Critical Vulnerability in Python Pulpcore and Yggdrasil Worker Forwarder Packages: Red Hat Security Advisory RHSA-2026:42082
Summary
RHSA-2026:42082: Red Hat Security Advisory: Satellite 6.16.11 Async Update. Affects python-pulpcore versions < 0:3.49.39-2.el8pc. Fixed in 0:3.49.39-2.el8pc. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Python Pulpcore package is a vital component in managing and distributing content in a variety of formats, primarily used in Red Hat Satellite environments. It provides essential functionalities for content management, including repository management and synchronization. The Yggdrasil Worker Forwarder is another crucial package that facilitates the forwarding of worker tasks in the Red Hat Satellite ecosystem. Both packages are integral to the performance and security of the Satellite infrastructure, making them critical to maintain and secure against vulnerabilities.
Vulnerability Detail
The vulnerability identified in the Python Pulpcore and Yggdrasil Worker Forwarder packages stems from several CVEs, including CVE-2026-12701 and CVE-2026-27145. This vulnerability can lead to unauthorized access and potential data breaches, as it allows attackers to exploit weaknesses in the packages. The CVSS score of this vulnerability is 9.0, indicating a critical level of severity. If left unaddressed, this vulnerability could result in significant impacts on system integrity and confidentiality.
How To Fix
Minimum fixed version
0:3.49.39-2.el8pc
This is the first release that contains the fix.
sudo dnf update python-pulpcoreTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not possible, consider implementing network segmentation to limit access to the affected services. Additionally, monitor logs for any suspicious activity that may indicate exploitation attempts.
Conclusion
In summary, the vulnerability in the Python Pulpcore and Yggdrasil Worker Forwarder packages poses a critical risk to Red Hat Satellite environments. It is essential to apply the necessary updates to mitigate this risk and ensure the security of your systems. Regular monitoring and updates are key to maintaining a secure infrastructure.
See every vulnerability recorded for python-pulpcore →
FAQ
The CVSS score of this vulnerability is 9.0, indicating a critical level of severity.
The affected packages include python-pulpcore, python3.11-pulpcore, and yggdrasil-worker-forwarder across both el8 and el9 ecosystems.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability could lead to unauthorized access, data breaches, and significant impacts on system integrity and confidentiality.
It is recommended to check for updates regularly, ideally on a weekly basis, to ensure that all packages are secure and up to date.
Related vulnerabilities
Recent vulnerabilities recorded for python-pulpcore.
