Vulnerability · Published Jul 31, 2026 · Assigned by redhat
CVE-2026-18157Yggdrasil-worker-package-manager: yggdrasil-worker-package-manager: remote code execution via apt argument injection
High 7.8
In plain English
A high-severity argument injection in Red Hat Enterprise Linux 10 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities).
Official description
A flaw was found in yggdrasil-worker-package-manager. A local attacker with existing access to the system could exploit an argument injection vulnerability in the APT backend. This allows specially crafted package names, which begin with a hyphen, to be misinterpreted as command options by apt-get. Successful exploitation could lead to remote code execution (RCE) with root privileges, enabling the attacker to fully compromise the system's integrity, confidentiality, and availability.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| RedHatInsights | yggdrasil-worker-package-manager | 0 – before 0.1.40.2.0 – before 0.2.4 |
| Red Hat | Red Hat Enterprise Linux 10 | see references |
Weakness: CWE-88 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://access.redhat.com/security/cve/CVE-2026-18157 vdb-entry, x_refsource_REDHAT
- RHBZ#2465250 issue-tracking, x_refsource_REDHAT
- https://github.com/RedHatInsights/yggdrasil-worker-package-manager/commit/959745bb5917c17f0316af199aace6c71baa5ad7
- https://github.com/RedHatInsights/yggdrasil-worker-package-manager/releases/tag/0.1.4
- https://github.com/RedHatInsights/yggdrasil-worker-package-manager/releases/tag/0.2.4