CVE-2026-18379 Yggdrasil-worker-package-manager: yggdrasil-worker-package-manager: path traversal via unsanitized repo name in addrepo/removerepo

Red Hat rates this vulnerability as Moderate impact because successful exploitation relies on dispatching malformed directives through the message broker, which requires prior access to the management control plane. Although the package manager worker executes with root privileges and could permit unauthorized file modifications or deletions outside the designated repository directory, it cannot be invoked directly by unauthenticated remote actors. In standard deployments, risk is constrained to systems connected to a compromised or untrusted broker infrastructure.

--- CME Mitigation Guidance (2026-11-06) ---

Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.

The highest-value action is to sanitize repository names and enforce directory boundary validation to prevent traversal sequences from escaping /etc/yum.repos.d/ during file creation and deletion: upgrade to the fixed Yggdrasil Worker Package Manager builds, which apply the documented input check, closing crafted repository names containing directory traversal sequences. Until patched, this is a concern on Linux hosts running yggdrasil-worker-package-manager as root, so Restrict and audit authenticated access to dispatch directives through the management message broker to prevent malformed repository names from reaching the root worker. As a compensating measure, Configure auditd to log file creation, modification, and deletion syscalls initiated by the root worker across monitored system paths, Run SELinux in enforcing mode to confine the worker daemon and prevent writing or deleting files outside repository configuration file types, Deploy an EDR agent to monitor endpoint behavior and detect unauthorized file drops or suspicious cron and system modifications, Use Falco or eBPF runtime security to detect anomalous file write or unlink operations executed by the worker outside /etc/yum.repos.d/, and Deploy AIDE or file integrity monitoring to detect unauthorized modifications or deletions of critical system configuration files. These controls limit blast radius and contain exploitation, but they do not fix the underlying path-traversal defect — apply the upstream patch to fully remediate.

Highest-impact CME: CME-1301 Path Traversal Prevention (Canonicalization) (high)