CVE-2026-102930

An Important severity flaw was found in virtualenv, a tool for creating isolated Python virtual environments that is shipped in Red Hat products and offerings including Red Hat Enterprise Linux, Red Hat Ansible Automation Platform, Red Hat AI offerings, and other Red Hat cloud services. When virtualenv fetches pip or setuptools seed wheels over the network, through its periodic-update mechanism or the --download option, it does not verify the downloaded files against an authoritative cryptographic checksum. A network attacker able to intercept TLS traffic, or a compromised or stale package index or mirror, could substitute a malicious wheel under the expected distribution, version, and filename. virtualenv would then cache the tampered wheel and seed it into subsequently created virtual environments, which can result in arbitrary code execution. Red Hat products that bundle virtualenv are affected where this download path can be exercised, and fixes are being pursued through the respective product release streams; a small number of bundled components were assessed as not affected because the vulnerable component is not present in them. While the upstream project's security advisory rates this issue as low severity, Red Hat rates it as Important based on the potential for arbitrary code execution in environments created from tampered seed packages.