CVE-2026-112210: Rhc: rhc: local privilege escalation via symlink following in rhc-canonical-facts.service

Severity: medium (CVSS 6.0 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-19 · updated 2026-10-19
Weakness: CWE-59

Description

A flaw was found in the rhc-canonical-facts.service systemd unit shipped with rhc. The service runs as root and operates on a file inside a directory owned by an unprivileged system user without verifying that the file is not a symbolic link. A local attacker who has already compromised the privileged yggdrasil system service account can exploit this to gain ownership of arbitrary files, leading to privilege escalation to root.

Affected products

Red Hat Enterprise Linux 10: all versions

References

https://access.redhat.com/security/cve/CVE-2026-112210
https://bugzilla.redhat.com/show_bug.cgi?id=2555474
https://github.com/RedHatInsights/rhc/blob/51928db/data/systemd/rhc-canonical-facts.service

Get alerted when CVE-2026-112210 or the next vulnerability affects your stack