ADVISOR_BACKEND-95b1ba7-002 from Project Glasswing AI-SAST audit of redhatinsights/advisor-backend (commit 95b1ba7, audit date 2026-07-27). Multiple code paths deserialize YAML with the unsafe full Loader (yaml.Loader), which instantiates arbitrary Python objects via YAML tags (CWE-502). tasks/views/task.py line 95 runs yaml.load(task.playbook, yaml.Loader) on every playbook fetch. Task.playbook rows are authored through the Turnpike-gated InternalTaskViewSet and through the unauthenticated content-import path (companion finding, filed separately: flaw 74d89d0d-5a99-47bb-abd3-3518cf4e63a2, /private/import_content/). The import command additionally fetches YAML dumps over HTTP(S) from a configurable content server and full-Loads them (import_content.py lines 75, 100).

Source: advisor-backend-security-audit.md#ADVISOR_BACKEND-95b1ba7-002. Standalone CVSS (privileged-author prerequisite): CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H (7.2).

Chained CVSS (effective prerequisite once the sibling unauthenticated import_content finding is exploited first): CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8). An attacker who can POST to /private/import_content/ stores a playbook whose YAML carries a python/object/apply tag (e.g. !!python/object/apply:os.system); the next caller of GET /api/tasks/v1/task/<slug>/playbook, or the content compiler, triggers yaml.load with the full Loader, executing code in the advisor-backend pod, which holds shared DB credentials and serves every tenant. This chain is a network-adjacent unauthenticated RCE with no credential required end-to-end.

CWE-502. Triage verdict: confirmed true positive (Christopher Lusk, 2026-08-19). Impact rated Critical per the chained unauthenticated-RCE path, consistent with severity standard (Critical requires unauthenticated RCE). Engineering tracking: RHINENG-29269 (Mark Huth, fix in progress).