Bug 2519653 (CVE-2026-76595)

Summary: CVE-2026-76595 advisor-backend: Unsafe YAML deserialization of associate-editable Task playbook (yaml.Loader)
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: urgent Docs Contact:
Priority: urgent    
Version: unspecifiedCC: kaycoth, security-response-team
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in advisor-backend. Multiple code paths within the application deserialize YAML (YAML Ain't Markup Language) with an unsafe full Loader, which can instantiate arbitrary Python objects via YAML tags. An unauthenticated remote attacker can exploit this by submitting specially crafted YAML input, leading to remote code execution (RCE) within the `advisor-backend` pod. This compromise could allow access to shared database credentials and impact all tenants.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-08-19 14:39:52 UTC 
ADVISOR_BACKEND-95b1ba7-002 from Project Glasswing AI-SAST audit of redhatinsights/advisor-backend (commit 95b1ba7, audit date 2026-07-27). Multiple code paths deserialize YAML with the unsafe full Loader (yaml.Loader), which instantiates arbitrary Python objects via YAML tags (CWE-502). tasks/views/task.py line 95 runs yaml.load(task.playbook, yaml.Loader) on every playbook fetch. Task.playbook rows are authored through the Turnpike-gated InternalTaskViewSet and through the unauthenticated content-import path (companion finding, filed separately: flaw 74d89d0d-5a99-47bb-abd3-3518cf4e63a2, /private/import_content/). The import command additionally fetches YAML dumps over HTTP(S) from a configurable content server and full-Loads them (import_content.py lines 75, 100).

Source: advisor-backend-security-audit.md#ADVISOR_BACKEND-95b1ba7-002. Standalone CVSS (privileged-author prerequisite): CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H (7.2).

Chained CVSS (effective prerequisite once the sibling unauthenticated import_content finding is exploited first): CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8). An attacker who can POST to /private/import_content/ stores a playbook whose YAML carries a python/object/apply tag (e.g. !!python/object/apply:os.system); the next caller of GET /api/tasks/v1/task/<slug>/playbook, or the content compiler, triggers yaml.load with the full Loader, executing code in the advisor-backend pod, which holds shared DB credentials and serves every tenant. This chain is a network-adjacent unauthenticated RCE with no credential required end-to-end.

CWE-502. Triage verdict: confirmed true positive (Christopher Lusk, 2026-08-19). Impact rated Critical per the chained unauthenticated-RCE path, consistent with severity standard (Critical requires unauthenticated RCE). Engineering tracking: RHINENG-29269 (Mark Huth, fix in progress).