CVE-2026-112210Medium· 6.0▾ SunlitA flaw was found in the rhc-canonical-facts.service systemd unit shipped with rhc. The service runs as root and operates on a file inside a directory owned by an unprivileged system user without verifying that the file is not a symbolic …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 33 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Oct 21.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.1%
A flaw was found in the rhc-canonical-facts.service systemd unit shipped with rhc. The service runs as root and operates on a file inside a directory owned by an unprivileged system user without verifying that the file is not a symbolic link. A local attacker who has already compromised the privileged yggdrasil system service account can exploit this to gain ownership of arbitrary files, leading to privilege escalation to root.
rhc (all versions)rhcrhcrhcRefer to the linked advisories for vendor-supplied fixes and affected version ranges.
Disable the rhc-canonical-facts timer to prevent automatic triggering of the vulnerable service:
systemctl stop rhc-canonical-facts.timer
systemctl disable rhc-canonical-facts.timer
Note that this will prevent rhc from updating canonical facts automatically. The rhc connect command will still trigger the service manually.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-115378Medium· 5.8github.com/lxc/incus: Incus: Arbitrary file write on the host via recursive file pull (CVE-2026-115378)
CVE-2026-108119Medium· 6.3A flaw was found in busybox
CVE-2024-1753High· 8.6A flaw was found in Buildah (and subsequently Podman Build) which allows containers to mount arbitrary locations on the host filesystem into build containers
CVE-2026-117574Critical· 9.1Ai-gateway-payload-processing: ai-gateway-payload-processing: tenant/credential selection from client-controlled url path with no in-process authorization
CVE-2026-13451High· 7.7Kserve: kserve: server-side request forgery via malicious storageuri
CVE-2026-84725High· 8.1Openjdk-orb: incomplete fix for cve-2026-15560,unauthed class loading via iiop in eap