EUVD-2026-51380
GHSA-f9rr-qg3x-wq4m
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local vector with low-privilege access to submit a package name (AV:L/PR:L/AC:L), no scope change, but root-level execution yields full C/I/A impact.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
A flaw was found in yggdrasil-worker-package-manager. A local attacker with existing access to the system could exploit an argument injection vulnerability in the APT backend. This allows specially crafted package names, which begin with a hyphen, to be misinterpreted as command options by apt-get. Successful exploitation could lead to remote code execution (RCE) with root privileges, enabling the attacker to fully compromise the system's integrity, confidentiality, and availability.
AnalysisAI
Local privilege escalation to root via argument injection in the APT backend of yggdrasil-worker-package-manager, the Red Hat Insights remote package-management worker shipped with Red Hat Enterprise Linux 10. Because package names are passed directly to apt-get without an argument terminator, a name beginning with a hyphen is parsed as a command-line option rather than a package, letting an attacker who can influence the package list achieve root-level remote code execution. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires that the attacker can control or influence the package name string passed to the yggdrasil-worker-package-manager APT backend on an APT-based system, and that the crafted name begins with a hyphen so apt-get parses it as an option instead of a package operand. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (7.8, High) is internally consistent with the description: exploitation is local (AV:L), low-complexity (AC:L), requires some existing privilege/access to supply a package name (PR:L), needs no user interaction, and yields full C/I/A compromise because code runs as root. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who can already influence the package name handed to the worker (for example a lower-privileged user or a compromised upstream request in a delegated-management setup) supplies a name beginning with a hyphen that apt-get interprets as an option enabling command execution. Since the worker invokes apt-get as root, the injected option runs attacker-controlled code with root privileges, fully compromising the host. … |
| Remediation | Vendor-released patch: upgrade yggdrasil-worker-package-manager to 0.1.4 or 0.2.4 (whichever matches your deployed line), which add the '--' end-of-options terminator to the apt-get invocation (commit 959745bb5917c17f0316af199aace6c71baa5ad7). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all RHEL 10 systems with yggdrasil-worker-package-manager installed and active Insights integration, and map local user access patterns to assess exploitation risk. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Vendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today