CVE-2026-87910

What it actually does

Python tarfile’s extraction filters are bypassed on hosts that cannot create links. When a link member is extracted, tarfile falls back to writing a regular archive member and invokes the filter twice (once for the member, once for the link location) but ignores one return value. A member that should be skipped if either call returns None can still be written, enabling path traversal and arbitrary file overwrite relative to the extraction root (high integrity impact; no confidentiality or availability impact in the CVSS vector).

Why it matters to the business

Any service, installer, CI/CD job, or developer workflow that unpacks tar archives with Red Hat Python 3.10–3.14 can have application files, configs, or scripts overwritten if an untrusted archive is extracted on a system without link support. Python’s ecosystem prevalence makes the unpatched runtime footprint large even though conditions are constrained (user/process must extract the archive; Attack Requirements Present). Risk of mass exploitation is currently low: not in CISA KEV, not associated with ransomware, exploit maturity is None, and EPSS is low and flat (~0.0064 over 30 days, 0% change). Treat as a prioritized patch for extraction-facing systems rather than an emergency KEV-style outage.

How an attack unfolds

An attacker delivers a crafted tar archive whose link members are intended to be rejected by tarfile’s data/tar filters. The victim or an automated Python process extracts it (extract/extractall) on a platform where link creation is unsupported, so tarfile takes the fallback write path. Because one of the two filter results is discarded, a member that should have been skipped is written outside or over the intended tree. The attacker then abuses the overwritten file (configuration, plugin, or later-executed code) for integrity compromise. No named threat actors or campaigns are tied to this CVE, and there is no public exploit maturity.

How to fix it

Patch Red Hat Python packages to the RHSA-2026:67575 builds: python3-10-main 3.10.21-1.2.hum1, python3-11-main 3.11.16-1.3.hum1, python3-12-main 3.12.14-1.2.hum1, python3-13-main 3.13.15-1.2.hum1, python3-14-main 3.14.7-1.2.hum1. Until upgraded, do not extract untrusted tarballs with tarfile on systems that lack link support; extract only into dedicated, least-privilege directories; disable or gate extract/extractall on untrusted input; and prefer isolated/sandboxed unpackers for third-party archives.

How to confirm the fix worked

Inventory hosts for python3-10/11/12/13/14-main and confirm RPM versions are at or above the RHSA-2026:67575 fixed releases. Search application and automation code for tarfile.extract, extractall, and custom tarfile.TarFile usage, especially on Windows or other link-limited platforms. After patching, regression-test that extraction of archives containing links skips the member when either filter call returns None, and that files are not written outside the destination directory. Verify no remaining processes load the unpatched libpython/tarfile from the old packages.

Typical attack path

1. Attacker builds a tar archive that uses link members so that one filter invocation would skip the member while the ignored result still allows a write.
2. Archive is delivered via a trusted-looking channel (uploaded artifact, dependency, email, CI input, or software package).
3. A user or low-privilege Python process extracts the archive with tarfile filters that are expected to block unsafe members.
4. On a host that cannot create links, tarfile falls back to extracting the member and ignores one filter return value.
5. A skipped-in-intent member is written, overwriting or placing a file outside the intended extraction directory.
6. Attacker leverages the integrity break (malicious config or code picked up on a later run) for follow-on access.

How to detect it

There are no public in-the-wild campaigns or unique malware families for this issue, so hunting is for suspicious extraction outcomes rather than a known implant. Review application and syslog around Python processes that unpack .tar/.tar.gz/.tgz/.tar.bz2, especially on hosts without link support. Look for tarfile.FilterError/ExtractError, unexpected files created outside the intended unpack directory shortly after a Python extract, and FIM alerts on config, plugin, or executable paths following archive handling. Correlate user-upload, CI artifact, and package-install events with those writes. Absence of these artifacts does not prove non-exploitation; prioritize confirming patched package versions.

What your security team should do

• Apply RHSA-2026:67575 to all affected Red Hat Python 3.10–3.14 packages as a scheduled but prompt patch, with extraction-facing and CI/build hosts first.
• Inventory and restrict Python tarfile extraction of untrusted archives, especially on hosts that do not support links.
• Turn on file-integrity monitoring around unpack destinations and application config/plugin directories.
• Do not treat this as KEV/ransomware-urgent; EPSS is low and stable, but do not defer indefinitely given Python’s install base.
• After patching, re-scan for leftover unpatched python3-*-main packages and document residual extractall call sites.