-08-09T20:29:00+00:00"
first_seen_at: "2026-10-27T16:20:27+00:00"
updated_at: "2026-10-27T16:33:07+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-8787-63px-3m23", "first_seen_at": "2026-10-27T16:20:27+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-10931", "first_seen_at": "2026-10-27T16:33:07+00:00"}]
---

# Cobbler has Exposed Dangerous Method or Function

Cobbler 2.6.x exposed every function of its XMLRPC interface class, so anyone who can reach the service can call them. An unauthenticated remote attacker can gain high privileges in Cobbler and upload files to arbitrary locations as the daemon user.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pypi:cobbler affected >= 2.6.0, < 3.0.0 fixed 3.0.0
- vendor:cobbler project cobbler affected >= 2.6.0, <= 2.6.11 fixed ?
- vendor:redhat satellite affected = 5.6 fixed ?
- vendor:redhat satellite affected = 5.7 fixed ?
- vendor:redhat satellite affected = 5.8 fixed ?

## How to check

- Run `cobbler version` or check the installed pypi:cobbler version and confirm whether it is at least `2.6.0` and below `3.0.0`
- Check whether the Cobbler XMLRPC service is reachable from untrusted networks (default port 25151)

## Fix

- Upgrade pypi:cobbler to `3.0.0` or later

## Timeline

- 2026-10-27T16:20:27+00:00 ghsa https://github.com/advisories/GHSA-8787-63px-3m23
- 2026-10-27T16:33:07+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2018-10931

## From the sources

It was found that cobbler 2.6.x exposed all functions from its CobblerXMLRPCInterface class over XMLRPC. A remote, unauthenticated attacker could use this flaw to gain high privileges within cobbler, upload files to arbitrary location in the context of the daemon.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_