CVE-2026-95521: RPM Package Manager RCE Vulnerability

CVE-2026-95521 is a command injection flaw in RPM that enables remote code execution when processing malicious source RPM files. Attackers can execute arbitrary commands by exploiting macro constructs in file basenames. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2026-95521 Overview

CVE-2026-95521 is a command injection flaw in rpm, the package manager used by Red Hat Enterprise Linux and derivative distributions. Installing or rebuilding a source RPM (.src.rpm) whose source or spec file basenames contain a %() macro construct causes rpm to execute attacker-controlled shell commands. The vulnerability is triggered when rpm relocates the source file list and passes untrusted basenames through popen(). Any user who processes an untrusted .src.rpm becomes a code execution target.

Critical Impact
Processing a malicious source RPM results in arbitrary shell command execution as the invoking user, typically a non-root developer or build account.

Affected Products

rpm package manager (RPM Package Manager)
Red Hat Enterprise Linux and derivative distributions that ship vulnerable rpm builds
Build systems and CI pipelines that process untrusted .src.rpm files

Discovery Timeline

2026-09-24 - CVE CVE-2026-95521 published to NVD
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-95521

Vulnerability Analysis

The flaw is classified as OS Command Injection [CWE-78]. The RPM Package Manager expands macros during package processing, including file basename handling for source RPMs. When a source or spec file basename contains the %() macro construct, RPM evaluates the construct by invoking popen() with the embedded shell command. An attacker crafts a .src.rpm whose source filenames contain %(command) payloads. Installing or rebuilding the package then runs the command in the user's shell context.

Exploitation requires local access and user interaction, specifically the act of running rpm -i, rpmbuild --rebuild, or an equivalent operation against the attacker-supplied archive. Successful exploitation grants code execution as the invoking account, which is often a developer, build agent, or packager rather than root. In automated build systems the resulting foothold can enable supply chain compromise of downstream artifacts.

Root Cause

RPM's source file relocation logic passes macro-containing basenames to the macro expansion engine without sanitization. The expansion engine treats %() as a shell execution directive and dispatches it through popen(). Filenames should be inert data, not evaluated as macros.

Attack Vector

The attacker publishes or delivers a crafted .src.rpm through a mirror, email attachment, developer forum, or compromised build dependency. When a victim runs rpm -i package.src.rpm or rpmbuild --rebuild package.src.rpm, the embedded %(...) payload executes. Review the Red Hat CVE-2026-95521 advisory and the Red Hat Bug Report 2537812 for upstream analysis.

Detection Methods for CVE-2026-95521

Indicators of Compromise

Source RPM filenames or spec files containing the literal substring %( in source basenames or Source: directives.
Unexpected child processes of rpm, rpmbuild, or /bin/sh spawned during package installation or rebuild operations.
Outbound network connections or shell utility execution (curl, wget, nc, bash -c) originating from build user accounts shortly after .src.rpm processing.

Detection Strategies

Scan incoming .src.rpm artifacts for %( patterns in header tags using rpm -qpl and rpm --querytags before installation.
Alert on process trees where rpm or rpmbuild is the parent of interactive shells or networking tools.
Correlate package processing events with file write activity outside the build root to catch persistence attempts.

Monitoring Recommendations

Forward auditd execve events for rpm and rpmbuild to a centralized logging platform and baseline normal child-process behavior.
Monitor developer workstations and CI runners for anomalous command execution following source RPM operations.
Track mirror and repository integrity to detect unauthorized .src.rpm uploads.

How to Mitigate CVE-2026-95521

Immediate Actions Required

Apply vendor-supplied rpm updates as soon as they are available from your distribution.
Quarantine untrusted .src.rpm files and refuse to install source packages from unverified origins.
Rebuild source RPMs inside isolated, non-privileged containers or virtual machines until patched binaries are deployed.

Patch Information

Refer to the Red Hat CVE-2026-95521 advisory and the Red Hat Bug Report 2537812 for patched package versions and errata identifiers specific to your distribution.

Workarounds

Inspect source RPM headers with rpm -qip and rpm -qpl before installation, rejecting any package whose basenames contain %( sequences.
Restrict rpm -i and rpmbuild --rebuild operations to dedicated low-privilege build accounts without access to developer secrets or production credentials.
Enforce signature verification with rpm --checksig and reject unsigned source packages from external sources.

bash

# Configuration example: pre-flight check for malicious macro constructs
for pkg in *.src.rpm; do
  if rpm -qpl "$pkg" | grep -q '%('; then
    echo "REJECT: $pkg contains suspicious macro construct"
  fi
done