yggdrasil-worker-package-manager EUVD-2026-51380

Requires that the attacker can control or influence the package name string passed to the yggdrasil-worker-package-manager APT backend on an APT-based system, and that the crafted name begins with a hyphen so apt-get parses it as an option instead of a package operand. Limiting factors: exploitation is local (AV:L) and requires existing low-level access or privilege (PR:L) sufficient to submit a package operation through the worker; the vulnerable code path is the APT backend specifically; and the worker must be deployed and reachable in the environment. It is not a remote-unauthenticated flaw - an attacker with no path to the worker's package input cannot trigger it.

The CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (7.8, High) is internally consistent with the description: exploitation is local (AV:L), low-complexity (AC:L), requires some existing privilege/access to supply a package name (PR:L), needs no user interaction, and yields full C/I/A compromise because code runs as root. This is a genuine local privilege-escalation / RCE primitive rather than a network-facing mass-exploitation risk. No EPSS score, POC, or KEV entry was provided; the local-only vector plus the need to influence the worker's package input make widespread opportunistic exploitation unlikely, while risk is elevated in delegated- or multi-tenant management setups where lower-privileged input can steer the package name sent to a root worker. No signals conflict here - all point to a locally-scoped, high-impact but not internet-wormable flaw. Absent EPSS/KEV data, treat as a patch-soon item for RHEL 10 fleets running this worker, not an emergency.

An attacker who can already influence the package name handed to the worker (for example a lower-privileged user or a compromised upstream request in a delegated-management setup) supplies a name beginning with a hyphen that apt-get interprets as an option enabling command execution. Since the worker invokes apt-get as root, the injected option runs attacker-controlled code with root privileges, fully compromising the host. No public POC was provided, but the one-line nature of the flaw makes exploitation straightforward once the package-name input is reachable.