by Kastro
Paper/Archive/CVE-2026-42571

CVE-2026-42571

PelicanPlatform pelican — Privilege Escalation Attack affecting Pelican Web UI

EPSS 0.3%CVSS 9.0
critical.is priorityof 100
32
CVSS 9.0 (CNA)9.0 / 10 × 3027.0Not in CISA KEV+300.0EPSS percentile 25.1.251 × 205.0No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Pelican is a platform for creating data federations. From versions 7.21.0 to before 7.21.5, 7.22.0 to before 7.22.3, 7.23.0 to before 7.23.3, and 7.24.0 to before 7.24.2, there is a a privilege escalation vulnerability affecting Pelican's Web User Interface (WebUI). This attack allows any user authenticated to the WebUI via OAuth to gain admin privileges under certain configurations. This issue has been patched in versions 7.21.5, 7.22.3, 7.23.3, and 7.24.2.

Affected

ProductAffectedFixed inSource
pelican>= 7.21.0, < 7.21.5–CNA
pelican>= 7.22.0, < 7.22.3–CNA
pelican>= 7.23.0, < 7.23.3–CNA
pelican>= 7.24.0, < 7.24.2–CNA

Scores by source

GitHub_M (CNA)9.0CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refgithub.com/PelicanPlatform/pelican/security/advisories/GHSA-rpfr-x88x-xwcwrefgithub.com/PelicanPlatform/pelican/commit/7f73b9c3e677a0ae4a0ec465c5d98bb8bd948854