CVE-2026-76594
Description
A flaw was found in advisor-backend. A network-adjacent unauthenticated attacker could exploit a vulnerability in the /private/import_content/ endpoint, which lacks proper authentication and permission checks. This allows the attacker to overwrite the global Advisor rule, resolution, and playbook catalogue. When combined with another vulnerability involving unsafe YAML deserialization, this could lead to arbitrary code execution on affected systems.
Statement
This is an Important vulnerability as an unauthenticated, network-adjacent attacker can overwrite the global Red Hat Advisor rule catalogue. This flaw, when chained with a separate unsafe YAML deserialization vulnerability, could lead to remote code execution on customer hosts by injecting malicious Ansible playbooks. The affected endpoint is exposed on the same listener as the public API, increasing the risk in standard deployments.
Mitigation
Restrict network access to the `/private/import_content/` endpoint of the `advisor-backend` service. Configure network policies or firewall rules to limit connections to this path to only trusted internal networks or localhost, preventing unauthenticated external access. This will reduce the attack surface by ensuring only authorized internal services can interact with the content import functionality. If the service is reloaded or restarted, ensure the network restrictions remain in effect.
Understanding the Weakness (CWE)
Access Control,Other
Technical Impact: Gain Privileges or Assume Identity; Varies by Context
Exposing critical functionality essentially provides an attacker with the privilege level of that functionality. The consequences will depend on the associated functionality, but they can range from reading or modifying sensitive data, accessing administrative or other privileged functionality, or possibly even executing arbitrary code.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
