CVE-2026-95519: RPM Package Manager RCE Vulnerability

CVE-2026-95519 Overview

A flaw in rpm allows attackers to achieve arbitrary code execution through crafted manifest files. When a user or automation processes a manifest with rpm -q -p or similar manifest-handling flows, manifest entries undergo unexpected macro expansion before being opened. This behavior allows embedded shell commands to execute with the privileges of the rpm process. Successful exploitation leads to full compromise of confidentiality, integrity, and availability for the affected account. The flaw is categorized under [CWE-78] as an OS Command Injection weakness.

Critical Impact

Attackers can execute arbitrary shell commands through manipulated rpm manifest files, resulting in complete compromise of the account running rpm.

Affected Products

• RPM Package Manager (rpm) manifest-processing functionality
• Red Hat Enterprise Linux distributions shipping affected rpm versions
• Automation and tooling that invokes rpm -q -p against untrusted manifest files

Discovery Timeline

• 2026-09-24 - CVE CVE-2026-95519 published to NVD
• 2026-09-25 - Last updated in NVD database

Technical Details for CVE-2026-95519

Vulnerability Analysis

The vulnerability stems from improper handling of manifest file contents in rpm. Manifest files passed to commands such as rpm -q -p <manifest> are expected to contain plain package paths or identifiers. Instead, rpm applies macro expansion to those entries before opening them. This expansion step evaluates embedded shell constructs, converting a data file into an executable payload channel. An attacker who controls or supplies a manifest file can inject shell commands that run under the user identity executing rpm.

Exploitation requires local access and user interaction, since a victim or automation workflow must process the attacker-supplied manifest. However, interaction is minimal: standard query operations on an unfamiliar manifest are enough to trigger execution. Build systems, package validation scripts, and CI pipelines that fetch and inspect .rpm manifests from external sources are the most exposed workflows.

Root Cause

The root cause is unsafe macro expansion applied to untrusted manifest content prior to file open. The rpm macro engine evaluates embedded directives, including shell escapes, during manifest parsing. There is no sanitization boundary between manifest data and macro directives, which collapses the trust distinction between file-name input and executable configuration.

Attack Vector

The attack vector is local and requires user interaction. An attacker crafts a manifest file containing macro directives that invoke shell commands. The attacker places this file where a victim will process it, for example in a shared build directory, extracted archive, or downloaded artifact. When the victim runs rpm -q -p or an equivalent manifest-processing command against the file, the embedded commands execute with the victim's privileges. Refer to the Red Hat CVE-2026-95519 Advisory and Red Hat Bug Report #2470977 for upstream technical details.

Detection Methods for CVE-2026-95519

Indicators of Compromise

• Unexpected child processes spawned by rpm, particularly shells (/bin/sh, /bin/bash) or interpreters (python, perl) with no legitimate build context.
• Manifest files containing %(...) macro syntax, backticks, or shell metacharacters alongside package paths.
• Outbound network connections or file modifications originating from an rpm process tree.

Detection Strategies

• Monitor process ancestry for rpm spawning shells or network utilities such as curl, wget, or nc.
• Inspect manifest files consumed by automation for macro expressions or non-printable characters that deviate from expected package-name patterns.
• Correlate rpm -q -p invocations against untrusted file paths, including user download directories and world-writable locations.

Monitoring Recommendations

• Enable auditd rules for execve events where the parent process is rpm and the child is a shell or scripting interpreter.
• Log and alert on rpm executions whose arguments include files outside standard package repositories.
• Review CI/CD and build-system logs for rpm command failures or anomalous runtime durations that may indicate injected command execution.

How to Mitigate CVE-2026-95519

Immediate Actions Required

• Apply vendor-supplied rpm updates as soon as distribution patches become available through Red Hat and downstream maintainers.
• Treat all externally sourced manifest files as untrusted and avoid passing them to rpm -q -p until patched.
• Audit automation and CI pipelines that process .rpm manifest files and restrict them to vetted sources.

Patch Information

Monitor the Red Hat CVE-2026-95519 Advisory and Red Hat Bug Report #2470977 for fixed package versions and backports. Deploy the patched rpm package across all affected hosts, including build servers, container base images, and developer workstations.

Workarounds

• Avoid invoking rpm -q -p or similar manifest-processing commands on files from untrusted or unverified origins.
• Run rpm manifest operations under a dedicated low-privilege account that cannot access sensitive data or credentials.
• Validate manifest files with a strict allowlist parser before passing them to rpm, rejecting any content containing macro syntax or shell metacharacters.

# Configuration example
# Inspect a manifest for suspicious macro or shell constructs before processing
grep -nE '%\(|`|\$\(' /path/to/manifest && echo 'REJECT: manifest contains macro/shell syntax' || rpm -q -p /path/to/manifest