VDB
RHSA-2026:50479
RHSA-2026:50479
PUBLISHED
CVSS 8.199999809265137 HIGH
A flaw was found in pip, the package installer for Python. A remote attacker can exploit this vulnerability by tricking a victim into installing a malicious Python wheel. This wheel contains specially crafted entry-point names that use directory traversal or absolute paths. This allows pip to write generated script wrappers outside the intended installation directory, leading to arbitrary file overwrite. This can severely impact system integrity and availability, and in certain scenarios, may lead to arbitrary code execution.
Risk Scores
CVSS 3.1
8.199999809265137
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/ansible-automation-platform-26/gateway-rhel9-operator@sha256:2f9958a2ab37aa25749d5cb9eb9d0dc8bf6b79846963c04f95d09bcc061431e9_amd64 as a component of Red Hat Ansible Automation Platform 2.6 | * |
| Red Hat | registry.redhat.io/ansible-automation-platform-26/gateway-rhel9@sha256:3bb5c591fa83d61af4a21f63ab1e044aa56f86a89cbda17b77b98a2a3bb088b9_ppc64le as a component of Red Hat Ansible Automation Platform 2.6 | * |
| Red Hat | registry.redhat.io/ansible-automation-platform-26/controller-rhel9@sha256:8acf8e32e0dfca8b9a4cfcd765509424a8c1b884ad382a5f21d58e8c44e56cae_ppc64le as a component of Red Hat Ansible Automation Platform 2.6 | * |
| Red Hat | registry.redhat.io/ansible-automation-platform-26/gateway-rhel9@sha256:b579af422da0bb4bc6fe17e598ca356e68957b566d9a607ff854ad6039572a56_arm64 as a component of Red Hat Ansible Automation Platform 2.6 | * |
| Red Hat | registry.redhat.io/ansible-automation-platform-26/lightspeed-chatbot-rhel9@sha256:a4927ab07375561c595afb1898ea52e28a9efb6910bee1011332d23344052e3f_amd64 as a component of Red Hat Ansible Automation Platform 2.6 | * |
| Red Hat | registry.redhat.io/ansible-automation-platform-26/receptor-rhel9@sha256:461fc04f1bc051c5ce6ced0e7d7179e9078dd5545eced38bdc37df7a9c06e722_ppc64le as a component of Red Hat Ansible Automation Platform 2.6 | * |
| Red Hat | registry.redhat.io/ansible-automation-platform-26/de-minimal-rhel9@sha256:30745071ac71a3fdd97d062f180c8fd05d75d9955d4cfccbcf2aeec8deb7f084_s390x as a component of Red Hat Ansible Automation Platform 2.6 | * |
| Red Hat | registry.redhat.io/ansible-automation-platform-26/platform-resource-runner-rhel9@sha256:9683a91e7d16893fe030e1701a2500d1e79c7bea0ab7557438b53d281acd14e4_ppc64le as a component of Red Hat Ansible Automation Platform 2.6 | * |
| Red Hat | registry.redhat.io/ansible-automation-platform/platform-operator-bundle@sha256:f72a736351733cb24b8243647309abcdf086f0cb8fe59e12a3e95510917dfb4d_amd64 as a component of Red Hat Ansible Automation Platform 2.6 | * |
| Red Hat | registry.redhat.io/ansible-automation-platform-tech-preview/mcp-server-rhel9@sha256:18f55feaae83ee6506b3af76cdd511687e82995440f87af6e9b9aefa06e726ad_amd64 as a component of Red Hat Ansible Automation Platform 2.6 | * |
| Red Hat | registry.redhat.io/ansible-automation-platform-26/ee-minimal-rhel9@sha256:87db0da260805165f54ef956c9e4b1e6a4f6e559306a35558696fb2861422cef_ppc64le as a component of Red Hat Ansible Automation Platform 2.6 | * |
| Red Hat | registry.redhat.io/ansible-automation-platform-26/lightspeed-rhel9-operator@sha256:5565418214a3480ba6e3a85f56838678549e515e374535813dfdc03700950cb7_s390x as a component of Red Hat Ansible Automation Platform 2.6 | * |
