CVE-2026-78367: RPM rpmbuild Tarball Processing RCE Vulnerability

CVE-2026-78367 Overview

CVE-2026-78367 is a code injection vulnerability in RPM's rpmbuild tarball processing logic. The getTarSpec() function in tools/rpmbuild.cc passes an attacker-controlled tar archive member name to rpmExpand() inside a %{basename:...} macro expression. A crafted .spec member name can inject RPM macros, including Lua expressions, and execute arbitrary code with the privileges of the user running rpmbuild. Exploitation requires a victim or automated build system to process a malicious source tarball using rpmbuild tarball mode such as -ts, -ta, or -tb. The flaw is classified under CWE-94 (Improper Control of Generation of Code).

Critical Impact
Attackers who supply a malicious source tarball can achieve arbitrary code execution on developer workstations and automated RPM build systems.

Affected Products

RPM Package Manager (rpm-software-management/rpm) — rpmbuild component
Red Hat Enterprise Linux distributions shipping affected rpm builds
Downstream RPM-based build systems and CI pipelines invoking rpmbuild -ts, -ta, or -tb

Discovery Timeline

2026-08-24 - CVE-2026-78367 published to NVD
2026-08-24 - Last updated in NVD database

Technical Details for CVE-2026-78367

Vulnerability Analysis

The defect lives in the getTarSpec() function inside tools/rpmbuild.cc. When rpmbuild operates in tarball mode, it inspects archive member names to locate the .spec file. The extracted member name is concatenated into a %{basename:...} macro string and handed to rpmExpand() for evaluation.

rpmExpand() interprets its input as an RPM macro expression. RPM macros support embedded Lua code through the %{lua:...} construct. An attacker who controls a tar member name can therefore inject macro syntax that is executed during expansion. Command execution runs in the context of the invoking user, which on build servers is frequently a service account with broad filesystem access.

Exploitation is local and requires user interaction, since a build operator or automated pipeline must invoke rpmbuild on the attacker-supplied tarball. However, RPM source tarballs are routinely fetched from third-party sources, package trackers, and untrusted contributors, making this a realistic supply chain attack path.

Root Cause

The root cause is unsanitized input passed into a macro evaluator. Tar archive member names are attacker-controlled data, yet getTarSpec() treats them as trusted macro arguments. rpmExpand() performs no sandboxing on Lua execution invoked through %{lua:...}, so any injected macro payload runs with full interpreter privileges.

Attack Vector

An attacker crafts a source archive containing a .spec member whose filename embeds RPM macro syntax such as a %{lua:...} block. The attacker distributes the tarball through a mirror, pull request, package index, or social engineering channel. When a maintainer or CI job runs rpmbuild -ts, -ta, or -tb against the archive, getTarSpec() expands the malicious filename and executes the embedded payload.

Refer to the Red Hat CVE-2026-78367 Advisory, the Red Hat Bug Report #2521857, and GitHub RPM Issue #4314 for upstream technical detail.

Detection Methods for CVE-2026-78367

Indicators of Compromise

Tar archive entries whose filenames contain %{, %{lua:, or other RPM macro syntax rather than plain path characters.
Unexpected child processes spawned by rpmbuild, such as shells, network utilities, or interpreters invoked during a source archive parse.
Outbound network connections initiated by build accounts immediately after rpmbuild -ts, -ta, or -tb invocations.

Detection Strategies

Inspect tar archives before build with tar -tvf and flag member names containing %, {, }, or control characters.
Log full command lines for rpmbuild invocations and correlate them with subsequent process creation events on the same host.
Alert on rpmbuild process trees that fork non-build binaries such as /bin/sh, curl, wget, python, or nc.

Monitoring Recommendations

Forward build server process telemetry and command-line arguments to a central analytics platform for retrospective hunting.
Monitor CI runner accounts for anomalous outbound traffic and filesystem writes outside declared build directories.
Track RPM package versions across the fleet and alert on hosts running vulnerable rpm builds prior to the vendor fix.

How to Mitigate CVE-2026-78367

Immediate Actions Required

Apply the vendor-supplied rpm update as soon as the patched package is available from your Linux distribution.
Restrict rpmbuild -ts, -ta, and -tb usage to trusted, curated source tarballs until patches are deployed.
Isolate RPM build activity to dedicated, non-privileged accounts on ephemeral or sandboxed build hosts.

Patch Information

Refer to the Red Hat CVE-2026-78367 Advisory and GitHub RPM Issue #4314 for the upstream fix status and distribution-specific package updates. Rebuild container images and CI runner base images once fixed packages are published.

Workarounds

Extract source archives with tar -xf into a scratch directory and invoke rpmbuild -bs or -ba against the extracted .spec file rather than the tarball, avoiding the vulnerable code path.
Validate tar member names against a strict allowlist (for example, alphanumerics, ., -, _, /) before passing archives to rpmbuild.
Run rpmbuild inside a rootless container, chroot, or systemd sandbox with no network access and read-only host mounts.

bash

# Safe extraction workflow avoiding rpmbuild tarball mode
mkdir -p /tmp/rpmwork && cd /tmp/rpmwork
tar -tvf /path/to/source.tar.gz | awk '{print $NF}' | grep -E '[%{}]' && \
    echo 'Refusing archive: suspicious member names detected' && exit 1
tar -xf /path/to/source.tar.gz
rpmbuild -bs ./*/*.spec