CVE Intelligence
Analysis AI-assisted

CVE-2026-42571: Pelican WebUI privilege escalation to admin via OAuth

CVE-2026-42571 is a critical privilege escalation flaw (CWE-863, Incorrect Authorization) in the Web User Interface of Pelican, a platform for creating data federations. According to the record, any user authenticated to the WebUI via OAuth can gain admin privileges under certain configurations. The issue is patched in 7.21.5, 7.22.3, 7.23.3 and 7.24.2, and no confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-42571 affects the Web User Interface of Pelican, a platform for creating data federations. The record classifies it as Incorrect Authorization (CWE-863) and reports a critical CVSS 4.0 score of 9 from the GitHub Security Advisories CNA. The advisory is available at GHSA-rpfr-x88x-xwcw.

Impact

  • Any user authenticated to the WebUI via OAuth may gain administrator privileges under certain configurations.
  • The CVSS 4.0 vector in the record indicates a network attack vector, low privileges required, and high impact on confidentiality, integrity and availability of the vulnerable system.
  • The specific configurations that enable the escalation are not described in the record.

Affected products and versions

  • Product: Pelican, WebUI component.
  • Affected ranges according to the record:
  • 7.21.0 up to before 7.21.5
  • 7.22.0 up to before 7.22.3
  • 7.23.0 up to before 7.23.3
  • 7.24.0 up to before 7.24.2
  • Fixed versions stated in the record: 7.21.5, 7.22.3, 7.23.3 and 7.24.2.

Exploitation status

The record shows this CVE is not listed in the CISA KEV catalog. No confirmed exploitation appears in the sources consulted. The EPSS probability in the record is 0.00396 (percentile 0.31954), but the EPSS date in the record is later than the publication date, so this figure should be treated with caution.

Remediation and mitigation

  • Upgrade to 7.21.5, 7.22.3, 7.23.3 or 7.24.2, according to your release branch.
  • Until the upgrade is complete, restrict WebUI access to trusted users and networks and review which identity providers can sign in through OAuth.
  • Audit current administrator accounts and role assignments for grants that were not expected.
  • Review the referenced commit and the advisory for details on the change.

Detection guidance

  • Review WebUI and authentication logs for role or permission changes, especially elevation to administrator by non-administrative accounts.
  • Monitor for newly created administrative accounts or OAuth-linked identities that gain admin rights.
  • Alert on configuration changes that affect authentication or authorization settings.

Limitations of the available information

  • The record does not specify which configurations enable the escalation, so exposure cannot be determined from the record alone.
  • The record does not state whether versions before 7.21.0 or other release lines are affected.
  • The record contains a CVSS score from the GitHub CNA only; no NVD score is present.
  • The relationship between the referenced commit and the fix is not stated explicitly in the record.

Frequently asked questions

Is this vulnerability being actively exploited?

The record shows it is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.

Which Pelican versions are fixed?

According to the record, the issue is patched in 7.21.5, 7.22.3, 7.23.3 and 7.24.2, depending on the release line.

Who should be concerned?

Deployments that use the Pelican WebUI with OAuth sign-in in the affected version ranges should review their exposure, although the record does not specify which configurations enable the escalation.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.