CVE-2026-90959

Red Hat Ansible Automation Platform: Mehrere Schwachstellen

Debian Linux, Red Hat Enterprise Linux, IBM QRadar SIEM, RESF Rocky Linux, SUSE Linux, SUSE openSUSE, Oracle Linux, Red…

A path traversal vulnerability was found in pulpcore. The content upload API accepts a 'file_url' parameter that allows users with file repository privileges to specify a local file URL for Pulp to download and store. A URL scheme validation check uses a string prefix comparison that only rejects URLs beginning with 'file://', but Python's URL parser recognizes the 'file:' scheme without double slashes, creating a mismatch between what is validated and what is dispatched to…

24. Sep 2026

Ausgewertete Quellen

• Red Hat
  https://access.redhat.com/errata/RHSA-2026:100120
• Red Hat
  https://access.redhat.com/errata/RHSA-2026:87004
• Red Hat
  https://access.redhat.com/errata/RHSA-2026:87120
• Red Hat
  https://access.redhat.com/errata/RHSA-2026:87124
• Red Hat
  https://access.redhat.com/errata/RHSA-2026:99949
• Red Hat
  https://access.redhat.com/errata/RHSA-2026:99950
• Red Hat
  https://access.redhat.com/errata/RHSA-2026:99952
• Red Hat
  https://access.redhat.com/security/cve/CVE-2026-90959
• Red Hat
  https://bugzilla.redhat.com/show_bug.cgi?id=2533037
• CERT-Bund
  WID-SEC-2026-4111
• NVD
  CVE-2026-90959