wheel Allows Arbitrary File Permission Modification via Path Traversal
Priority MEDIUM 64CWE-22Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · High
- Fix status
- Partial Red Hat: 43 fixed, 11 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.
Summary
wheel is a command line tool for manipulating Python wheel files, as defined in PEP 427. In versions 0.40.0 through 0.46.1, the unpack function is vulnerable to file permission modification through mishandling of file permissions after extraction. The logic blindly trusts the filename from the archive header for the chmod operation, even though the extraction process itself might have sanitized the path. Attackers can craft a malicious wheel file that, when unpacked, changes the permissions of critical system files (e.g., /etc/passwd, SSH keys, config files), allowing for Privilege Escalation or arbitrary code execution by modifying now-writable scripts. This issue has been fixed in version 0.46.2.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0035 28th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial wheel (pypa): 0.46.2wheel (PyPI): 0.46.2Red Hat: 44 advisoriesRed Hat: 43 fixed, 11 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| pypa | wheel | 0.40.0 to before 0.46.2 | 0.46.2 | Patch available | CNA |
| — | wheel (PyPI) | 0.40.0 to before 0.46.2 | 0.46.2 | Patch available | GHSA-8rrh-rw8j-w5fx |
- wheel Vendorpypa Affected 0.40.0 to before 0.46.2 Fixed in 0.46.2 Patch available CNA
- wheel (PyPI) Vendor— Affected 0.40.0 to before 0.46.2 Fixed in 0.46.2 Patch available GHSA-8rrh-rw8j-w5fx
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:wheel_project:wheel:*:*:*:*:*:python:*:* | 0.40.0 to before 0.46.2 | Vulnerable | Wheel Project |
- cpe:2.3:a:wheel_project:wheel:*:*:*:*:*:python:*:* Versions 0.40.0 to before 0.46.2 Vulnerable ·Wheel Project
Remediation
- Fix · CNA wheel (pypa) Fixed in 0.46.2
- Fix · GHSA-8rrh-rw8j-w5fx wheel (PyPI) Fixed in 0.46.2 Advisory →
Red Hat 44 advisories
- RHSA-2026:62115 Released 2026-09-01 · Red Hat rating ImportantRed Hat Ceph Storage
- Red Hat Ceph Storage 8.1 registry.redhat.io/rhceph/grafana-rhel9, registry.redhat.io/rhceph/rhceph-8-rhel9
- RHSA-2026:61628 Released 2026-08-31 · Red Hat rating ImportantRed Hat AI Inference Server Model Optimization Tools 3.2.2 (CUDA)
- Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/model-opt-cuda-rhel9
- RHSA-2026:20089 Released 2026-05-29 · Red Hat rating ImportantOpenShift Container Platform 4.16.63 security and extras update
- Red Hat OpenShift Container Platform 4.16 registry.redhat.io/openshift4/ose-ansible-rhel9-operator, registry.redhat.io/openshift4/ose-dpu-cni-rhel9, registry.redhat.io/openshift4/ose-node-feature-discovery-rhel9 +3
Show 41 more Red Hat advisories
- RHSA-2026:19712 Released 2026-05-20 · Red Hat rating CriticalRHOAI 3.3.3 - Red Hat OpenShift AI
- Red Hat OpenShift AI 3.3 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9 +33
- RHSA-2026:17599 Released 2026-05-20 · Red Hat rating ImportantOpenShift Container Platform 4.17.54 security and extras update
- Red Hat OpenShift Container Platform 4.17 registry.redhat.io/openshift4/ose-ansible-rhel9-operator, registry.redhat.io/openshift4/ose-node-feature-discovery-rhel9, registry.redhat.io/openshift4/ose-sriov-network-device-plugin-rhel9
- RHSA-2026:14020 Released 2026-05-06 · Red Hat rating ImportantRelease of components for Service Telemetry Framework 1.5.7
- Red Hat OpenStack 1.5 registry.redhat.io/stf/prometheus-webhook-snmp-rhel9, registry.redhat.io/stf/service-telemetry-rhel9-operator, registry.redhat.io/stf/sg-core-rhel9 +1
- RHSA-2026:13545 Released 2026-05-04 · Red Hat rating ImportantRed Hat Ansible Automation Platform 2.6 Container Release Update
