CVE-2026-84232
Pulpcore: python-pulpcore: stored cross-site scripting via inline rendering of uploaded html/svg content
A flaw was found in pulpcore's content serving application. Files uploaded to Pulp file-type repositories are served with their original content type (e.g., text/html for .html files, image/svg+xml for .svg files) and without a Content-Disposition: attachment header when using local filesystem storage. An authenticated user or attacker with content upload permissions can upload a specially crafted HTML or SVG file containing JavaScript, which executes in the browser of any user who visits the file URL, resulting in stored cross-site scripting (XSS) in the context of the host application.
Fixes and workarounds
Workaround
If immediate update is not possible, administrators can add security headers to the Apache reverse proxy configuration for the /pulp/content/ path. On Satellite, add the following to the Apache configuration (e.g., via a custom .conf file in /etc/httpd/conf.d/ or via a Puppet override): ``` <Location /pulp/content> Header set Content-Disposition "attachment" Header set X-Content-Type-Options "nosniff" Header set Content-Security-Policy "default-src 'none'; sandbox" </Location> ``` This forces all content downloads rather than inline rendering, and blocks script execution even if Content-Disposition is somehow bypassed. After applying, restart Apache: ```systemctl restart httpd``` Alternatively, restrict file upload permissions in Satellite to only trusted users who require content management capabilities.
Source: CNA: redhatAffected products and versions
| Product | Versions | Authority |
|---|---|---|
| Red Hat Ansible Automation Platform 2 Red Hat ansible-automation-platform-24/hub-rhel8
https://access.redhat.com/downloads/content/package-browser/ |
Range not reported
Other versions: unaffected |
CNA: redhat |
| Red Hat Ansible Automation Platform 2 Red Hat ansible-automation-platform-25/hub-rhel8
https://access.redhat.com/downloads/content/package-browser/ |
Range not reported
Other versions: unaffected |
CNA: redhat |
| Red Hat Ansible Automation Platform 2 Red Hat ansible-automation-platform-26/hub-rhel9
https://access.redhat.com/downloads/content/package-browser/ |
Range not reported
Other versions: unaffected |
CNA: redhat |
| Red Hat Ansible Automation Platform 2 Red Hat ansible-automation-platform-27/hub-rhel9
https://access.redhat.com/downloads/content/package-browser/ |
Range not reported
Other versions: unaffected |
CNA: redhat |
| Red Hat Ansible Automation Platform 2 Red Hat python3.11-pulpcore
https://access.redhat.com/downloads/content/package-browser/ |
Range not reported
Other versions: unaffected |
CNA: redhat |
| Red Hat Ansible Automation Platform 2 Red Hat python3.12-pulpcore
https://access.redhat.com/downloads/content/package-browser/ |
Range not reported
Other versions: unaffected |
CNA: redhat |
| Red Hat Ansible Automation Platform 2 Red Hat python3x-pulpcore
https://access.redhat.com/downloads/content/package-browser/ |
Range not reported
Other versions: unaffected |
CNA: redhat |
| Red Hat Ansible Automation Platform 2 Red Hat python-pulpcore
https://access.redhat.com/downloads/content/package-browser/ |
Range not reported
Other versions: unaffected |
CNA: redhat |
| Red Hat Satellite 6 Red Hat python3.12-pulpcore
https://access.redhat.com/downloads/content/package-browser/ |
Range not reported
Other versions: affected |
CNA: redhat |
| Red Hat Satellite 6 Red Hat python-pulpcore
https://access.redhat.com/downloads/content/package-browser/ |
Range not reported
Other versions: affected |
CNA: redhat |
| Red Hat Update Infrastructure 4 for Cloud Providers Red Hat python-pulpcore
https://access.redhat.com/downloads/content/package-browser/ |
Range not reported
Other versions: unaffected |
CNA: redhat |
| Red Hat Update Infrastructure 5 Red Hat rhui5/rhua-rhel9
https://access.redhat.com/downloads/content/package-browser/ |
Range not reported
Other versions: unaffected |
CNA: redhat |
| Red Hat Update Infrastructure 5 Red Hat rhui5/rhua-tp-rhel9
https://access.redhat.com/downloads/content/package-browser/ |
Range not reported
Other versions: unaffected |
CNA: redhat |
Version ranges are source assertions. Check the vendor advisory and your installed configuration before determining exposure.
CVSS assessments
| Version / score | Vector | Authority |
|---|---|---|
| 3.1 / 5.4 medium |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N | CNA: redhat |
Exploit evidence
No exploit evidence in collected sources. This is not proof of no exploitation.
References
- https://access.redhat.com/security/cve/CVE-2026-84232CNA: redhat · vdb-entry, x_refsource_REDHAT
- https://bugzilla.redhat.com/show_bug.cgi?id=2526807CNA: redhat · issue-tracking, x_refsource_REDHAT
For agents and automation
Read public disclosures for free as Markdown or JSON. Compatible browsers also expose native WebMCP tools to search disclosures, read this page, and discover API access.
Use the ontology-linked Cyber API with x402 pay per request, or a Y2 Pro or Elite API key with the intel:cyber scope.
Endpoints and access details
https://api.y2.dev/api/v2/cyber/cveshttps://api.y2.dev/api/v2/cyber/cves/{cveId}
A workspace owner or admin can create a Pro or Elite API key. Send Authorization: Bearer <Y2_API_KEY> from your trusted agent runtime.
For x402, omit Authorization and read the HTTP 402 payment challenge before signing a retry. Public browser tools do not make payments.