CVE-2026-112210
Received Received - Intake

Privilege Escalation via Symbolic Link in rhc

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: redhat-SADP

Description
A flaw was found in the rhc-canonical-facts.service systemd unit shipped with rhc. The service runs as root and operates on a file inside a directory owned by an unprivileged system user without verifying that the file is not a symbolic link. A local attacker who has already compromised the privileged yggdrasil system service account can exploit this to gain ownership of arbitrary files, leading to privilege escalation to root.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-112210
EUVD
EUVD-2026-104247

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Red Hat Red Hat Enterprise Linux 10 *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-59 The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-112210 is a local privilege escalation flaw in the rhc-canonical-facts.service systemd unit of the Red Hat Connector (rhc). The service runs as root and operates on files in a directory owned by an unprivileged user without checking for symbolic links. A local attacker who has compromised the yggdrasil system service account can exploit this to gain ownership of arbitrary files and escalate privileges to root.

Detection Guidance

Check if the rhc-canonical-facts.service is active using systemctl is-active rhc-canonical-facts.service. Verify if the service file exists at /etc/systemd/system/rhc-canonical-facts.service. Inspect the service configuration for improper file operations without symlink checks.

Impact Analysis

An attacker with access to the yggdrasil account could replace a file with a symlink, causing the service to change ownership and truncate the target file. This could lead to denial of service, data loss, or full system compromise if combined with other exploits. SELinux in Enforcing mode limits some impacts.

Compliance Impact

This vulnerability primarily affects system integrity and availability by allowing privilege escalation to root through local access. While it does not directly expose sensitive data, unauthorized root access could lead to data breaches or unauthorized system modifications, which may violate compliance requirements under GDPR (data protection) and HIPAA (health data security).

Mitigation Strategies
  • Stop and disable the vulnerable timer with systemctl stop rhc-canonical-facts.timer and systemctl disable rhc-canonical-facts.timer.
  • Update rhc to version 0.3.0 or later if available to remove the vulnerable service file.
  • Ensure SELinux is in Enforcing mode to limit potential exploit paths.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-112210. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart