Pulp-container Credential Reuse in Registry Authentication

Executive Summary

CVE-2026-103868 is a flaw in Red Hat's pulp-container software where registry credentials (username, password, or bearer token) from one authenticated container remote are incorrectly reused for subsequent downloads in the same worker process. This happens because credentials are cached process-wide across Pulp domains until the worker exits. An attacker with sync permissions who points a remote to a malicious server they control can extract credentials intended for a different remote.

Useful 0 Not Useful 0

Detection Guidance

Monitor Pulp worker processes for unexpected credential reuse by checking logs for sync operations from untrusted remotes. Inspect pulp-container worker logs for multiple sync tasks using the same credentials across different remotes.

Useful 0 Not Useful 0

Impact Analysis

An attacker could gain access to credentials for other container remotes, potentially allowing them to access or manipulate container images in upstream registries. This requires the attacker to have sync permissions and modify the remote URL. The impact is limited to confidentiality, as integrity and availability are not affected.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data stored in container images, potentially violating GDPR (data protection) or HIPAA (health information privacy) if such data is exposed. Organizations using pulp-container must ensure credentials are properly managed to maintain compliance.

Useful 0 Not Useful 0

Mitigation Strategies

Apply available security updates for pulp-container. Avoid syncing authenticated container remotes from untrusted sources. Restart Pulp workers after updates to clear cached credentials.

Useful 0 Not Useful 0