CVE-2026-55828: qbee transport Path Traversal Vulnerability

CVE-2026-55828 Overview

CVE-2026-55828 is a path traversal vulnerability [CWE-22] in the qbee transport remote access protocol implementation. The flaw resides in the extractTar routine, which applies strictly lexical path validation when unpacking tar archives. This validation does not account for symbolic links written to disk earlier in the same extraction. A crafted archive containing a symlink chain can redirect writes one directory above the intended extraction path. When qbee-agent runs the extraction with root privileges, an attacker can achieve a root-owned file write outside the destination directory. The issue is fixed in version 1.26.25.

Critical Impact
A malicious tar archive can leverage attacker-planted symlinks to force qbee-agent into writing or overwriting arbitrary files as root outside the intended extraction directory.

Affected Products

qbee-io transport (github.com/qbee-io/transport) prior to 1.26.25
qbee-agent components that invoke the vulnerable extractTar routine
Deployments where qbee-agent extracts archives with root privileges

Discovery Timeline

2026-09-15 - CVE-2026-55828 published to NVD
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-55828

Vulnerability Analysis

The qbee transport library implements tar archive extraction in its extractTar routine. Path safety is enforced through lexical checks, comparing the declared entry path against the target directory before writing. Lexical validation inspects the archive header string only. It does not resolve symbolic links that already exist on the filesystem at write time.

When extraction proceeds sequentially, the routine can create a symlink entry first, then process a subsequent regular file entry whose path traverses that symlink. Because the header path itself is confined to the extraction directory, the lexical check passes. The kernel then follows the symlink during open, redirecting the write to the symlink target one directory above the destination. Combined with root execution by qbee-agent, this yields an arbitrary root-owned file write primitive.

Root Cause

The routine trusts the archive-declared path without canonicalizing the final on-disk target through lstat or O_NOFOLLOW. Symlinks planted earlier in the extraction are treated as ordinary directory components at open time.

Attack Vector

An attacker with the ability to supply a tar archive to qbee-agent crafts an archive containing (1) a symlink entry pointing to a parent path such as ../ and (2) a regular file entry whose path traverses the symlink. During extraction as root, the file write follows the symlink and lands outside the intended directory.

// Patch excerpt from file_transfer.go (DEV-3004)
// Source: https://github.com/qbee-io/transport/commit/43947671ba9be8fb08b105f3539a112ee7a57ddc

-	f, err := os.OpenFile(targetPath, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, os.FileMode(header.Mode))
+	// Always remove existing file/symlink at target path before creating new file
+	// to prevent abuse of hard links in the archive.
+	if err := os.Remove(targetPath); err != nil && !os.IsNotExist(err) {
+		return fmt.Errorf("error removing existing entry %s: %w", targetPath, err)
+	}
+
+	f, err := os.OpenFile(targetPath, os.O_CREATE|os.O_EXCL|os.O_WRONLY|os.O_TRUNC, os.FileMode(header.Mode))
 	if err != nil {
 		return fmt.Errorf("error creating file %s: %w", targetPath, err)
 	}

The fix removes any pre-existing entry at targetPath and reopens the file with O_EXCL, preventing the kernel from following a planted symlink or reusing a hard link.

Detection Methods for CVE-2026-55828

Indicators of Compromise

Files owned by root appearing outside qbee-agent extraction directories with recent modification times aligning with agent activity.
Unexpected symbolic links inside directories used by qbee-agent for archive staging.
Tar archives delivered to qbee-agent containing entries with ../ path components or symlink headers referencing parent directories.

Detection Strategies

Compare installed qbee-agent versions against 1.26.25 across managed fleets and flag any host running an older release.
Inspect archive payloads received by qbee-agent for mixed symlink and regular file entries whose combined paths escape the extraction root.
Audit filesystem changes made by the qbee-agent process using auditd or eBPF-based file integrity monitoring.

Monitoring Recommendations

Log all open, openat, and symlinkat syscalls originating from the qbee-agent process and alert on writes outside expected paths.
Monitor /etc, /root, /usr/bin, and other sensitive directories for new files created by qbee-agent.
Track qbee transport process telemetry for unusual archive extraction patterns and archive sources.

How to Mitigate CVE-2026-55828

Immediate Actions Required

Upgrade qbee-agent and any consumers of github.com/qbee-io/transport to version 1.26.25 or later.
Inventory the environment for hosts running vulnerable qbee transport builds and prioritize those where the agent runs as root.
Review recent qbee-agent extraction logs for archives received from untrusted or unexpected sources.

Patch Information

The fix is delivered in qbee transport version 1.26.25 via commit 43947671ba9be8fb08b105f3539a112ee7a57ddc and pull request GitHub PR #19. Details are published in GHSA-f9m7-vc86-p6jj. The patch removes any existing entry at the target path before writing and opens the destination file with O_EXCL to block symlink and hard link redirection.

Workarounds

Restrict which principals can initiate file transfers or archive pushes to qbee-agent until the patched version is deployed.
Where feasible, run qbee-agent extraction under a non-root account or a restricted namespace to limit blast radius of an arbitrary write.
Isolate managed hosts on networks that only accept transport connections from trusted qbee control planes.

bash

# Verify installed qbee-agent version and upgrade if below 1.26.25
qbee-agent --version

# Example upgrade workflow (adjust for your package manager or deployment method)
sudo systemctl stop qbee-agent
sudo apt-get update && sudo apt-get install --only-upgrade qbee-agent
qbee-agent --version   # confirm >= 1.26.25
sudo systemctl start qbee-agent