Live › vulnerability › CVE-2026-112210
Go to dashboardThe rhc-canonical-facts.service systemd unit runs as root and operates on a file inside a directory owned by an unprivileged system user without checking for symbolic links. A local attacker who already controls the yggdrasil service account can use a symlink to take ownership of arbitrary files and escalate to root.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems with rhc installed that run the rhc-canonical-facts.service unit, where the yggdrasil system service account is a possible foothold for a local attacker. The sources do not name affected rhc versions. Systems without rhc, or where the yggdrasil service is not in use, are unlikely to be exposed.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A flaw was found in the rhc-canonical-facts.service systemd unit shipped with rhc. The service runs as root and operates on a file inside a directory owned by an unprivileged system user without verifying that the file is not a symbolic link. A local attacker who has already compromised the privileged yggdrasil system service account can exploit this to gain ownership of arbitrary files, leading to privilege escalation to root.
This page as .md · .json · in your agent: get_signal("CVE-2026-112210")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.