Junglewise Threat Intelligence

CVE-2025-69872: DiskCache insecure pickle deserialization code execution

CVE-2025-69872 · Severity: critical · CVSS 9.8 · Published 2026-02-11

Vendors: Red Hat.

Executive brief

DiskCache is a popular Python library used to speed up applications by storing data on a computer's hard drive. A security flaw allows an attacker who can write files to the cache directory to take complete control of the application. This could lead to the theft of sensitive data, service disruptions, or unauthorized access to the underlying server.

Technical details

DiskCache (python-diskcache) through version 5.6.3 uses the Python 'pickle' module for serialization by default, which is inherently insecure when processing untrusted data. The vulnerability (CWE-502/CWE-94) occurs because the library does not validate or sign cached data before deserialization. An attacker who gains write access to the filesystem where the cache is stored can replace legitimate cached objects with malicious pickle payloads. When the victim application subsequently retrieves and deserializes these objects, the payload executes arbitrary code with the privileges of the application process. While the attack requires write access to the cache directory, CISA-ADP classifies this as a network-vector threat in certain deployments, likely where cache directories are shared or exposed via network services. Red Hat has released updates for affected products like OpenShift AI.

Affected products

  • Grant Jenks DiskCache (python-diskcache) through 5.6.3
  • Red Hat Red Hat OpenShift AI 3.3
  • Red Hat Red Hat Satellite 6

Timeline

  • 2026-02-11: disclosed: CVE published and reported to Red Hat Bugzilla
  • 2026-03-04: patched: Red Hat released security advisory RHSA-2026:3713 for OpenShift AI

References