Bug 2502072 (CVE-2026-9323) - CVE-2026-9323 urwid: Urwid: Predictable session IDs lead to remote code execution and information disclosure
Summary: CVE-2026-9323 urwid: Urwid: Predictable session IDs lead to remote code execu...
Keywords:
Status: NEW
Alias: CVE-2026-9323
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2502747 2502748 2502745 2502746
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-07-18 15:01 UTC by OSIDB Bzimport
Modified: 2026-08-26 14:59 UTC (History)
3 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2026:57637 0 None None None 2026-08-20 18:08:15 UTC
Red Hat Product Errata RHSA-2026:57638 0 None None None 2026-08-20 17:55:25 UTC
Red Hat Product Errata RHSA-2026:58561 0 None None None 2026-08-24 02:24:41 UTC
Red Hat Product Errata RHSA-2026:58562 0 None None None 2026-08-24 02:26:02 UTC
Red Hat Product Errata RHSA-2026:58952 0 None None None 2026-08-24 10:55:04 UTC
Red Hat Product Errata RHSA-2026:58953 0 None None None 2026-08-24 10:52:32 UTC
Red Hat Product Errata RHSA-2026:58954 0 None None None 2026-08-24 10:05:10 UTC
Red Hat Product Errata RHSA-2026:58955 0 None None None 2026-08-24 10:55:09 UTC
Red Hat Product Errata RHSA-2026:59198 0 None None None 2026-08-24 21:19:29 UTC
Red Hat Product Errata RHSA-2026:60353 0 None None None 2026-08-26 14:59:01 UTC

Description OSIDB Bzimport 2026-07-18 15:01:31 UTC
The urwid web display backend (urwid/display/web.py) generates web session identifiers (urwid_id) in Screen.start() by concatenating two random.randrange(10**9) calls that use Python's Mersenne Twister PRNG, which is not cryptographically secure. Each call consumes approximately 30 bits of PRNG state, and the Mersenne Twister internal state is approximately 19,937 bits, so an attacker who observes approximately 334 session IDs (for example via the X-Urwid-ID HTTP response header) can fully reconstruct the internal state and predict all past and future session IDs (Path B). The same identifier is also used as the filename of a FIFO created in the world-listable /tmp directory (for example /tmp/urwid375487765176907690.in), so any local user on the host can list /tmp to enumerate active session tokens directly (Path A). With a valid session ID, an attacker can read the victim's terminal screen via the polling endpoint, inject keystrokes into the victim's session (yielding OS-level code execution with the session owner's privileges if the session runs a shell), and inject exit sequences or flood the FIFO to terminate or crash the session. A prior Bandit S311 warning on this usage was suppressed with # noqa: S311 rather than fixed

Comment 2 Ashleey 2026-07-29 23:43:00 UTC
Interesting discussion. Whatever platform people choose, I think it's important to stick with licensed operators, read the terms carefully, and gamble responsibly. If you're looking for more information or want to compare features, https://win.bet/ro is one option to explore before deciding where to play.

Comment 3 errata-xmlrpc 2026-08-20 17:55:23 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On

Via RHSA-2026:57638 https://access.redhat.com/errata/RHSA-2026:57638

Comment 4 errata-xmlrpc 2026-08-20 18:08:14 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.8 Telecommunications Update Service

Via RHSA-2026:57637 https://access.redhat.com/errata/RHSA-2026:57637

Comment 5 errata-xmlrpc 2026-08-24 02:24:40 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:58561 https://access.redhat.com/errata/RHSA-2026:58561

Comment 6 errata-xmlrpc 2026-08-24 02:26:01 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:58562 https://access.redhat.com/errata/RHSA-2026:58562

Comment 7 errata-xmlrpc 2026-08-24 10:05:09 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2026:58954 https://access.redhat.com/errata/RHSA-2026:58954

Comment 8 errata-xmlrpc 2026-08-24 10:52:31 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions

Via RHSA-2026:58953 https://access.redhat.com/errata/RHSA-2026:58953

Comment 9 errata-xmlrpc 2026-08-24 10:55:03 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:58952 https://access.redhat.com/errata/RHSA-2026:58952

Comment 10 errata-xmlrpc 2026-08-24 10:55:08 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:58955 https://access.redhat.com/errata/RHSA-2026:58955

Comment 11 errata-xmlrpc 2026-08-24 21:19:27 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On

Via RHSA-2026:59198 https://access.redhat.com/errata/RHSA-2026:59198

Comment 12 errata-xmlrpc 2026-08-26 14:59:00 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10.0 Extended Update Support

Via RHSA-2026:60353 https://access.redhat.com/errata/RHSA-2026:60353


Note You need to log in before you can comment on or make changes to this bug.