All vulnerabilities
CVE-2017-1000469GHSA-96hw-v598-jvghPYSEC-2026-314

Cobbler vulnerable to arbitrary code execution

n/a cobblerpipLibraries & packages
Open in ThreatlineRecord JSON
CVSS
9.8Critical
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)5.56%Chance of exploitation activity in the next 30 days, higher than 92% of CVEs. Scored 27 Oct 2026FIRST EPSS
Fixed in3.0.0Fixed versionGitHub
Published3 Jan 2018Updated 27 Oct 2026CVE List

What fixes it

  • 3.0.0cobbler, pipGitHub
  • 3.0.0cobbler, PyPIOSVpip install "cobbler>=3.0.0"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Cobbler version up to 2.8.2 is vulnerable to a command injection vulnerability in the "add repo" component resulting in arbitrary code execution as root user.

Text from CVE List

Affected versions 4

  • cobbler, pip<= 2.8.2GitHub
  • n/aaffected: n/aCVE List
  • cobbler, PyPIfrom first release, fixed in 3.0.0OSV
  • cobbler, PyPI0.6.3-2OSV

References 6