| Red Hat | registry.redhat.io/ansible-automation-platform-tech-preview/metrics-service-rhel9@sha256:a6ecee20b39158df405c56ed811a882c2ea82a996308b51fad6ac659c669c566_amd64 as a component of Red Hat Ansible Automation Platform 2.6 | * |
| Red Hat | registry.redhat.io/ansible-automation-platform-26/gateway-rhel9-operator@sha256:63abb6f786ed50165351ec2f03649ef0ff5d05e06a939e2314c8b8b4729e803a_arm64 as a component of Red Hat Ansible Automation Platform 2.6 | * |
| Red Hat | registry.redhat.io/ansible-automation-platform-26/ee-supported-rhel9@sha256:7dfd8a045a5df672dc2b4f76bff307c0a78c1703e0572f10c1e07bd46e735947_amd64 as a component of Red Hat Ansible Automation Platform 2.6 | * |
| Red Hat | registry.redhat.io/ansible-automation-platform-26/platform-resource-runner-rhel9@sha256:a217de550b6a6509eca369318e2bd9585a70c67756ac9980f933b548de668f8d_s390x as a component of Red Hat Ansible Automation Platform 2.6 | * |
| Red Hat | registry.redhat.io/ansible-automation-platform-26/de-supported-rhel9@sha256:a48db0666b33ef1be5ab4ff02d7584c3fa1516c8a18f09295ae6a220d2e2ebf6_amd64 as a component of Red Hat Ansible Automation Platform 2.6 | * |
| Red Hat | registry.redhat.io/ansible-automation-platform-26/hub-rhel9-operator@sha256:c1c608e5ee45a6d6248d7657e9b7f17cdb3f8342af9b5e94145217c6fb6efc2a_s390x as a component of Red Hat Ansible Automation Platform 2.6 | * |
| Red Hat | registry.redhat.io/ansible-automation-platform-26/controller-rhel9-operator@sha256:fa606a224ac6d3d5e17650a9b9a52e5cb76af57dc767adf79609e0ab95081304_amd64 as a component of Red Hat Ansible Automation Platform 2.6 | * |
| Red Hat | registry.redhat.io/ansible-automation-platform-26/lightspeed-rhel9@sha256:f5c7dd391581c2549b57ea4a5f61133221d19951ac45ff10952bc26048b71975_ppc64le as a component of Red Hat Ansible Automation Platform 2.6 | * |
…and 98 more
Timeline
- Aug 4, 2026 CVE Published
- Sep 11, 2026 CVE Updated
- Sep 11, 2026 Distribution Patch
- Sep 11, 2026 Distribution Patch
- Sep 11, 2026 Security Advisory
- Sep 11, 2026 Security Advisory
- Sep 11, 2026 Security Advisory
- Sep 11, 2026 Security Advisory
- Sep 11, 2026 Security Advisory
- Sep 11, 2026 Security Advisory
- Sep 11, 2026 Security Advisory
- Sep 11, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:50479 advisory
- https://access.redhat.com/security/cve/CVE-2026-11332 advisory
- https://access.redhat.com/security/cve/CVE-2026-13149 advisory
- https://access.redhat.com/security/cve/CVE-2026-13676 advisory
- https://access.redhat.com/security/cve/CVE-2026-18141 advisory
- https://access.redhat.com/security/cve/CVE-2026-34993 advisory
- https://access.redhat.com/security/cve/CVE-2026-40898 advisory
- https://access.redhat.com/security/cve/CVE-2026-44545 advisory
- https://access.redhat.com/security/cve/CVE-2026-48990 advisory
- https://access.redhat.com/security/cve/CVE-2026-54058 advisory
- https://access.redhat.com/security/cve/CVE-2026-54060 advisory
- https://access.redhat.com/security/cve/CVE-2026-54283 advisory
- https://access.redhat.com/security/cve/CVE-2026-55379 advisory
- https://access.redhat.com/security/cve/CVE-2026-55380 advisory
- https://access.redhat.com/security/cve/CVE-2026-59197 advisory
- https://access.redhat.com/security/cve/CVE-2026-59869 advisory
- https://access.redhat.com/security/cve/CVE-2026-59886 advisory
- https://access.redhat.com/security/cve/CVE-2026-59939 advisory
- https://access.redhat.com/security/cve/CVE-2026-8643 advisory
- https://access.redhat.com/security/cve/CVE-2026-9595 advisory
…and 102 more