CVE-2022-26526

Anaconda Anaconda3 (Anaconda Distribution) through 2021.11.0.0 and Miniconda3 through 4.11.0.0 can create a world-writable directory under %PROGRAMDATA% and place that directory into the system PATH environment variable. Thus, for example, local users can gain privileges by placing a Trojan horse file into that directory. (This problem can only happen in a non-default installation. The person who installs the product must specify that it is being installed for all users. Also, the person who installs the product must specify that the system PATH should be changed.

• CWE-732

• https://docs.conda.io/en/latest/miniconda.htmlProduct, Vendor Advisory
• https://github.com/continuumio/anaconda-issues/issuesIssue Tracking, Third Party Advisory
• https://improsec.com/tech-blog/privilege-escalation-vulnerability-in-anaconda3-and-miniconda3Exploit, Third Party Advisory
• https://repo.anaconda.com/miniconda/Vendor Advisory
• https://docs.conda.io/en/latest/miniconda.htmlProduct, Vendor Advisory
• https://github.com/continuumio/anaconda-issues/issuesIssue Tracking, Third Party Advisory
• https://improsec.com/tech-blog/privilege-escalation-vulnerability-in-anaconda3-and-miniconda3Exploit, Third Party Advisory
• https://repo.anaconda.com/miniconda/Vendor Advisory

Published

Mar 17, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-26519There is no limit to the number of attempts to authenticate …5.5
• CVE-2022-2652Depending on the way the format strings in the card label ar…6
• CVE-2022-26520In pgjdbc before 42.3.3, an attacker (who controls the jdbc …9.8
• CVE-2022-26521Abantecart through 1.3.2 allows remote authenticated adminis…7.2
• CVE-2022-26522The socket connection handler in aswArPot.sys in the Avast a…7.8
• CVE-2022-26523The socket connection handler in aswArPot.sys in the Avast a…5.3
• CVE-2022-26527Realtek Linux/Android Bluetooth Mesh SDK has a buffer overfl…6.5
• CVE-2022-26528Realtek Linux/Android Bluetooth Mesh SDK has a buffer overfl…6.5
• CVE-2022-26529Realtek Linux/Android Bluetooth Mesh SDK has a buffer overfl…6.5
• CVE-2022-2653With this vulnerability an attacker can read many sensitive …6.5
• CVE-2022-26530swaylock before 1.6 allows attackers to trigger a crash and …9.1
• CVE-2022-26531Multiple improper input validation flaws were identified in …7.8