Read the docs
TI-2026-76862 Aliases CVE-2026-112940GHSA-v4x8-3wr5-3wq8

Symlink race in filelock ReadWriteLock lets attackers overwrite files

Priority MEDIUM 64CWE-363Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · High
Fix status
Partial Red Hat: 3 fixed, 13 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

The filelock Python package from 3.20.4 before 4.2.1 is affected. ReadWriteLock reopens its SQLite database and side files by name, which causes a link resolution race (CWE-59). On POSIX systems, a local attacker with rename access in a non-sticky parent directory can swap those names so overwrite or unlink operations hit other files, and attacker-chosen content also needs a writable adjacent hot journal. A public exploit is linked in the references.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Description from the CNA

filelock is a platform-independent file lock for Python. From 3.20.4 until 4.2.1, ReadWriteLock let SQLite reopen the database and side files by name; on POSIX systems an attacker with rename access in a non-sticky parent can swap those names to cause overwrite or unlink operations, while a writable adjacent hot journal is additionally required for attacker-chosen content overwrites. This issue is fixed in version 4.2.1.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0019 8th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial filelock (tox-dev): 4.2.1filelock (PyPI): 4.2.1Red Hat: 8 advisoriesRed Hat: 3 fixed, 13 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
tox-devfilelock3.20.4 to before 4.2.14.2.1Patch availableCNA
—filelock (PyPI)3.20.4 to before 4.2.14.2.1Patch availableGHSA-v4x8-3wr5-3wq8
  • filelock Vendortox-dev Affected 3.20.4 to before 4.2.1 Fixed in 4.2.1 Patch available CNA
  • filelock (PyPI) Vendor— Affected 3.20.4 to before 4.2.1 Fixed in 4.2.1 Patch available GHSA-v4x8-3wr5-3wq8

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:tox-dev:filelock:*:*:*:*:*:python:*:*3.20.4 to before 4.2.1Vulnerabletox-dev
  • cpe:2.3:a:tox-dev:filelock:*:*:*:*:*:python:*:* Versions 3.20.4 to before 4.2.1 Vulnerable ·tox-dev

Remediation

Upgrade filelock to version 4.2.1, which fixes it in Red Hat AI Inference Server 3.5, Red Hat OpenShift AI 3.4 and Red Hat OpenShift AI 3.5 through RHSA-2026:94738, RHSA-2026:94721, RHSA-2026:94717, RHSA-2026:94715, RHSA-2026:94709, RHSA-2026:94702, RHSA-2026:94631 and RHSA-2026:92510. Red Hat plans no fix for Red Hat AI Inference Server. The sources list no fixed version for the other affected products.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

  • Fix · CNA filelock (tox-dev) Fixed in 4.2.1
  • Fix · GHSA-v4x8-3wr5-3wq8 filelock (PyPI) Fixed in 4.2.1 Advisory →

Red Hat 8 advisories

  • RHSA-2026:94738 Released 2026-11-03 · Red Hat rating Critical
    Red Hat AI Inference 3.5.3 (CUDA)
    • Red Hat AI Inference Server 3.5 registry.redhat.io/rhaii/vllm-cuda-rhel9
  • RHSA-2026:94721 Released 2026-11-03 · Red Hat rating Critical
    Red Hat AI Inference Tech Preview 3.5.3 (Gaudi)
    • Red Hat AI Inference Server 3.5 registry.redhat.io/rhaii/vllm-gaudi-rhel9
  • RHSA-2026:94717 Released 2026-11-03 · Red Hat rating Critical
    Red Hat AI Inference 3.5.3 (Spyre)
    • Red Hat AI Inference Server 3.5 registry.redhat.io/rhaii/vllm-spyre-rhel9
Show 5 more Red Hat advisories
  • RHSA-2026:94715 Released 2026-11-03 · Red Hat rating Critical
    Red Hat AI Inference Model Optimization Tools 3.5.3 (CUDA)
    • Red Hat AI Inference Server 3.5 registry.redhat.io/rhaii/model-opt-cuda-rhel9
  • RHSA-2026:94709 Released 2026-11-03 · Red Hat rating Critical
    Red Hat AI Inference 3.5.3 (ROCm)
    • Red Hat AI Inference Server 3.5 registry.redhat.io/rhaii/vllm-rocm-rhel9
  • RHSA-2026:94702 Released 2026-11-03 · Red Hat rating Critical
    Red Hat AI Inference 3.5.3 (CPU)
    • Red Hat AI Inference Server 3.5 registry.redhat.io/rhaii/vllm-cpu-rhel9
  • RHSA-2026:94631 Released 2026-11-03 · Red Hat rating Critical
    GuideLLM 3.5.1
    • Red Hat OpenShift AI 3.5 registry.redhat.io/rhai/guidellm-rhel9
  • RHSA-2026:92510 Released 2026-10-29 · Red Hat rating Critical
    RHOAI 3.4.6 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-cli-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9 +47

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Ansible Automation Orchestrator 2026AffectedNo fix yet
Exploit IntelligenceAffectedNo fix planned: Out of support scope
Lightspeed CoreAffectedNo fix yet
Lightspeed Services for Advanced Cluster ManagementAffectedNo fix yet
OpenShift LightspeedAffectedNo fix yet
Red Hat AI Inference ServerAffectedNo fix planned: Will not fix
Red Hat Ansible Automation Platform 2AffectedNo fix yet
Red Hat Ansible Automation Platform Ansible Core 2AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux AI (RHEL AI) 3AffectedNo fix yet
Red Hat Lightspeed Services for OCPAffectedNo fix yet
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet
Red Hat OpenShift Dev SpacesAffectedNo fix yet
Red Hat Satellite 6AffectedNo fix yet
Red Hat AI Inference Server 3.5Fixed RHSA-2026:94702, RHSA-2026:94709, RHSA-2026:94715, RHSA-2026:94717, RHSA-2026:94721, RHSA-2026:94738
Red Hat OpenShift AI 3.4Fixed RHSA-2026:92510
Red Hat OpenShift AI 3.5Fixed RHSA-2026:94631
Not affected: 6 products
  • Pen Drive Powered by Red Hat Lightspeed
  • Red Hat Ansible Automation Platform 2
  • Red Hat Ansible Automation Platform Ansible Core 2
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift AI 3.4
  • Red Hat OpenShift Container Platform 4

Timeline

  1. 2026-10-20 Threatist record created from CVE-2026-112940
  2. 2026-10-21 Affected versions changed · Red Hat
  3. 2026-10-21 CVSS score added · Red Hat
  4. 2026-10-21 Weakness changed · NVD
  5. 2026-10-22 Priority changed: MEDIUM → LOW
  6. 2026-10-22 Affected versions changed · Red Hat
  7. 2026-10-23 CISA SSVC decision points changed
  8. 2026-10-23 Priority changed: LOW → MEDIUM
  9. 2026-10-23 Affected versions changed · Red Hat
  10. 2026-10-23 Alias added: GHSA-v4x8-3wr5-3wq8
  11. 2026-10-23 Fix available: PyPI/[email protected] · GHSA-v4x8-3wr5-3wq8
  12. 2026-10-23 CVSS score added · GHSA-v4x8-3wr5-3wq8
  13. 2026-10-23 Weakness changed · GHSA-v4x8-3wr5-3wq8
  14. 2026-10-23 6 new references · GHSA-v4x8-3wr5-3wq8
  15. 2026-10-30 Fix available: RHSA-2026:92510 · Red Hat
  16. 2026-10-30 Fix available: Red Hat OpenShift AI 3.4 · Red Hat
  17. 2026-11-03 Affected versions changed · Red Hat
  18. 2026-11-04 Fix available: RHSA-2026:94717 · Red Hat
  19. 2026-11-04 Fix available: RHSA-2026:94715 · Red Hat
  20. 2026-11-04 Fix available: RHSA-2026:94709 · Red Hat
  21. 2026-11-04 Fix available: RHSA-2026:94738 · Red Hat
  22. 2026-11-04 Fix available: RHSA-2026:94702 · Red Hat
  23. 2026-11-04 Fix available: RHSA-2026:94631 · Red Hat
  24. 2026-11-04 Fix available: RHSA-2026:94721 · Red Hat
  25. 2026-11-04 Fix available: Red Hat AI Inference Server 3.5, Red Hat OpenShift AI 3.5 · Red Hat

References

Exploit 1

Patch 2

Advisory 1

Other 2

  • TI-2026-76853 filelock soft locks adopt directories created by other local users CVSS 3.1MEDIUM 6.3
  • TI-2026-76859 Symlink following in filelock ReadWriteLock redirects SQLite database CVSS 3.1MEDIUM 6.1
  • TI-2026-76857 Unsafe holder record refresh in filelock SoftReadWriteLock CVSS 3.1MEDIUM 6.1
  • TI-2026-76852 filelock UnixFileLock truncates files placed on the lock path CVSS 3.1MEDIUM 6.1
  • TI-2026-76856 Crafted lock database makes filelock ReadWriteLock acquisitions hang CVSS 3.1MEDIUM 5.5
  • TI-2026-76861 SoftFileLock in filelock trusts forged PIDs and removes live markers CVSS 3.1MEDIUM 4.7
See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences