YGGDRASIL-WORKER-PACKAGE-MANAGER · CVE-2026-18379 · Other
FIX → 0.2.3-7.el10_2.9 ✓ verified
AddRepo/RemoveRepo in yggdrasil-worker-package-manager do not sanitize '../' in repository names, so an authenticated party able to send directives via the management message broker can make the root worker create or delete files outside /etc/yum.repos.d/. Red Hat rates it Moderate (CVSS 8.8 preliminary) because the broker control plane is required; no exploitation reported.
first public Nov 12, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Systems running yggdrasil-worker-package-manager where a user with an account can submit or manage repository names. The sources do not name affected versions or the deployment conditions beyond that. Teams not running this package can skip it.
Not affected if not-installed, untrusted-broker-access-blocked, worker-not-installed
Who cares path-traversal, privilege-escalation, rhel, rhel-10, self-hosted, yggdrasil, yggdrasil-worker-package-manager
rpm -q yggdrasil-worker-package-manager0.2.3-7.el10_2.9A flaw was found in yggdrasil-worker-package-manager. An authenticated attacker can exploit this issue to achieve arbitrary file modification or potential privilege escalation. The vulnerability exists because repository management operations fail to sanitize directory traversal sequences (such as '../') within repository names. By supplying a crafted repository name, an attacker can manipulate the root-level worker process into creating or deleting files outside the intended directory, compromising host system integrity.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
Upgrade to 0.2.3-7.el10_2.9
On RHEL 10 (incl. 10.2 EUS), update to yggdrasil-worker-package-manager-0.2.3-7.el10_2.9 or later (RHSA-2026:96082): dnf upgrade yggdrasil-worker-package-manager