VDB
RHSA-2026%3A6555
RHSA-2026%3A6555
PUBLISHED
CVSS 7.099999904632568 HIGH
A path traversal flaw has been discovered in the python wheel too. The unpack function is vulnerable to file permission modification through mishandling of file permissions after extraction. The logic blindly trusts the filename from the archive header for the chmod operation, even though the extraction process itself might have sanitized the path. Attackers can craft a malicious wheel file that, when unpacked, changes the permissions of critical system files (e.g., /etc/passwd, SSH keys, config files), allowing for Privilege Escalation or arbitrary code execution by modifying now-writable scripts.
Risk Scores
CVSS 3.1
7.099999904632568
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/openshift4/pf-status-relay-rhel9@sha256:4010c40e7ea52af12e39628c7d93d238ad64a3020b094e99df2b643626e9cd0e_amd64 as a component of Red Hat OpenShift Container Platform 4.18 | *, *, * |
| Red Hat | registry.redhat.io/openshift4/ose-aws-efs-csi-driver-rhel9-operator@sha256:b6e52dfc23d35287d4227dc75cb43b2ff771b78e33c6ed4dd71902735541eb24_amd64 as a component of Red Hat OpenShift Container Platform 4.18 | *, *, registry.redhat.io/openshift4/ose-aws-efs-csi-driver-rhel9-operator@sha256:b6e52dfc23d35287d4227dc75cb43b2ff771b78e33c6ed4dd71902735541eb24_amd64 |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-capacity-rhel9@sha256:25d885ce6ed2a9b59ee51dbe428bd06275c8907379c77d3cd4e0943b3b181bf0_ppc64le as a component of Red Hat OpenShift Container Platform 4.18 | *, *, * |
| Red Hat | registry.redhat.io/openshift4/ose-vertical-pod-autoscaler-rhel9-operator@sha256:b65a39ffd99ecf16f03dd7bf0b1ecf16f5236235fc57dcb0d790c07d78a786db_amd64 as a component of Red Hat OpenShift Container Platform 4.18 | *, *, * |
| Red Hat | registry.redhat.io/openshift4/ingress-node-firewall-rhel9-operator@sha256:d36c9ff60c6a8fbdfec283082aee811f0831c11c37ed17d6ecbbb9e026052ef8_ppc64le as a component of Red Hat OpenShift Container Platform 4.18 | *, registry.redhat.io/openshift4/ingress-node-firewall-rhel9-operator@sha256:d36c9ff60c6a8fbdfec283082aee811f0831c11c37ed17d6ecbbb9e026052ef8_ppc64le, * |
| Red Hat | registry.redhat.io/openshift4/ose-secrets-store-csi-mustgather-rhel9@sha256:ab04172d1254ad1820fc1ac8c268191788f43a6489cfc50f19a04644861ad258_amd64 as a component of Red Hat OpenShift Container Platform 4.18 | *, registry.redhat.io/openshift4/ose-secrets-store-csi-mustgather-rhel9@sha256:ab04172d1254ad1820fc1ac8c268191788f43a6489cfc50f19a04644861ad258_amd64, * |
| Red Hat | registry.redhat.io/openshift4/ose-sriov-infiniband-cni-rhel9@sha256:42507dad8deeeafcad811bcda3a625382fe836f20196885e9b51e81b03fa84a7_amd64 as a component of Red Hat OpenShift Container Platform 4.18 | *, *, registry.redhat.io/openshift4/ose-sriov-infiniband-cni-rhel9@sha256:42507dad8deeeafcad811bcda3a625382fe836f20196885e9b51e81b03fa84a7_amd64 |
| Red Hat | registry.redhat.io/openshift4/ose-local-storage-rhel9-operator@sha256:4c5f8c19fb62e60909f0f0d6e5e8ac8941c186eb58dbc22f6e059a97da0b3ef3_arm64 as a component of Red Hat OpenShift Container Platform 4.18 | registry.redhat.io/openshift4/ose-local-storage-rhel9-operator@sha256:4c5f8c19fb62e60909f0f0d6e5e8ac8941c186eb58dbc22f6e059a97da0b3ef3_arm64, *, * |
| Red Hat | registry.redhat.io/openshift4/ose-csi-external-provisioner-rhel9@sha256:bdb3a6caf982ab515f63b4e7fd36dd6f0149276de0df8ec7dacf8c989840d8b5_s390x as a component of Red Hat OpenShift Container Platform 4.18 | *, *, * |
| Red Hat | registry.redhat.io/openshift4/sriov-cni-rhel9@sha256:cdcf879ed49f57a38c74b63bdb17dc7af790ec1ec25fc64994d6e5f884ee9433_arm64 as a component of Red Hat OpenShift Container Platform 4.18 | *, registry.redhat.io/openshift4/sriov-cni-rhel9@sha256:cdcf879ed49f57a38c74b63bdb17dc7af790ec1ec25fc64994d6e5f884ee9433_arm64, * |
