Red Hat

CVE-2026-123084: An expression language injection has been found in the HeaderContentGuard.permit function in publication.py of the content guard in the Pulpcore package

CVE-2026-123084 Nov 10, 2026 Source: Vendor

In brief. Red Hat published CVE-2026-123084: An **expression language injection** has been found in the HeaderContentGuard.permit function in publication.py of the content guard in the **Pulpcore** package on November 10, 2026. It credits 1 researcher or team for 1 CVE.

An **expression language injection** has been found in the HeaderContentGuard.permit function in publication.py of the content guard in the **Pulpcore** package. The guard is supposed to check a value in a request header. It saves a jq filter and runs that filter against the header when a client asks for content. The filter is not limited to the header, and jq's env builtin also returns the environment of the content process. A low-privileged network attacker or user who can create a header cont

Source of record The credited names below are quoted verbatim from the vendor's own advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-123084

Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.

Credited

1 line

Showing 1–1 of 1

CVE-2026-123084 BR2026-0000-046342 unclaimed

Credited as Red Hat would like to thank Zachariah Mithani (AploSec) for reporting this issue