{"id":"CVE-2026-112210","title":"Rhc: rhc: local privilege escalation via symlink following in rhc-canonical-facts.service","summary":"A flaw was found in the rhc-canonical-facts.service systemd unit shipped with rhc. The service runs as root and operates on a file inside a directory owned by an unprivileged system user without verifying that the file is not a symbolic …","severity":"medium","cvss":6,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H","cvssSource":"cna","cwe":["CWE-59"],"vendor":"Red Hat","product":"rhc","affected":["rhc (all versions)","rhc","rhc","rhc"],"published":"2026-10-19","updated":"2026-10-19","sourceUpdated":"2026-10-19T13:00:27.192Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-112210","references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-112210"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2555474","label":"RHBZ#2555474"},{"url":"https://github.com/RedHatInsights/rhc/blob/51928db/data/systemd/rhc-canonical-facts.service"}],"tags":["cve.org"],"ingestedAt":"2026-10-19T12:27:23.801Z","slug":"CVE-2026-112210","body":"## Overview\n\nA flaw was found in the rhc-canonical-facts.service systemd unit shipped with rhc. The service runs as root and operates on a file inside a directory owned by an unprivileged system user without verifying that the file is not a symbolic link. A local attacker who has already compromised the privileged yggdrasil system service account can exploit this to gain ownership of arbitrary files, leading to privilege escalation to root.\n\n## Affected\n\n- `rhc (all versions)`\n- `rhc`\n- `rhc`\n- `rhc`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n### Workarounds\n\nDisable the rhc-canonical-facts timer to prevent automatic triggering of the vulnerable service:\n\n    systemctl stop rhc-canonical-facts.timer\n    systemctl disable rhc-canonical-facts.timer\n\nNote that this will prevent rhc from updating canonical facts automatically. The rhc connect command will still trigger the service manually.","depth":"sunlit","depthScore":33,"depthScoreParts":{"impact":33,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}