High · CVSS 8.8CVE-2026-18379

Yggdrasil-worker-package-manager: yggdrasil-worker-package-manager: path traversal via unsanitized repo name in addrepo/removerepoCVE-2026-18379

Answer in brief

CVE-2026-18379 records a High severity (CVSS 8.8) vulnerability in Yggdrasil-worker-package-manager: yggdrasil-worker-package-manager: path traversal via unsanitized repo name in addrepo/removerepo. The current sources do not mark it as known exploited. The current feed maps Red Hat/yggdrasil-worker-package-manager (generic). Check affected ranges and fixed versions before updating.

Analysis pending evidence review

HOL Guard separates source facts from reviewed analysis. See the methodology.

Published Nov 12, 2026Updated Nov 12, 2026Source checked Nov 12, 2026First seen by HOL Nov 12, 2026Material review Nov 12, 2026

Upstream Advisory

Key facts

Risk: High · CVSS 8.8
Exploitation: Not marked as known exploited
Affected software: 1 mapped package or product
Fix availability: Not reported

Why this deserves its current priority

CVSS is 8.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps Red Hat/yggdrasil-worker-package-manager (generic). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
Red Hat/yggdrasil-worker-package-managergeneric	*	Not reported

Recommended response

Check inventory. Check lockfiles and deployed manifests for Red Hat/yggdrasil-worker-package-manager.
Review the reported fix. Source-reported workaround: --- CME Mitigation Guidance (2026-11-06) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure. The highest-value action is to sanitize repository names and enforce directory boundary validation to prevent traversal sequences from escaping /etc/yum.repos.d/ during file creation and deletion: upgrade to the fixed Yggdrasil Worker Package Manager builds, which apply the documented input check, closing crafted repository names containing directory traversal sequences. Until patched, this is a concern on Linux hosts running yggdrasil-worker-package-manager as root, so Restrict and audit authenticated access to dispatch directives through the management message broker to prevent malformed repository names from reaching the root worker. As a compensating measure, Configure auditd to log file creation, modification, and deletion syscalls initiated by the root worker across monitored system paths, Run SELinux in enforcing mode to confine the worker daemon and prevent writing or deleting files outside repository configuration file types, Deploy an EDR agent to monitor endpoint behavior and detect unauthorized file drops or suspicious cron and system modifications, Use Falco or eBPF runtime security to detect anomalous file write or unlink operations executed by the worker outside /etc/yum.repos.d/, and Deploy AIDE or file integrity monitoring to detect unauthorized modifications or deletions of critical system configuration files. These controls limit blast radius and contain exploitation, but they do not fix the underlying path-traversal defect — apply the upstream patch to fully remediate. Highest-impact CME: CME-1301 Path Traversal Prevention (Canonicalization) (high)

Evidence timeline and material changes

Published upstream
Nov 12, 2026
Evidence: source:cvelist:source_dates:source-dates:record
Source modified
Nov 12, 2026
Evidence: source:cvelist:source_dates:source-dates:record
First seen by HOL
Nov 12, 2026

Sources and claim methodology

Upstream source description

A flaw was found in yggdrasil-worker-package-manager. An authenticated attacker can exploit this issue to achieve arbitrary file modification or potential privilege escalation. The vulnerability exists because repository management operations fail to sanitize directory traversal sequences (such as '../') within repository names. By supplying a crafted repository name, an attacker can manipulate the root-level worker process into creating or deleting files outside the intended directory, compromising host system integrity.

Quoted source text, attributed separately from HOL analysis.

Elasticsearch data source resource proxy allows arbitrary methods and paths with the data source's credentialsAlso CWE-22