CVE-2026-90959 Red Hat CVE debrief

Who should care

Defenders responsible for systems using pulpcore, particularly those with Pulp Container deployments, should assess exposure and potential impact, and review and apply vendor remediation.

Why it matters

CVE-2026-90959 is a path traversal vulnerability in pulpcore that allows an authenticated user with low-privilege repository permissions to read any file accessible to the Pulp server process. In deployments that include Pulp Container, successful exploitation could lead to unauthorized access to sensitive files, exposure of container registry token signing private key, forgery of bearer tokens, and granting unauthorized access to all private container repositories. Defenders should prioritize verifying exposure and assessing potential impact, and review and apply vendor remediation.

• Potential unauthorized access to sensitive files
• Possible exposure of container registry token signing private key
• Potential forgery of bearer tokens
• Granting unauthorized access to all private container repositories

Technical summary

The content upload API in pulpcore accepts a 'file_url' parameter that allows users with file repository privileges to specify a local file URL for Pulp to download and store. A URL scheme validation check uses a string prefix comparison that only rejects URLs beginning with 'file://', but Python's URL parser recognizes the 'file:' scheme without double slashes, creating a mismatch between what is validated and what is dispatched to the file downloader.

Defensive priority

Defenders should prioritize verifying exposure and assessing potential impact, particularly in deployments that include Pulp Container, and review and apply vendor remediation.

Recommended defensive actions

• Verify exposure by reviewing system configurations and inventory
• Assess potential impact, particularly in deployments that include Pulp Container
• Review and apply vendor remediation
• Monitor for suspicious activity
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. Further verification is needed to determine the full scope of affected systems and potential impact. The vulnerability allows an attacker to read any file accessible to the Pulp server process, which could include sensitive files such as container registry token signing private keys. Defenders should verify exposure and assess potential impact, particularly in deployments that include Pulp Container.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.