CVE-2026-112210: Rhc: rhc: local privilege escalation via symlink following in rhc-canonical-facts.service
A flaw was found in the rhc-canonical-facts.service systemd unit shipped with rhc. The service runs as root and operates on a file inside a directory owned by an unprivileged system user without verifying that the file is not a symbolic link. A local attacker who has already compromised the privileged yggdrasil system service account can exploit this to gain ownership of arbitrary files, leading to privilege escalation to root.
Other sources
A symlink-following vulnerability was found in rhc-canonical-facts.service. The service runs as root and performs touch, chown yggdrasil:yggdrasil, and StandardOutput=truncate: on /var/lib/yggdrasil/canonical-facts.json — a path inside a directory owned by the unprivileged yggdrasil user (via StateDirectory=yggdrasil). None of these operations reject symlinks.
An attacker with code execution as yggdrasil can replace canonical-facts.json with a symlink to an arbitrary file. When the service triggers (daily timer or rhc connect), the target file's ownership is transferred to yggdrasil and its content is truncated and overwritten.
The service has no User= directive, no systemd sandboxing, and no confined SELinux domain (systemd-analyze security: 9.6 UNSAFE). On RHEL 10.2 with SELinux Enforcing, the full exploit chain was confirmed against varlibt and systemdunitfilet targets. The /etc/shadow path is blocked by SELinux (initt cannot open shadowt for StandardOutput), but targeting systemd unit files provides a path to root.
Introduced in rhc v0.3.0. Versions prior to 0.3.0 do not ship this service file.
External reference: PSIRTSUPT-25922
— Red Hat
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Exploitation requires local code execution as the yggdrasil system service account. An attacker must first compromise that privileged service account; the issue is not described as remotely exploitable without that prerequisite.
What triggers the vulnerable root-level operation?
The operation can run through the daily timer or when rhc connect is executed. At that time, the service processes /var/lib/yggdrasil/canonical-facts.json as root.
What is the impact of successful exploitation?
An attacker can replace canonical-facts.json with a symlink to an arbitrary file. The root-run service can then change the target's ownership to yggdrasil and truncate and overwrite its contents, enabling escalation to root.
How can I determine whether a host is exposed?
Check whether rhc-canonical-facts.service is present and operates on /var/lib/yggdrasil/canonical-facts.json with root privileges. The described exposure depends on the yggdrasil-owned StateDirectory and the service performing touch, chown, or StandardOutput=truncate operations without rejecting symbolic links.