CVE-2026-103868
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2026
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
Pulp-container: registry credentials are reused across remotes in a worker
A flaw was found in pulp-container when it authenticates to an upstream registry. Basic and bearer credentials from one remote are reused for later downloads in the same worker. A user who can sync a container remote, and can point that remote at a server they control, receives the username, password, or bearer token stored for a different remote, and can reuse that credential at the upstream registry. Content stored in Pulp is not changed, and the service is not stopped.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Red Hat Ansible Automation Platform 2
- Vendor
- Red Hat
- Product
- Red Hat Ansible Automation Platform 2
- Platforms
- Unknown
- Default status
unaffected- Package
- ansible-automation-platform-24/hub-rhel8
- Package collection
- https://access.redhat.com/downloads/content/package-browser/
No explicit version tuples; consult this entry's default status.
Red Hat Ansible Automation Platform 2
- Vendor
- Red Hat
- Product
- Red Hat Ansible Automation Platform 2
- Platforms
- Unknown
- Default status
unaffected- Package
- ansible-automation-platform-25/hub-rhel8
- Package collection
- https://access.redhat.com/downloads/content/package-browser/
No explicit version tuples; consult this entry's default status.
Red Hat Ansible Automation Platform 2
- Vendor
- Red Hat
- Product
- Red Hat Ansible Automation Platform 2
- Platforms
- Unknown
- Default status
affected- Package
- ansible-automation-platform-26/hub-rhel9
- Package collection
- https://access.redhat.com/downloads/content/package-browser/
No explicit version tuples; consult this entry's default status.
Red Hat Ansible Automation Platform 2
- Vendor
- Red Hat
- Product
- Red Hat Ansible Automation Platform 2
- Platforms
- Unknown
- Default status
affected- Package
- ansible-automation-platform-27/hub-rhel9
- Package collection
- https://access.redhat.com/downloads/content/package-browser/
No explicit version tuples; consult this entry's default status.
Red Hat Ansible Automation Platform 2
- Vendor
- Red Hat
- Product
- Red Hat Ansible Automation Platform 2
- Platforms
- Unknown
- Default status
unaffected- Package
- python3.11-pulp-container
- Package collection
- https://catalog.redhat.com/software/containers/
No explicit version tuples; consult this entry's default status.
Red Hat Ansible Automation Platform 2
- Vendor
- Red Hat
- Product
- Red Hat Ansible Automation Platform 2
- Platforms
- Unknown
- Default status
unaffected- Package
- python3.12-pulp-container
- Package collection
- https://catalog.redhat.com/software/containers/
No explicit version tuples; consult this entry's default status.
Red Hat Ansible Automation Platform 2
- Vendor
- Red Hat
- Product
- Red Hat Ansible Automation Platform 2
- Platforms
- Unknown
- Default status
unaffected- Package
- python3x-pulp-container
- Package collection
- https://catalog.redhat.com/software/containers/
No explicit version tuples; consult this entry's default status.
Red Hat Ansible Automation Platform 2
- Vendor
- Red Hat
- Product
- Red Hat Ansible Automation Platform 2
- Platforms
- Unknown
- Default status
unaffected- Package
- python-pulp-container
- Package collection
- https://catalog.redhat.com/software/containers/
No explicit version tuples; consult this entry's default status.
Red Hat Satellite 6
- Vendor
- Red Hat
- Product
- Red Hat Satellite 6
- Platforms
- Unknown
- Default status
affected- Package
- python3.12-pulp-container
- Package collection
- https://catalog.redhat.com/software/containers/
No explicit version tuples; consult this entry's default status.
Red Hat Satellite 6
- Vendor
- Red Hat
- Product
- Red Hat Satellite 6
- Platforms
- Unknown
- Default status
affected- Package
- python-pulp-container
- Package collection
- https://catalog.redhat.com/software/containers/
No explicit version tuples; consult this entry's default status.
Red Hat Update Infrastructure 4 for Cloud Providers
- Vendor
- Red Hat
- Product
- Red Hat Update Infrastructure 4 for Cloud Providers
- Platforms
- Unknown
- Default status
unaffected- Package
- python-pulp-container
- Package collection
- https://catalog.redhat.com/software/containers/
No explicit version tuples; consult this entry's default status.
Red Hat Update Infrastructure 4 for Cloud Providers
- Vendor
- Red Hat
- Product
- Red Hat Update Infrastructure 4 for Cloud Providers
- Platforms
- Unknown
- Default status
unaffected- Package
- python-pulp-container-client
- Package collection
- https://access.redhat.com/downloads/content/package-browser/
No explicit version tuples; consult this entry's default status.
Red Hat Update Infrastructure 5
- Vendor
- Red Hat
- Product
- Red Hat Update Infrastructure 5
- Platforms
- Unknown
- Default status
unaffected- Package
- python-pulp-container-client
- Package collection
- https://access.redhat.com/downloads/content/package-browser/
No explicit version tuples; consult this entry's default status.
Red Hat Update Infrastructure 5
- Vendor
- Red Hat
- Product
- Red Hat Update Infrastructure 5
- Platforms
- Unknown
- Default status
unaffected- Package
- rhui5/rhua-rhel9
- Package collection
- https://access.redhat.com/downloads/content/package-browser/
No explicit version tuples; consult this entry's default status.
Red Hat Update Infrastructure 5
- Vendor
- Red Hat
- Product
- Red Hat Update Infrastructure 5
- Platforms
- Unknown
- Default status
unaffected- Package
- rhui5/rhua-tp-rhel9
- Package collection
- https://access.redhat.com/downloads/content/package-browser/
No explicit version tuples; consult this entry's default status.