CVE-2026-84837

CVE-2026-84837 is an OS command injection flaw (CWE-78) in the RPM package manager's build tool, rpmbuild, in its tarball-processing modes invoked with the -t options (rpmbuild -t*). It is triggered when the path or filename of a tarball passed to rpmbuild -t* contains shell metacharacters, which get handed to a shell instead of being treated as literal text; an attacker needs a way to influence that name, which typically occurs in automated build or CI pipelines that ingest externally supplied artifact names. Successful exploitation yields arbitrary command execution with the privileges of the build user, enabling theft of secrets from the build environment or disruption of builds, and the CVSS vector (AV:L/UI:R) confirms this is a local, user-interaction-dependent flaw rather than a remotely exploitable one. Anyone running rpmbuild -t* on attacker-influenced tarball names is affected, most plausibly packaging teams and CI systems on RPM-based distributions (Red Hat is the assigning CNA), while systems that merely install RPM packages are unlikely to be exposed. There is no public proof-of-concept, no CISA KEV listing, and no known in-the-wild exploitation; EPSS estimates roughly a 1.2% probability of exploitation within 30 days.

What to do: Inventory build servers and CI jobs that invoke rpmbuild with tarball modes on externally supplied artifact names, and apply the rpm security update from your distribution's advisory when released (fixed versions are not stated in this data). Until patched, sanitize or constrain tarball paths and filenames to exclude shell metacharacters, and run builds as an unprivileged user inside an isolated build container to limit impact. Systems that only install RPM packages without building from tarballs require no urgent action.