--- id: CVE-2026-28684 title: >- python-dotenv: python-dotenv: Arbitrary file overwrite via symbolic link following (CVE-2026-28684) summary: >- A flaw was found in python-dotenv. A local attacker can exploit this by crafting a symbolic link, which the `set_key()` and `unset_key()` functions in python-dotenv follow when rewriting `.env` files. This can lead to the overwriting of ar… severity: high cvss: 7.1 cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H' cvssSource: vendor cwe: CWE-59 vendor: Red Hat product: Red Hat OpenShift AI 3.3 affected: - lightspeed_core - openshift_lightspeed - ai_inference_server - ansible_automation_platform 2 - enterprise_linux_ai_rhel_ai 3 - openshift_ai_rhoai - satellite 6 - ai_inference_server 3.2 - ansible_automation_platform 2.6 - migration_toolkit_for_applications 8.2 - openshift_ai 2.25 - openshift_ai 3.3 - satellite 6.18 patched: - ai_inference_server 3.2 - ansible_automation_platform 2.6 - migration_toolkit_for_applications 8.2 - openshift_ai 2.25 - openshift_ai 3.3 - satellite 6.18 published: '2026-04-20' updated: '2026-10-15' sourceUpdated: '2026-10-15T11:34:44+00:00' source: CSAF sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28684.json' references: - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28684.json - url: 'https://access.redhat.com/security/cve/CVE-2026-28684' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2459798' - url: 'https://www.cve.org/CVERecord?id=CVE-2026-28684' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-28684' - url: >- https://github.com/theskumar/python-dotenv/commit/790c5c02991100aa1bf41ee5330aca75edc51311 - url: 'https://github.com/theskumar/python-dotenv/releases/tag/v1.2.2' - url: >- https://github.com/theskumar/python-dotenv/security/advisories/GHSA-mf9w-mj56-hr94 - url: 'https://access.redhat.com/errata/RHSA-2026:61628' - url: 'https://access.redhat.com/errata/RHSA-2026:24866' - url: 'https://access.redhat.com/errata/RHSA-2026:43038' - url: 'https://access.redhat.com/errata/RHSA-2026:42644' - url: 'https://access.redhat.com/errata/RHSA-2026:24977' - url: 'https://access.redhat.com/errata/RHSA-2026:19712' - url: 'https://access.redhat.com/errata/RHSA-2026:73987' - url: 'https://access.redhat.com/errata/RHSA-2026:37275' - url: 'https://access.redhat.com/errata/RHSA-2026:26226' - url: >- https://github.com/theskumar/python-dotenv/commit/790c5c02991100aa1bf41ee5330aca75edc51311.patch - url: 'https://github.com/theskumar/python-dotenv' tags: - csaf - vex - red-hat - osv - pip epss: 0.00252 epssPercentile: 0.16628 aliases: - GHSA-mf9w-mj56-hr94 - PYSEC-2026-2270 ecosystem: pip scores: vendor: 7.1 osv: 6.6 ingestedAt: '2026-07-13T18:58:00.624Z' --- ## Overview A flaw was found in python-dotenv. A local attacker can exploit this by crafting a symbolic link, which the `set_key()` and `unset_key()` functions in python-dotenv follow when rewriting `.env` files. This can lead to the overwriting of arbitrary files on the system. ## Vendor advisories - **RHSA-2026:61628** · Red Hat · fixed in: Red Hat AI Inference Server 3.2 · released 2026-08-31 · [advisory](https://access.redhat.com/errata/RHSA-2026:61628) - **RHSA-2026:24866** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.6 · released 2026-06-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:24866) - **RHSA-2026:43038** · Red Hat · fixed in: Red Hat Migration Toolkit for Applications 8.2 · released 2026-07-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:43038) - **RHSA-2026:42644** · Red Hat · fixed in: Red Hat OpenShift AI 2.25 · released 2026-07-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:42644) - **RHSA-2026:24977** · Red Hat · fixed in: Red Hat OpenShift AI 2.25 · released 2026-06-10 · [advisory](https://access.redhat.com/errata/RHSA-2026:24977) - **RHSA-2026:19712** · Red Hat · fixed in: Red Hat OpenShift AI 3.3 · released 2026-05-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:19712) - **RHSA-2026:73987** · Red Hat · fixed in: Red Hat OpenShift AI 3.3 · released 2026-09-30 · [advisory](https://access.redhat.com/errata/RHSA-2026:73987) - **RHSA-2026:37275** · Red Hat · fixed in: Red Hat OpenShift AI 3.3 · released 2026-07-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:37275) - **RHSA-2026:26226** · Red Hat · fixed in: Red Hat Satellite 6.18 · released 2026-06-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:26226) - **Red Hat VEX** · Moderate · affected: Lightspeed Core, OpenShift Lightspeed, Red Hat AI Inference Server, Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI), … · no fix planned: Red Hat AI Inference Server, Red Hat Ansible Automation Platform 2, Red Hat Satellite 6, Lightspeed Core, … · updated 2026-10-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28684.json) **python-dotenv: python-dotenv: Arbitrary file overwrite via symbolic link following** — rated Moderate by Red Hat. Released 2026-04-20, updated 2026-10-15. Affected: - Lightspeed Core - OpenShift Lightspeed - Red Hat AI Inference Server - Red Hat Ansible Automation Platform 2 - Red Hat Enterprise Linux AI (RHEL AI) 3 - Red Hat OpenShift AI (RHOAI) - Red Hat Satellite 6 Fixed: - Red Hat AI Inference Server 3.2 - Red Hat Ansible Automation Platform 2.6 - Red Hat Migration Toolkit for Applications 8.2 - Red Hat OpenShift AI 2.25 - Red Hat OpenShift AI 3.3 - Red Hat Satellite 6.18 No fix planned: - Red Hat AI Inference Server - Red Hat Ansible Automation Platform 2 - Red Hat Satellite 6 - Lightspeed Core - OpenShift Lightspeed - Red Hat Enterprise Linux AI (RHEL AI) 3 - Red Hat OpenShift AI (RHOAI) Not affected: - Red Hat Ansible Automation Platform 2.6 - Red Hat Migration Toolkit for Applications 8.2 - Red Hat OpenShift AI 2.25 - Red Hat OpenShift AI 3.3 - OpenShift Lightspeed - Red Hat OpenShift AI (RHOAI) ## Remediation For more information visit https://access.redhat.com/errata/RHSA-2026:61628 https://access.redhat.com/errata/RHSA-2026:61628 Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.6#Upgrade https://access.redhat.com/errata/RHSA-2026:24866 Before applying this update, make sure all previously released errata relevant to your system have been applied. https://access.redhat.com/errata/RHSA-2026:43038 Workarounds / mitigations: - Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. ## Package advisory (CVE-2026-28684) Affected packages: - `python-dotenv < 1.2.2` Patched in: - `python-dotenv 1.2.2` Source: https://osv.dev/vulnerability/GHSA-mf9w-mj56-hr94