PT-2026-37203 · Pelican · Pelican

Brian Bockelman + 1 · Published 2026-05-04 · Updated 2026-05-09 · CVE-2026-42571

Positive Technologies (AI Summary)

CVSS v4.0

9.0

Critical

Base vector

AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions Pelican versions 7.21.0 through 7.21.4 Pelican versions 7.22.0 through 7.22.2 Pelican versions 7.23.0 through 7.23.2 Pelican versions 7.24.0 through 7.24.1

Description A privilege escalation issue exists in the Web User Interface (WebUI) that allows any user authenticated via OAuth to obtain admin privileges under specific configurations. This occurs when OIDC logins are enabled and the attacker knows or guesses an admin identifier for an administrator who has not yet logged into the WebUI. The issue is particularly relevant when the following configuration variables are enabled:

• Server.UIAdminUsers: affected if listed admin users or the default admin account have not previously logged in.
• Server.AdminGroups: affected if Issuer.GroupSource is set to internal and a group admin has not previously logged in.

An attacker can create database records that grant them admin privileges upon subsequent login, enabling them to modify server configurations, create persistent API tokens, and change admin passwords. Depending on the service, this could lead to high data tampering risks, such as modifying configurations to point to different registries, poisoning federation-wide namespaces, or exposing protected paths.

Recommendations Upgrade to version 7.21.5 or later for those on the 7.21 series. Upgrade to version 7.22.3 or later for those on the 7.22 series. Upgrade to version 7.23.3 or later for those on the 7.23 series. Upgrade to version 7.24.2 or later for those on the 7.24 series. As a temporary workaround, disable the vulnerable configuration by removing or commenting out the Server.UIAdminUsers and Server.AdminGroups settings in the pelican.yaml file.

Fix

LPE

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-42571

GHSA-RPFR-X88X-XWCW

Affected Products

Pelican

References · 6

• https://osv.dev/vulnerability/GHSA-rpfr-x88x-xwcw · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42571 · Security Note
• https://github.com/PelicanPlatform/pelican/security/advisories/GHSA-rpfr-x88x-xwcw · Note
• https://github.com/PelicanPlatform/pelican · Note
• https://github.com/PelicanPlatform/pelican/commit/7f73b9c3e677a0ae4a0ec465c5d98bb8bd948854 · Note
• https://t.me/CVEtracker/53234 · Telegram Post