Junglewise Threat Intelligence

CVE-2026-18157: Red Hat yggdrasil-worker-package-manager argument injection in APT backend

CVE-2026-18157 · Severity: high · CVSS 7.8 · Published 2026-07-31

Executive brief

A security vulnerability exists in the yggdrasil-worker-package-manager, a tool used to manage software packages on Linux systems. An attacker with local access to the system can provide specially crafted package names that are misinterpreted as administrative commands. This could allow the attacker to execute arbitrary code with full administrative (root) privileges, potentially leading to a complete system takeover and data theft.

Technical details

An argument injection vulnerability exists in the APT backend of yggdrasil-worker-package-manager within `package_manager_apt.go`. The application fails to use an option terminator (`--`) when passing user-supplied package names to the `apt-get` command. A local attacker with permission to dispatch requests to the worker can provide package names starting with a hyphen (e.g., `-o...`), which `apt-get` interprets as configuration options rather than package names. This can be leveraged to achieve arbitrary code execution with root privileges by injecting dangerous APT configuration directives. The issue is fixed in versions 0.1.4 and 0.2.4.

Affected products

  • Red Hat yggdrasil-worker-package-manager < 0.1.4, 0.2.0 - 0.2.4
  • Red Hat Red Hat Enterprise Linux 10 yggdrasil-worker-package-manager-0.2.3-4.el10

Timeline

  • 2026-05-04: other: Reported to Red Hat Bugzilla
  • 2026-07-30: patched: Fix committed and versions 0.1.4/0.2.4 released
  • 2026-07-31: advisory: NVD publication date

References

Related threats