CVE-2026-42571
Last modified
CVE-2026-42571 is a critical-severity vulnerability rated 9/10 on the CVSS scale. Pelican is a platform for creating data federations. From versions 7.21.0 to before 7.21.5, 7.22.0 to before 7.22.3, 7.23.0 to before 7.23.3, and 7.24.0 to before 7.24.2, there is a a privilege escalation vulnerability affecting Pelican's Web User Interface (WebUI). EPSS estimates a 0.32% chance of exploitation in the next 30 days.
Description
Pelican is a platform for creating data federations. From versions 7.21.0 to before 7.21.5, 7.22.0 to before 7.22.3, 7.23.0 to before 7.23.3, and 7.24.0 to before 7.24.2, there is a a privilege escalation vulnerability affecting Pelican's Web User Interface (WebUI). This attack allows any user authenticated to the WebUI via OAuth to gain admin privileges under certain configurations. This issue has been patched in versions 7.21.5, 7.22.3, 7.23.3, and 7.24.2.
Metrics
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-42571?
How severe is CVE-2026-42571?
How do I fix CVE-2026-42571?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-42566Meshtastic is an open source mesh networking solution. Prior…7.5
- CVE-2026-42567Svelte is a performance oriented web framework. From version…7.5
- CVE-2026-42568Yamcs is a mission control framework. Prior to versions 5.13…4.3
- CVE-2026-42569phpVMS is a PHP application to run and simulate an airline. …9.4
- CVE-2026-4257The Contact Form by Supsystic plugin for WordPress is vulner…9.8
- CVE-2026-42570Svelte devalue is a JavaScript library that serializes value…7.5
- CVE-2026-42572Hatchet is a platform for orchestrating background tasks, AI…6.5
- CVE-2026-42573Svelte is a performance oriented web framework. Prior to ver…6.1
- CVE-2026-42574apko allows users to build and publish OCI container images …7.5
- CVE-2026-42575apko allows users to build and publish OCI container images …7.5
- CVE-2026-42576apko allows users to build and publish OCI container images …6.5
- CVE-2026-42577Netty is an asynchronous, event-driven network application f…7.5
Are you affected by CVE-2026-42571?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST