Red Hat rhc CVE-2026-112210

Exploitation requires that the attacker has already fully compromised the privileged yggdrasil system service account used by rhc, and that the affected rhc package with the rhc-canonical-facts.service systemd unit is installed and the service runs as root (its default shipped configuration on RHEL). The concrete primitive is that the root service operates on a file inside the yggdrasil-user-owned directory without verifying the file is not a symbolic link, so the attacker pre-plants a symlink to a root-owned target. Limiting factors that reduce real-world risk: local access only (no remote vector), a hard prerequisite of prior yggdrasil-account compromise (PR:H), and no user interaction from a victim - meaning realistic exposure is confined to systems where the yggdrasil account can already be reached.

This is a genuine but conditional local privilege-escalation issue (CWE-59, link following) in the rhc-canonical-facts.service unit, and the signals are internally consistent rather than conflicting. The vendor CVSS vector (AV:L/AC:L/PR:H/UI:N/S:U, 6.0 MEDIUM) correctly reflects a local-only attack that requires the attacker to ALREADY hold high privileges - specifically the compromised yggdrasil system service account - so this is a chaining/escalation primitive, not an initial-access bug. No EPSS score, KEV listing, or public POC was provided in the input, and there is no public exploit identified at time of analysis. The practical risk is therefore moderate: the technical impact is severe (full root once chained), but the PR:H precondition means it is only valuable as the second stage of an attack where yggdrasil is already owned. This should be patched as part of normal RHEL errata hygiene rather than treated as an emergency; it is a real, legitimate escalation path but not a mass-exploitation candidate. One honest caveat: the vendor rated confidentiality impact C:N, but successful escalation to root yields full disclosure of the system - see assessed vector where I raise C to H for that reason.

An attacker who has already subverted the unprivileged yggdrasil service account places a symbolic link inside the yggdrasil-owned working directory, pointing at a sensitive root-owned target file. When the root-running rhc-canonical-facts.service next operates on that file without checking for a symlink, it follows the link and transfers ownership (or writes content) to the attacker, who then leverages the newly owned file to execute code as root. No public exploit code is known at time of analysis, and because this is a planted-symlink rather than a tight race, no precise timing window is required.