- Red Hat Ansible Automation Platform 2.6 registry.redhat.io/ansible-automation-platform-26/ansible-dev-tools-rhel9, registry.redhat.io/ansible-automation-platform-26/controller-rhel9, registry.redhat.io/ansible-automation-platform-26/eda-controller-rhel9 +11
- RHSA-2026:10184 Released 2026-04-23 · Red Hat rating ImportantRHOAI 2.25.5 - Red Hat OpenShift AI
- Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-caikit-nlp-rhel9, registry.redhat.io/rhoai/odh-caikit-tgis-serving-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9 +47
- RHSA-2026:7250 Released 2026-04-16 · Red Hat rating ImportantOpenShift Container Platform 4.19.28 security and extras update
- Red Hat OpenShift Container Platform 4.19 registry.redhat.io/openshift4/ose-ansible-rhel9-operator
- RHSA-2026:6565 Released 2026-04-09 · Red Hat rating ImportantOpenShift Container Platform 4.20.18 security and extras update
- Red Hat OpenShift Container Platform 4.20 registry.redhat.io/openshift4/ose-ansible-rhel9-operator
- RHSA-2026:6555 Released 2026-04-09 · Red Hat rating ImportantOpenShift Container Platform 4.18.37 security and extras update
- Red Hat OpenShift Container Platform 4.18 registry.redhat.io/openshift4/ose-ansible-rhel9-operator
- RHSA-2026:6562 Released 2026-04-08 · Red Hat rating ImportantOpenShift Container Platform 4.21.9 security and extras update
- Red Hat OpenShift Container Platform 4.21 registry.redhat.io/openshift4/ose-ansible-rhel9-operator
- RHSA-2026:6192 Released 2026-03-30 · Red Hat rating ImportantRed Hat OpenShift Dev Spaces 3.27.0 Release.
- Red Hat OpenShift Dev Spaces 3.27 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/configbump-rhel9, registry.redhat.io/devspaces/dashboard-rhel9 +9
- RHSA-2026:5119 Released 2026-03-19 · Red Hat rating ImportantRed Hat OpenShift AI 3.4.0-ea.1 Release
- Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-feature-server-rhel9, registry.redhat.io/rhoai/odh-vllm-gaudi-rhel9
- RHSA-2026:4942 Released 2026-03-18 · Red Hat rating ImportantRed Hat Quay 3.12.15
- Red Hat Quay 3.12 registry.redhat.io/quay/quay-rhel8
- RHSA-2026:4271 Released 2026-03-11 · Red Hat rating ImportantRHTAS 1.3.2 - Tech Preview Release of Model Transparency
- Red Hat Trusted Artifact Signer 1.3 registry.redhat.io/rhtas/model-transparency-rhel9
- RHSA-2026:4215 Released 2026-03-10 · Red Hat rating ImportantRed Hat Quay 3.14.6
- Red Hat Quay 3.14 registry.redhat.io/quay/quay-rhel8
- RHSA-2026:4185 Released 2026-03-10 · Red Hat rating ImportantRed Hat Quay 3.13.11
- Red Hat Quay 3.13 registry.redhat.io/quay/quay-rhel8
- RHSA-2026:3959 Released 2026-03-06 · Red Hat rating ImportantRed Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update
- Red Hat Ansible Automation Platform 2.5 for RHEL 8 automation-controller-4.6.26-1.el8ap, automation-controller-cli-4.6.26-1.el8ap, automation-controller-server-4.6.26-1.el8ap +10
- Red Hat Ansible Automation Platform 2.5 for RHEL 9 automation-controller-4.6.26-1.el9ap, automation-controller-cli-4.6.26-1.el9ap, automation-controller-server-4.6.26-1.el9ap +10
- RHSA-2026:3960 Released 2026-03-06 · Red Hat rating ImportantRed Hat Ansible Automation Platform 2.6 Container Release Update
- Red Hat Ansible Automation Platform 2.6 registry.redhat.io/ansible-automation-platform-26/de-minimal-rhel9, registry.redhat.io/ansible-automation-platform-26/de-supported-rhel9, registry.redhat.io/ansible-automation-platform-26/ee-minimal-rhel9 +9
- RHSA-2026:3958 Released 2026-03-06 · Red Hat rating ImportantRed Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update
- Red Hat Ansible Automation Platform 2.6 for RHEL 10 receptor-1.6.3-4.el10ap, receptorctl-1.6.3-4.el10ap
