Read the docs
TI-2018-15871 Aliases CVE-2018-1000226GHSA-f88q-22g8-frcg

Cobbler version Verified as present in Cobbler versions 2.6.11+, but code inspection…

Priority MEDIUM 56CWE-732Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 2 without a fix

Attack profile from CVSS 3.0 · NVD. Fix status from CNA, GitHub and Red Hat.

Summary

Cobbler version Verified as present in Cobbler versions 2.6.11+, but code inspection suggests at least 2.0.0+ or possibly even older versions may be vulnerable contains a Incorrect Access Control vulnerability in XMLRPC API (/cobbler_api) that can result in Privilege escalation, data manipulation or exfiltration, LDAP credential harvesting. This attack appear to be exploitable via "network connectivity". Taking advantage of improper validation of security tokens in API endpoints. Please note this is a different issue than CVE-2018-10931.

Why it matters now

EPSS 0.12584 96th percentileScored 2026-11-07
Fix Partial cobbler (PyPI): 3.0.0Red Hat: 2 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—cobbler (PyPI)before 3.0.03.0.0Patch availableGHSA-f88q-22g8-frcg
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • cobbler (PyPI) Vendor— Affected before 3.0.0 Fixed in 3.0.0 Patch available GHSA-f88q-22g8-frcg

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:cobblerd:cobbler:*:*:*:*:*:*:*:*2.0.0VulnerableCobblerd
  • cpe:2.3:a:cobblerd:cobbler:*:*:*:*:*:*:*:* Versions 2.0.0 Vulnerable ·Cobblerd

Remediation

  • Fix · GHSA-f88q-22g8-frcg cobbler (PyPI) Fixed in 3.0.0 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 8AffectedNo fix planned: Will not fix
Red Hat Satellite 5AffectedNo fix planned: Will not fix

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-1000226
  2. 2026-10-03 Alias added: GHSA-f88q-22g8-frcg

References

Advisory 3

Other 4

  • TI-2011-04262 cobbler: Web interface lacks CSRF protection when using Django framework CVSS 3.1HIGH 8.8
  • TI-2011-04264 cobbler has local privilege escalation via the use of insecure location for PYTHON_EGG_CACHE CVSS 3.1HIGH 7.8
  • TI-2018-15870 Cobbler version Verified as present in Cobbler versions 2.6.11+, but code inspection… CVSS 3.0MEDIUM 6.1
  • TI-2014-02584 Absolute path traversal vulnerability in the web interface in Cobbler 2.4.x through 2.6.x… CVSS 2.0MEDIUM 4.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences