Expression Language Injection Vulnerability in Pulpcore by Red Hat
CVE-2026-123084

6.5MEDIUM

Key Information:

Vendor

Red Hat
Status
Red Hat Ansible Automation Platform 2
Red Hat Satellite 6
Red Hat Update Infrastructure 4 For Cloud Providers
Red Hat Update Infrastructure 5
Vendor
CVE Published:
10 November 2026

What is CVE-2026-123084?

An expression language injection vulnerability exists in the HeaderContentGuard.permit function within pulpcore's publication.py. This security flaw allows low-privileged attackers to manipulate the request header, potentially leading to unauthorized access to sensitive information stored in the environment of the content process. By exploiting this vulnerability, an attacker can execute a jq filter that reveals critical settings such as the Django secret key and database passwords, dramatically increasing the risk of data exposure and system compromise.

References

https://access.redhat.com/security/cve/CVE-2026-123084
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2567260
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank Zachariah Mithani (AploSec) for reporting this issue.
.