- Red Hat Ansible Automation Platform 2.6 for RHEL 9 automation-controller-4.7.9-1.el9ap, automation-controller-cli-4.7.9-1.el9ap, automation-controller-server-4.7.9-1.el9ap +8
- RHSA-2026:3782 Released 2026-03-04 · Red Hat rating CriticalRHOAI 2.25.3 - Red Hat OpenShift AI
- Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-caikit-tgis-serving-rhel9, registry.redhat.io/rhoai/odh-codeflare-operator-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9 +27
- RHSA-2026:3713 Released 2026-03-04 · Red Hat rating CriticalRHOAI 3.3 - Red Hat OpenShift AI
- Red Hat OpenShift AI 3.3 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9 +47
- RHSA-2026:3462 Released 2026-02-27 · Red Hat rating CriticalRed Hat AI Inference Server 3.2.2 (ROCm)
- Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/vllm-rocm-rhel9
- RHSA-2026:3461 Released 2026-02-27 · Red Hat rating CriticalRed Hat AI Inference Server 3.2.2 (CUDA)
- Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/vllm-cuda-rhel9
- RHSA-2026:2925 Released 2026-02-18 · Red Hat rating ImportantRHTAS 1.2.2 - Red Hat Trusted Artifact Signer Release
- Red Hat Trusted Artifact Signer 1.2 registry.redhat.io/rhtas/segment-reporting-rhel9
- RHSA-2026:2900 Released 2026-02-18 · Red Hat rating ImportantNetwork Observability 1.11.0 for OpenShift
- Network Observability (NETOBSERV) 1.11.0 registry.redhat.io/network-observability/network-observability-cli-rhel9, registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9, registry.redhat.io/network-observability/network-observability-console-plugin-rhel9 +2
- RHSA-2026:2866 Released 2026-02-18 · Red Hat rating Importantpython3.12-wheel security update
- Red Hat CodeReady Linux Builder EUS (v.9.4) python3.12-wheel-wheel-0.41.2-3.el9_4.1
- Red Hat Enterprise Linux AppStream EUS (v.9.4) python3.12-wheel-0.41.2-3.el9_4.1
- RHSA-2026:2865 Released 2026-02-18 · Red Hat rating Importantpython-wheel security update
- Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) python-wheel-1:0.41.2-5.el10_0.1, python3-wheel-1:0.41.2-5.el10_0.1, python3-wheel-wheel-1:0.41.2-5.el10_0.1
- RHSA-2026:2823 Released 2026-02-17 · Red Hat rating ImportantUpdated discovery-cli release RPM versions 2.4.3
- Discovery 2 for RHEL 10 discovery-cli-2.4.3-2.el10
- Discovery 2 for RHEL 8 discovery-cli-2.4.3-2.el8
- Discovery 2 for RHEL 9 discovery-cli-2.4.3-2.el9
- RHSA-2026:2762 Released 2026-02-16 · Red Hat rating ImportantRed Hat Quay 3.10.18
- Red Hat Quay 3.10 registry.redhat.io/quay/quay-rhel8
- RHSA-2026:2754 Released 2026-02-16 · Red Hat rating ImportantRed Hat Quay 3.9.18
- Red Hat Quay 3.9 registry.redhat.io/quay/quay-rhel8
- RHSA-2026:2710 Released 2026-02-16 · Red Hat rating Importantpython3.12-wheel security update
- Red Hat CodeReady Linux Builder EUS (v.9.6) python3.12-wheel-wheel-0.41.2-3.el9_6.1
- Red Hat Enterprise Linux AppStream EUS (v.9.6) python3.12-wheel-0.41.2-3.el9_6.1
- RHSA-2026:2695 Released 2026-02-12 · Red Hat rating ImportantRHOAI 2.25.2 - Red Hat OpenShift AI
- Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-dashboard-rhel9, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-workflowcontroller-rhel9 +13
- RHSA-2026:2694 Released 2026-02-12 · Red Hat rating ImportantA Subscription Management tool for finding and reporting Red Hat product usage
- Red Hat Discovery 2 registry.redhat.io/discovery/discovery-server-rhel9, registry.redhat.io/discovery/discovery-ui-rhel9
- RHSA-2026:2681 Released 2026-02-12 · Red Hat rating ImportantRed Hat Quay 3.16.2
- Red Hat Quay 3.16 registry.redhat.io/quay/quay-builder-rhel9, registry.redhat.io/quay/quay-rhel9
- RHSA-2026:2675 Released 2026-02-12 · Red Hat rating ImportantRed Hat Developer Hub 1.8.3 release.
- Red Hat Developer Hub 1.8 registry.redhat.io/rhdh/rhdh-hub-rhel9, registry.redhat.io/rhdh/rhdh-rhel9-operator
- RHSA-2026:2139 Released 2026-02-05 · Red Hat rating ImportantRHTAS 1.3.2 - Red Hat Trusted Artifact Signer Release
- Red Hat Trusted Artifact Signer 1.3 registry.redhat.io/rhtas/segment-reporting-rhel9
- RHSA-2026:2106 Released 2026-02-05 · Red Hat rating ImportantRHOAI 2.25.2 - Red Hat OpenShift AI
- Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-caikit-nlp-rhel9, registry.redhat.io/rhoai/odh-caikit-tgis-serving-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9 +47
- RHSA-2026:2090 Released 2026-02-05 · Red Hat rating Importantpython3.12-wheel security update
- Red Hat Enterprise Linux AppStream (v. 8) python3.12-wheel-0.41.2-4.el8_10
- Red Hat Enterprise Linux CRB (v. 8) python3.12-wheel-wheel-0.41.2-4.el8_10
- RHSA-2026:1939 Released 2026-02-04 · Red Hat rating Importantpython3.12-wheel security update
- Red Hat Enterprise Linux AppStream (v. 9) python3.12-wheel-0.41.2-3.el9_7.1
- Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) python3.12-wheel-wheel-0.41.2-3.el9_7.1
- RHSA-2026:1942 Released 2026-02-04 · Red Hat rating ImportantRed Hat Quay 3.15.3
- Red Hat Quay 3.15 registry.redhat.io/quay/quay-rhel8
- RHSA-2026:1902 Released 2026-02-04 · Red Hat rating Importantpython-wheel security update
- Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) python-wheel-1:0.41.2-5.el10_1.1, python3-wheel-1:0.41.2-5.el10_1.1, python3-wheel-wheel-1:0.41.2-5.el10_1.1
- RHSA-2026:1504 Released 2026-01-28 · Red Hat rating Importantsatellite/foreman-mcp-server-rhel9 container image available as a Technology Preview
- Red Hat Satellite 6.18 registry.redhat.io/satellite/foreman-mcp-server-rhel9
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Logging Subsystem for Red Hat OpenShift | Affected | No fix planned: Will not fix |
| Migration Toolkit for Virtualization | Affected | No fix planned: Will not fix |
| OpenShift Lightspeed | Affected | No fix yet |
| Red Hat AI Inference Server | Affected | No fix yet |
| Red Hat Advanced Cluster Security 4 | Affected | No fix planned: Will not fix |
| Red Hat Ansible Automation Platform 2 | Affected | No fix yet |
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet |
| Red Hat OpenShift Dev Spaces | Affected | No fix yet |
| Discovery 2 for RHEL 10 | Fixed | RHSA-2026:2823 |
| Discovery 2 for RHEL 8 | Fixed | RHSA-2026:2823 |
| Discovery 2 for RHEL 9 | Fixed | RHSA-2026:2823 |
| Network Observability (NETOBSERV) 1.11.0 | Fixed | RHSA-2026:2900 |
| Red Hat AI Inference Server 3.2 | Fixed | RHSA-2026:3461, RHSA-2026:3462, RHSA-2026:61628 |
| Red Hat Ansible Automation Platform 2.5 for RHEL 8 | Fixed | RHSA-2026:3959 |
| Red Hat Ansible Automation Platform 2.5 for RHEL 9 | Fixed | RHSA-2026:3959 |
| Red Hat Ansible Automation Platform 2.6 | Fixed | RHSA-2026:13545, RHSA-2026:3960 |
| Red Hat Ansible Automation Platform 2.6 for RHEL 9 | Fixed | RHSA-2026:3958 |
| Red Hat Ceph Storage 8.1 | Fixed | RHSA-2026:62115 |
| Red Hat CodeReady Linux Builder EUS (v.9.4) | Fixed | RHSA-2026:2866 |
| Red Hat CodeReady Linux Builder EUS (v.9.6) | Fixed | RHSA-2026:2710 |
| Red Hat Developer Hub 1.8 | Fixed | RHSA-2026:2675 |
| Red Hat Discovery 2 | Fixed | RHSA-2026:2694 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2026:2090 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2026:1939 |
| Red Hat Enterprise Linux AppStream EUS (v.9.4) | Fixed | RHSA-2026:2866 |
| Red Hat Enterprise Linux AppStream EUS (v.9.6) | Fixed | RHSA-2026:2710 |
| Red Hat Enterprise Linux CRB (v. 8) | Fixed | RHSA-2026:2090 |
| Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) | Fixed | RHSA-2026:1902 |
| Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) | Fixed | RHSA-2026:1939 |
| Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) | Fixed | RHSA-2026:2865 |
| Red Hat OpenShift AI 2.25 | Fixed | RHSA-2026:10184, RHSA-2026:2106, RHSA-2026:2695, RHSA-2026:3782 |
| Red Hat OpenShift AI 3.3 | Fixed | RHSA-2026:19712, RHSA-2026:3713 |
| Red Hat OpenShift AI 3.4 | Fixed | RHSA-2026:5119 |
| Red Hat OpenShift Container Platform 4.16 | Fixed | RHSA-2026:20089 |
| Red Hat OpenShift Container Platform 4.17 | Fixed | RHSA-2026:17599 |
| Red Hat OpenShift Container Platform 4.18 | Fixed | RHSA-2026:6555 |
| Red Hat OpenShift Container Platform 4.19 | Fixed | RHSA-2026:7250 |
| Red Hat OpenShift Container Platform 4.20 | Fixed | RHSA-2026:6565 |
| Red Hat OpenShift Container Platform 4.21 | Fixed | RHSA-2026:6562 |
| Red Hat OpenShift Dev Spaces 3.27 | Fixed | RHSA-2026:6192 |
| Red Hat OpenStack 1.5 | Fixed | RHSA-2026:14020 |
| Red Hat Quay 3.10 | Fixed | RHSA-2026:2762 |
| Red Hat Quay 3.12 | Fixed | RHSA-2026:4942 |
| Red Hat Quay 3.13 | Fixed | RHSA-2026:4185 |
| Red Hat Quay 3.14 | Fixed | RHSA-2026:4215 |
| Red Hat Quay 3.15 | Fixed | RHSA-2026:1942 |
| Red Hat Quay 3.16 | Fixed | RHSA-2026:2681 |
| Red Hat Quay 3.9 | Fixed | RHSA-2026:2754 |
| Red Hat Satellite 6.18 | Fixed | RHSA-2026:1504 |
| Red Hat Trusted Artifact Signer 1.2 | Fixed | RHSA-2026:2925 |
| Red Hat Trusted Artifact Signer 1.3 | Fixed | RHSA-2026:2139, RHSA-2026:4271 |
Not affected: 43 products
- Fence Agents Remediation Operator
- Multicluster Engine for Kubernetes
- Network Observability (NETOBSERV) 1.11.0
- OpenShift Lightspeed
- OpenShift Service Mesh 2
- OpenShift Service Mesh 3
- Red Hat Ansible Automation Platform 2
- Red Hat Ansible Automation Platform 2.5 for RHEL 8
- Red Hat Ansible Automation Platform 2.5 for RHEL 9
- Red Hat Ansible Automation Platform 2.6
- Red Hat Ansible Automation Platform 2.6 for RHEL 10
- Red Hat Ansible Automation Platform 2.6 for RHEL 9
- Red Hat Ansible Automation Platform Ansible Core 2
- Red Hat Ceph Storage 8.1
- Red Hat Developer Hub 1.8
- Red Hat Discovery 2
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat OpenShift AI (RHOAI)
- Red Hat OpenShift AI 2.25
- Red Hat OpenShift AI 3.3
- Red Hat OpenShift AI 3.4
- Red Hat OpenShift Container Platform 4
- Red Hat OpenShift Container Platform 4.16
- Red Hat OpenShift Container Platform 4.17
- Red Hat OpenShift Container Platform 4.18
- Red Hat OpenShift Container Platform 4.19
- Red Hat OpenShift Container Platform 4.20
- Red Hat OpenShift Container Platform 4.21
- Red Hat OpenShift Dev Spaces 3.27
- Red Hat OpenStack 1.5
- Red Hat Quay 3
- Red Hat Quay 3.10
- Red Hat Quay 3.12
- Red Hat Quay 3.13
- Red Hat Quay 3.14
- Red Hat Quay 3.15
- Red Hat Quay 3.16
- Red Hat Quay 3.9
- Red Hat Satellite 6
- Service Telemetry Framework 1.5
Timeline
- 2026-10-02 Threatist record created from CVE-2026-24049
- 2026-10-03 Alias added: GHSA-8rrh-rw8j-w5fx
References
More pypa vulnerabilities
- TI-2025-29803 setuptools has a path traversal vulnerability in PackageIndex.download that leads to Arbitrary File Write CVSS 4.0HIGH 7.7
- TI-2024-05888 Remote Code Execution in pypa/setuptools CVSS 3.0HIGH 8.8
- TI-2026-78525 Shell command injection in virtualenv generated POSIX launchers CVSS 3.1HIGH 7.8
- TI-2026-78526 Command injection in virtualenv bash activation prompt CVSS 4.0HIGH 7.1
- TI-2026-78521 Code injection in virtualenv Xonsh activation script CVSS 4.0HIGH 7.1
- TI-2026-42704 setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) on macOS APFS/HFS+ CVSS 3.1MEDIUM 6.1
Sources
- CVE-2026-24049 · CVE Program
- CVE-2026-24049 · NVD
- FIRST EPSS
- GHSA-8rrh-rw8j-w5fx · GitHub Advisory Database · CC BY 4.0
- CVE-2026-24049 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences