{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-112210", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "PUBLISHED", "assignerShortName": "redhat", "dateReserved": "2026-10-19T10:20:51.005Z", "datePublished": "2026-10-19T11:39:13.590Z", "dateUpdated": "2026-10-19T11:39:13.590Z"}, "containers": {"cna": {"title": "Rhc: rhc: local privilege escalation via symlink following in rhc-canonical-facts.service", "metrics": [{"other": {"content": {"value": "Moderate", "namespace": "https://access.redhat.com/security/updates/classification/"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 6, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}, "format": "CVSS"}], "descriptions": [{"lang": "en", "value": "A flaw was found in the rhc-canonical-facts.service systemd unit shipped with rhc. The service runs as root and operates on a file inside a directory owned by an unprivileged system user without verifying that the file is not a symbolic link. A local attacker who has already compromised the privileged yggdrasil system service account can exploit this to gain ownership of arbitrary files, leading to privilege escalation to root."}], "affected": [{"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhc", "defaultStatus": "affected", "cpes": ["cpe:/o:redhat:enterprise_linux:10"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 7", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhc", "defaultStatus": "unaffected", "cpes": ["cpe:/o:redhat:enterprise_linux:7"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhc", "defaultStatus": "unaffected", "cpes": ["cpe:/o:redhat:enterprise_linux:8"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhc", "defaultStatus": "unaffected", "cpes": ["cpe:/o:redhat:enterprise_linux:9"]}], "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-112210", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555474", "name": "RHBZ#2555474", "tags": ["issue-tracking", "x_refsource_REDHAT"]}, {"url": "https://github.com/RedHatInsights/rhc/blob/51928db/data/systemd/rhc-canonical-facts.service"}], "datePublic": "2026-10-15T21:55:33.000Z", "problemTypes": [{"descriptions": [{"cweId": "CWE-59", "description": "Improper Link Resolution Before File Access ('Link Following')", "lang": "en", "type": "CWE"}]}], "x_redhatCweChain": "CWE-59: Improper Link Resolution Before File Access ('Link Following')", "workarounds": [{"lang": "en", "value": "Disable the rhc-canonical-facts timer to prevent automatic triggering of the vulnerable service:\n\n systemctl stop rhc-canonical-facts.timer\n systemctl disable rhc-canonical-facts.timer\n\nNote that this will prevent rhc from updating canonical facts automatically. The rhc connect command will still trigger the service manually."}], "timeline": [{"lang": "en", "time": "2026-10-15T21:55:33.000Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-10-15T21:55:33.000Z", "value": "Made public."}], "credits": [{"lang": "en", "value": "Red Hat would like to thank D.M Sithum Vihanga for reporting this issue."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-10-19T11:39:13.590Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}}}

{}

{"affected": [{"affectedData": [{"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:10"], "defaultStatus": "affected", "packageName": "rhc", "product": "Red Hat Enterprise Linux 10", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:7"], "defaultStatus": "unaffected", "packageName": "rhc", "product": "Red Hat Enterprise Linux 7", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:8"], "defaultStatus": "unaffected", "packageName": "rhc", "product": "Red Hat Enterprise Linux 8", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:9"], "defaultStatus": "unaffected", "packageName": "rhc", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat"}], "source": "secalert@redhat.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A flaw was found in the rhc-canonical-facts.service systemd unit shipped with rhc. The service runs as root and operates on a file inside a directory owned by an unprivileged system user without verifying that the file is not a symbolic link. A local attacker who has already compromised the privileged yggdrasil system service account can exploit this to gain ownership of arbitrary files, leading to privilege escalation to root."}], "id": "CVE-2026-112210", "lastModified": "2026-10-19T12:17:01.910", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 6.0, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 0.8, "impactScore": 5.2, "source": "secalert@redhat.com", "type": "Primary"}]}, "published": "2026-10-19T12:17:01.910", "references": [{"source": "secalert@redhat.com", "url": "https://access.redhat.com/security/cve/CVE-2026-112210"}, {"source": "secalert@redhat.com", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555474"}, {"source": "secalert@redhat.com", "url": "https://github.com/RedHatInsights/rhc/blob/51928db/data/systemd/rhc-canonical-facts.service"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-59"}], "source": "secalert@redhat.com", "type": "Primary"}]}

{"acknowledgement": "Red Hat would like to thank D.M Sithum Vihanga for reporting this issue.", "bugzilla": {"description": "rhc: rhc: local privilege escalation via symlink following in rhc-canonical-facts.service", "id": "2555474", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555474"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H", "status": "draft"}, "cwe": "CWE-59", "details": ["A flaw was found in the rhc-canonical-facts.service systemd unit shipped with rhc. The service runs as root and operates on a file inside a directory owned by an unprivileged system user without verifying that the file is not a symbolic link. A local attacker who has already compromised the privileged yggdrasil system service account can exploit this to gain ownership of arbitrary files, leading to privilege escalation to root."], "mitigation": {"lang": "en:us", "value": "Disable the rhc-canonical-facts timer to prevent automatic triggering of the vulnerable service:\nsystemctl stop rhc-canonical-facts.timer\nsystemctl disable rhc-canonical-facts.timer\nNote that this will prevent rhc from updating canonical facts automatically. The rhc connect command will still trigger the service manually."}, "name": "CVE-2026-112210", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "rhc", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "rhc", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "rhc", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "rhc", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-10-15T21:55:33Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-112210\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-112210\nhttps://github.com/RedHatInsights/rhc/blob/51928db/data/systemd/rhc-canonical-facts.service"], "statement": "This vulnerability is rated Moderate because exploitation requires prior compromise of the yggdrasil system service account, which is not directly accessible to unprivileged users. Additionally, SELinux in Enforcing mode limits the set of files reachable through the full exploit chain. Versions of rhc prior to 0.3.0 (shipped in RHEL 7, 8, and 9) do not include the vulnerable service file and are not affected.", "threat_severity": "Moderate"}

{"created": "2026-10-19T12:30:14.212361+00:00", "updated": "2026-10-19T12:30:14.212374+00:00", "vendors": []}