| Red Hat | registry.redhat.io/openshift4/ose-local-storage-mustgather-rhel9@sha256:5d5a39f12974798b308005931295641700ee03803747d0007083b00df3cb5802_s390x as a component of Red Hat OpenShift Container Platform 4.18 | *, registry.redhat.io/openshift4/ose-local-storage-mustgather-rhel9@sha256:5d5a39f12974798b308005931295641700ee03803747d0007083b00df3cb5802_s390x, * |
| Red Hat | registry.redhat.io/openshift4/ose-kubernetes-nmstate-handler-rhel9@sha256:0ac81847a82186c17275b51e7f8a75e7d60a40b7d5b0ae1f2e7a3d0f82343d94_arm64 as a component of Red Hat OpenShift Container Platform 4.18 | *, registry.redhat.io/openshift4/ose-kubernetes-nmstate-handler-rhel9@sha256:0ac81847a82186c17275b51e7f8a75e7d60a40b7d5b0ae1f2e7a3d0f82343d94_arm64, * |
| Red Hat | registry.redhat.io/openshift4/ose-vertical-pod-autoscaler-rhel9@sha256:6cc7950a5d1fe6ac5cf9131d61ec5c2c62041879791043b1c330a44fa5e85ccd_s390x as a component of Red Hat OpenShift Container Platform 4.18 | *, *, registry.redhat.io/openshift4/ose-vertical-pod-autoscaler-rhel9@sha256:6cc7950a5d1fe6ac5cf9131d61ec5c2c62041879791043b1c330a44fa5e85ccd_s390x |
| Red Hat | registry.redhat.io/openshift4/ose-secrets-store-csi-driver-rhel9-operator@sha256:84ed57dead3d6cfb250bb284da3326a0d2531085c386e875b183e059ede762e4_amd64 as a component of Red Hat OpenShift Container Platform 4.18 | *, registry.redhat.io/openshift4/ose-secrets-store-csi-driver-rhel9-operator@sha256:84ed57dead3d6cfb250bb284da3326a0d2531085c386e875b183e059ede762e4_amd64, * |
| Red Hat | registry.redhat.io/openshift4/ose-cloud-event-proxy-rhel9@sha256:c03ff04f45df0fbbb84afb68017e9a2c984b482fe0c89ccc5ca413d3d4064f16_ppc64le as a component of Red Hat OpenShift Container Platform 4.18 | *, *, registry.redhat.io/openshift4/ose-cloud-event-proxy-rhel9@sha256:c03ff04f45df0fbbb84afb68017e9a2c984b482fe0c89ccc5ca413d3d4064f16_ppc64le |
| Red Hat | registry.redhat.io/openshift4/ose-aws-efs-csi-driver-container-rhel9@sha256:ef454a58e6a7e5845aeb61a66518e9f28cd0e513b30d45826653587f1cc13d4d_arm64 as a component of Red Hat OpenShift Container Platform 4.18 | *, *, registry.redhat.io/openshift4/ose-aws-efs-csi-driver-container-rhel9@sha256:ef454a58e6a7e5845aeb61a66518e9f28cd0e513b30d45826653587f1cc13d4d_arm64 |
| Red Hat | registry.redhat.io/openshift4/ingress-node-firewall-rhel9-operator@sha256:6f09dc9faf4069704e8c4e946608d4b8384bab5d4097d0d62c4bbfd59cf51246_arm64 as a component of Red Hat OpenShift Container Platform 4.18 | *, registry.redhat.io/openshift4/ingress-node-firewall-rhel9-operator@sha256:6f09dc9faf4069704e8c4e946608d4b8384bab5d4097d0d62c4bbfd59cf51246_arm64, * |
| Red Hat | registry.redhat.io/openshift4/ose-sriov-network-device-plugin-rhel9@sha256:962c0369c287b2df18d763092cda51bb7f2355a2e80175cbf7d46ca538dff39f_arm64 as a component of Red Hat OpenShift Container Platform 4.18 | *, *, * |
| Red Hat | registry.redhat.io/openshift4/ose-smb-csi-driver-rhel9@sha256:d699c119e4a29278788cbe47156e6ef5d2077dd156e61d0bab79d03d8cf3e558_amd64 as a component of Red Hat OpenShift Container Platform 4.18 | *, *, registry.redhat.io/openshift4/ose-smb-csi-driver-rhel9@sha256:d699c119e4a29278788cbe47156e6ef5d2077dd156e61d0bab79d03d8cf3e558_amd64 |
…and 185 more
Timeline
- Apr 9, 2026 CVE Published
- May 5, 2026 Distribution Patch
- May 5, 2026 Distribution Patch
- May 5, 2026 Security Advisory
- May 5, 2026 Security Advisory
- Jul 26, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHSA-2026:6555 advisory
- https://access.redhat.com/security/cve/CVE-2026-24049 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_6555.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2431959 issue
- https://www.cve.org/CVERecord?id=CVE-2026-24049 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-24049 advisory
- https://github.com/pypa/wheel/commit/7a7d2de96b22a9adf9208afcc9547e1001569fef advisory
- https://github.com/pypa/wheel/releases/tag/0.46.2 advisory
- https://github.com/pypa/wheel/security/advisories/GHSA-8rrh-rw8j-w5fx advisory