CVE-2026-909598.1HighCWE-22

CVE-2026-90959: Pulpcore: file:// scheme allowlist bypass in content upload file_url field enables arbitrary file read and pulp container registry signing key theft

Red Hat · Red Hat Ansible Automation Platform 2.6 for RHEL 9

Vendor fix available · Affected: Red Hat Ansible Automation Platform 2.6 for RHEL 9 · Exploitation: unlikely (under 1%)

Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.

0.5%probability of exploitation in the next 30 days

40th percentile

050100

Higher than 40% of scored CVEs

8.1HighCVSS 3.1

LowMediumHighCrit.

DescriptionCVE.org

A path traversal vulnerability was found in pulpcore. The content upload API accepts a 'file_url' parameter that allows users with file repository privileges to specify a local file URL for Pulp to download and store. A URL scheme validation check uses a string prefix comparison that only rejects URLs beginning with 'file://', but Python's URL parser recognizes the 'file:' scheme without double slashes, creating a mismatch between what is validated and what is dispatched to the file downloader. An authenticated user with low-privilege repository permissions can supply a specially crafted URL using relative path traversal sequences to read any file accessible to the Pulp server process. In deployments that include Pulp Container, successful exploitation allows an attacker to read the container registry token signing private key and forge bearer tokens, granting unauthorized access to all private container repositories in the affected registry.

Affected products20

From the CVE record. A product or version that is not listed is unknown, not unaffected.

Red Hat · Red Hat Ansible Automation Platform 2.6 for RHEL 9Versions not stated
Red Hat · Red Hat Satellite 6.16 for RHEL 8Versions not stated
Red Hat · Red Hat Satellite 6.16 for RHEL 8Versions not stated
Red Hat · Red Hat Satellite 6.16 for RHEL 9Versions not stated
Red Hat · Red Hat Satellite 6.16 for RHEL 9Versions not stated
Red Hat · Red Hat Satellite 6.17 for RHEL 9Versions not stated
Red Hat · Red Hat Satellite 6.17 for RHEL 9Versions not stated
Red Hat · Red Hat Satellite 6.18 for RHEL 9Versions not stated
Red Hat · Red Hat Satellite 6.18 for RHEL 9Versions not stated
Red Hat · Red Hat Satellite 6.19 for RHEL 9Versions not stated
Red Hat · Red Hat Satellite 6.19 for RHEL 9Versions not stated
Red Hat · Red Hat Ansible Automation Platform 2.6Versions not stated
Red Hat · Red Hat Ansible Automation Platform 2.7Versions not stated
Red Hat · Red Hat Ansible Automation Platform 2Versions not stated
Red Hat · Red Hat Ansible Automation Platform 2Versions not stated
Red Hat · Red Hat Ansible Automation Platform 2Versions not stated
Red Hat · Red Hat Ansible Automation Platform 2Versions not stated
Red Hat · Red Hat Ansible Automation Platform 2Versions not stated
Red Hat · Red Hat Ansible Automation Platform 2Versions not stated
Red Hat · Red Hat Satellite 6Versions not stated

On the Atlas

Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.

Open the Atlas

Exploitation: Unlikely (under 1%). EPSS under 1%, or no score yet.
CISA KEV: Not listed
Public check: No public nuclei template
Weakness: Path Traversal · File and Path Handling
Vendor: Red Hat
Published: September 2026
Band: Unlikely (under 1%), September 2026

CoverageNo articles yet

No CyberSIXT article names CVE-2026-90959 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.