CVE-2026-103868— Pulp-container: registry credentials are reused across remotes in a worker
Quick assessment
Affected
Red Hat Red Hat Ansible Automation Platform 2
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 pulp-container 中发现了在认证上游注册表时存在的一个漏洞。当执行后续下载任务时，同一个工作器会重复使用来自另一个远程仓库的基本认证凭据或 Bearer 令牌。能够同步容器远程仓库的用户，如果可以将该远程仓库指向由其控制的服务器，则可以获取为其他远程仓库存储的用户名、密码或 Bearer 令牌，并在上游注册表中重新利用这些凭据。存储在 Pulp 中的内容不会被更改，服务也不会中断。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-103868
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Pulp-container: registry credentials are reused across remotes in a worker
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in pulp-container when it authenticates to an upstream registry. Basic and bearer credentials from one remote are reused for later downloads in the same worker. A user who can sync a container remote, and can point that remote at a server they control, receives the username, password, or bearer token stored for a different remote, and can reuse that credential at the upstream registry. Content stored in Pulp is not changed, and the service is not stopped.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
对错误会话暴露数据元素
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Red Hat | Red Hat Ansible Automation Platform 2 | - |
cpe:/a:redhat:ansible_automation_platform:2
|
|
| Red Hat | Red Hat Ansible Automation Platform 2 | - |
cpe:/a:redhat:ansible_automation_platform:2
|
|
| Red Hat | Red Hat Ansible Automation Platform 2 | - |
cpe:/a:redhat:ansible_automation_platform:2
|
|
| Red Hat | Red Hat Ansible Automation Platform 2 | - |
cpe:/a:redhat:ansible_automation_platform:2
|
|
| Red Hat | Red Hat Ansible Automation Platform 2 | - |
cpe:/a:redhat:ansible_automation_platform:2
|
|
| Red Hat | Red Hat Ansible Automation Platform 2 | - |
cpe:/a:redhat:ansible_automation_platform:2
|
|
| Red Hat | Red Hat Ansible Automation Platform 2 | - |
cpe:/a:redhat:ansible_automation_platform:2
|
|
| Red Hat | Red Hat Ansible Automation Platform 2 | - |
cpe:/a:redhat:ansible_automation_platform:2
|
|
| Red Hat | Red Hat Satellite 6 | - |
cpe:/a:redhat:satellite:6
|
|
| Red Hat | Red Hat Satellite 6 | - |
cpe:/a:redhat:satellite:6
|
|
| Red Hat | Red Hat Update Infrastructure 4 for Cloud Providers | - |
cpe:/a:redhat:rhui:4::el8
|
|
| Red Hat | Red Hat Update Infrastructure 4 for Cloud Providers | - |
cpe:/a:redhat:rhui:4::el8
|
|
| Red Hat | Red Hat Update Infrastructure 5 | - |
cpe:/a:redhat:rhui:5::el9
|
|
| Red Hat | Red Hat Update Infrastructure 5 | - |
cpe:/a:redhat:rhui:5::el9
|
|
| Red Hat | Red Hat Update Infrastructure 5 | - |
cpe:/a:redhat:rhui:5::el9
|
|
II. Public POCs for CVE-2026-103868
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-103868
请登录查看更多情报信息。
Other References for CVE-2026-103868 (2)
Same Patch Batch · Red Hat · 2026-10-07 · 6 CVEs total
| CVE-2026-106471 | 8.1 HIGH | Candlepin: candlepin: broken object-level authorization via verifyauthorizationfilter mult |
| CVE-2026-107121 | 6.5 MEDIUM | Keycloak-services: keycloak-services: smtp starttls plaintext credential and message downg |
| CVE-2026-103869 | 6.5 MEDIUM | Pulp-ansible: bearer tokens are reused across remotes in a worker |
| CVE-2026-106061 | 5.5 MEDIUM | Gimp: gimp: heap buffer over-read in x cursor (xmc) thumbnail loader on crafted file |
| CVE-2026-103870 | 5.0 MEDIUM | Pulp-rpm: distribution tree publish creates directories from .treeinfo ids |
IV. Related Vulnerabilities
Same product: Red Hat Ansible Automation Platform 2
-
CVE-2026-103869
Pulp-ansible: bearer tokens are reused across remotes in a w -
CVE-2026-106033
Ansible: ansible-ui: ansible ui dom xss in /redirect next pa -
CVE-2026-103754
Ansible-runner: ansible-runner: path traversal and symlink e -
CVE-2026-90959
Pulpcore: pulpcore: file:// scheme allowlist bypass in conte -
CVE-2026-94416
Aap-gateway: aap-gateway: authorization bypass via workload
Same vendor: Red Hat
-
CVE-2026-107121
Keycloak-services: keycloak-services: smtp starttls plaintex -
CVE-2026-103870
Pulp-rpm: distribution tree publish creates directories from -
CVE-2026-103869
Pulp-ansible: bearer tokens are reused across remotes in a w -
CVE-2026-106061
Gimp: gimp: heap buffer over-read in x cursor (xmc) thumbnai -
CVE-2026-106471
Candlepin: candlepin: broken object-level authorization via
Same weakness: CWE-488
-
CVE-2026-103869
Pulp-ansible: bearer tokens are reused across remotes in a w -
CVE-2026-82806
Apache APISIX: cross-request permission pollution via static -
CVE-2026-103544
datadrivenconstruction OpenConstructionERP Al Provider Confi -
CVE-2026-88017
rclone: FTP cross-session auth-proxy backend confusion -
CVE-2026-84685
Improper Cache Isolation in auth0/react-native-auth0 SDK Web
V. Comments for CVE-2026-103868
No comments yet