CVE-2026-84837

What it actually does

rpmbuild incorrectly handles untrusted tarball path and filename values when invoked with tarball-oriented flags (-t*). Shell metacharacters in those names are interpreted by the shell rather than treated as literal filesystem components, producing command injection and arbitrary command execution as the build user. Impact is local to the build host, requires a user to (or an automation pipeline to) process the attacker-influenced artifact, and can fully compromise confidentiality, integrity, and availability of that build context.

Why it matters to the business

Successful abuse can steal source, credentials, and signing material from CI or packaging jobs, inject malicious content into produced RPMs, or halt software delivery. The issue is most material where pipelines accept externally supplied artifact names. It is not listed in CISA KEV, has no reported ransomware use, and published exploit maturity is none about a month after disclosure—so urgency is driven by exposure of untrusted-ingest build systems rather than mass in-the-wild exploitation. Downstream product lists and patched package versions were not supplied with this record, so organizations must inventory rpm/rpmbuild usage themselves.

How an attack unfolds

An attacker who can influence the path or filename of a tarball that a developer or automated workflow later feeds to rpmbuild (for example via a contribution, download, or CI artifact ingest) embeds shell metacharacters in that name. When rpmbuild is run with tarball-processing options, those characters are interpreted by the shell. Commands then run with the privileges of the account performing the build, which may read secrets, alter the workspace, or disrupt the job. No named threat actors or KEV-linked campaigns are associated with this flaw, and public exploit maturity is none; the realistic path is opportunistic abuse of poorly isolated CI that trusts external archive names.

How to fix it

Upgrade the rpm toolchain to a vendor-patched release as soon as your distribution publishes one; this record does not include exact fixed versions. Until then, do not pass unsanitized external paths or filenames to rpmbuild -ta/-tb/-ts (or equivalent -t* usage). Constrain artifact names to a strict allowlist (for example alphanumeric, dot, underscore, hyphen), resolve and copy inputs to a trusted internal name before invoking rpmbuild, avoid wrapping rpmbuild in a shell that expands the filename, run builds as an unprivileged dedicated user without access to signing keys or production credentials, and isolate CI runners so a compromised job cannot reach other pipelines.

How to confirm the fix worked

Inventory hosts and CI images for rpm/rpmbuild and note the installed version against your distro security tracker. Search pipeline definitions and wrapper scripts for rpmbuild invocations with -ta, -tb, -ts, or other -t* flags and for jobs that use contributor- or download-supplied archive names. Confirm that ingest paths rewrite names onto an allowlist and that rpmbuild is not invoked via an interpolating shell. After patching, verify the package version and re-run a representative packaging job using only internally renamed archives. Do not validate by submitting malicious filenames.

Typical attack path

1. Gain the ability to choose or rename a tarball that a packaging or CI workflow will pass to rpmbuild with tarball-processing flags.
2. Cause that workflow to ingest the archive without sanitizing the path or filename.
3. Wait for rpmbuild -t* to be invoked so the shell evaluates metacharacters in the name.
4. Run follow-on commands as the build user (read secrets, modify sources or output packages, or disrupt the job).
5. If the pipeline publishes artifacts, optionally persist by tampering with packages or build configuration rather than remaining on the builder.

How to detect it

Hunt historically on build hosts and CI runners rather than on end-user workstations. Review process-creation logs (auditd, EDR, syslog) for rpmbuild with -ta/-tb/-ts (or other -t*) whose command line includes unusual filename characters, and for rpmbuild as parent of a shell or of unexpected helpers. Inspect CI job logs, artifact-ingest logs, and workspace listings around the publication window (from 2026-09-02 onward) for tarball names that do not match normal packaging conventions. Because exploit maturity is none and no named actors are tied to this CVE, treat hits as suspected pipeline abuse or poisoned contributions, not as a known campaign fingerprint. Preserve the job workspace, the ingested archive name, and the rpmbuild command line if a hit is found.

• rpmbuild -ta
• rpmbuild -tb
• rpmbuild -ts
• rpmbuild -t
• auditd execve argv containing rpmbuild and a filename with ; ` $ ( ) | &
• process parent rpmbuild with child /bin/sh
• process parent rpmbuild with child /bin/bash
• process parent rpmbuild with child curl
• process parent rpmbuild with child wget
• CI log lines showing .tar/.tar.gz/.tgz names containing ; ` $ ( ) | &

What your security team should do

• Prioritize builders and CI jobs that run rpmbuild -t* on externally named tarballs; patch rpm there first even though this CVE is not in KEV.
• Block or rewrite untrusted archive names at ingest so only allowlisted characters reach rpmbuild.
• Drop build-user privileges, isolate runners, and keep signing keys and production credentials out of the rpmbuild environment.
• Alert on rpmbuild spawning shells or unexpected children and on tarball names containing shell metacharacters in build logs.
• Track vendor fixed versions (none were provided in this record) and confirm exploit maturity remains none before lowering watchfulness on exposed pipelines.