CVE-2026-18376

Description

Koji's SCM URL parser normalizes repository paths using urllib.parse.urlparse and os.path.normpath before evaluating them against the configured SCM policy. Because normpath decodes percent-encoded sequences at policy-check time but the underlying Git HTTP transport decodes them again during fetch, an attacker can craft a URL containing %2e%2e path traversal sequences (e.g., /rpms/%2e%2e/forks//rpms/.git) that satisfies the /rpms/* policy pattern but resolves to an attacker-controlled fork repository. This allows any authenticated Koji user, without packager privileges, to submit builds sourced from attacker-controlled code. The fix normalizes and URL-decodes SCM paths before policy evaluation. The original normpath logic was introduced to address CVE-2017-1002153; this vulnerability represents a bypass of that fix.

Statement

Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Mitigation

While a URL-encoding parser differential in Koji's SCM policy evaluation allows any authenticated Fedora Account holder to submit builds sourced from attacker-controlled code, it cannot independently produce a supply chain compromise. The full attack chain requires the resulting build to be tagged into an openh264 signing pipeline and delivered to end users via a poisoned MirrorManager database.

Both of those downstream steps have been blocked. Permissions on all *openh264 and epel*-openh264 tags have been updated to require admin access, preventing an unprivileged attacker from tagging a malicious build into the Robosignatory signing pipeline. Separately, MirrorManager has been patched to remove the pickle deserialization fallback entirely, closing the unauthenticated RCE path that would have allowed an attacker to manipulate mirror delivery.

As a result, an attacker exploiting this vulnerability today can produce a build from attacker-controlled source, but cannot get it signed with a genuine Fedora GPG key or deliver it to end users. The vulnerability remains open at the code level pending deployment of koji 1.36.1, but the practical impact of exploitation is contained by the mitigations applied to the other components in the chain.

Understanding the Weakness (CWE)

CWE-551

Access Control

Technical Impact: Bypass Protection Mechanism

Acknowledgements

Red Hat would like to thank splitline (@_splitline_) (DEVCORE Research Team) for reporting this issue.

Frequently Asked Questions

Not sure what something means? Check out our Security Glossary.

Want to get errata notifications? Sign up here.