Advisory · CVE-2026-90959
Pulp content upload path traversal can expose the container registry signing key
A path traversal flaw in pulpcore's content upload API lets an authenticated low-privilege user read any file the Pulp server can access; deployments with Pulp Container risk exposure of the token signing private key and forged access to all private container repositories.
- Vendor
- Red Hat
- Product
- pulpcore
- Identifier / CWE
- CVE-2026-90959
CWE-22 - Action timing
- Immediate
Explain it like I’m five
Pulp downloads files for you, but it checks the address with a sloppy rule: it only blocks addresses starting with 'file://'. The attacker uses 'file:' without the slashes, slips past the guard, and asks the server to hand over any file on its disk, including the key that signs registry access tokens.
- 01Upload API call
An authenticated user with low-privilege repository permissions calls the content upload API with a file_url parameter.
- 02Weak scheme check
URL validation uses a string prefix comparison that rejects only URLs beginning with 'file://', while Python's URL parser accepts the 'file:' scheme without double slashes.
- 03Path traversal
The attacker supplies a crafted URL with relative path traversal sequences that pass validation and reach the file downloader.
- 04Arbitrary file read
Pulp downloads and stores any file accessible to the Pulp server process and returns its content.
- 05Key exposure
In deployments with Pulp Container, the attacker reads the container registry token signing private key and forges Bearer tokens, gaining access to all private container repositories.
What happened
A path traversal vulnerability was found in pulpcore, the open-source repository management platform that backs Red Hat Satellite content services and Ansible Automation Platform. The content upload API accepts a file_url parameter so Pulp can fetch and store remote files. The URL scheme validation uses a string prefix comparison that rejects only URLs beginning with ‘file://’, but Python’s URL parser recognizes the ‘file:’ scheme without double slashes, so a crafted URL sails past the check and reaches the file downloader.
An authenticated user with low-privilege repository permissions can use relative path traversal sequences to read any file accessible to the Pulp server process. Where Pulp Container is deployed, the prize is the container registry token signing private key: with it, the attacker forges Bearer tokens and gains unauthorized access to every private container repository in the registry. The issue is rated high at CVSS 8.1.
What to do
- Identify pulpcore deployments, including those bundled with Red Hat Ansible Automation Platform 2, Red Hat Satellite 6, and Red Hat Update Infrastructure.
- Apply the fixed pulpcore packages for the affected platforms using Red Hat’s guidance.
- Restrict repository permissions to trusted users until patched.
- Review upload API logs for file_url values using the ‘file:’ scheme or path traversal sequences.
- If Pulp Container was deployed with an unpatched pulpcore, treat the registry token signing key as compromised: rotate it and re-issue registry tokens.
- Audit private container repositories for unauthorized pulls or pushes.
Management note
The damage here is not the file read, it is what the file read unlocks. A single low-privilege repository user reaching the token signing key turns into full private registry access, silently. Patching the traversal is step one; rotating the signing key and auditing registry access are the steps that actually close the blast radius.