Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2026-24049

25
FAUCET Score

CVE-2026-24049 is a medium-severity vulnerability affecting wheel_project wheel versions 0.40.0 through 0.46.1. It allows attackers to craft malicious wheel files that, upon unpacking, can modify file permissions of critical system files, potentially leading to privilege escalation or arbitrary code execution. The attack requires local access and user interaction (UI:R), with a CVSS score of 5.5. While there are no known active exploits, Metasploit modules, or ExploitDB entries, the vulnerability has garnered some community discussion, indicating awareness.

Impacted Technologies

VendorProductVersion(s)CPE
>= 0.40.0, < 0.46.2CPE matchmatch criteria
cpe:2.3:a:wheel_project:wheel:*:*:*:*:*:python:*:*

CVSS Data

CVSS version used by this source: 3.1

7.1HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
HIGH
Exploitability Score
1.8
Impact Score
5.2
CvssVersion
3.1

Exploit Intelligence

EPSS Score
0.31%
Probability of exploitation in next 30 days
EPSS Percentile
23.4%
Percentile rank of EPSS score among Peer Group
As of 2026-07-27
Model: v2026.06.15
This CVE's current EPSS score of 0.0031 is in the 28th percentile among its peer group of 5,760 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (116)

github_advisorypatch availablevia nvd_reference
View patch
pippatch availablevia ghsa
Product: wheelFixed in: 0.46.2
redhatpatch availablevia redhat_api
Product: Discovery 2 for RHEL 8Fixed in: discovery-cli-0:2.4.3-2.el8
View patch
redhatpatch availablevia redhat_api
Product: Discovery 2 for RHEL 9Fixed in: discovery-cli-0:2.4.3-2.el9
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 10Fixed in: python-wheel-1:0.41.2-5.el10_1.1
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 10.0 Extended Update SupportFixed in: python-wheel-1:0.41.2-5.el10_0.1
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: python3.12-wheel-0:0.41.2-4.el8_10
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 9Fixed in: python3.12-wheel-0:0.41.2-3.el9_7.1
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 9.4 Extended Update SupportFixed in: python3.12-wheel-0:0.41.2-3.el9_4.1
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 9.6 Extended Update SupportFixed in: python3.12-wheel-0:0.41.2-3.el9_6.1
View patch
redhatpatch availablevia redhat_api
Product: Network Observability (NETOBSERV) 1.11.0Fixed in: network-observability/network-observability-operator-bundle:sha256:6cc2706d0f934502e78d4f4585e0787a84e6751ff946568c21dbe7a87df699df
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Developer Hub 1.8Fixed in: rhdh/rhdh-hub-rhel9:sha256:114b288483eccad70b18159c9f75de9c061bdf9ee269198a75c3efeb68a43a2b
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift AI 2.25Fixed in: rhoai/odh-ml-pipelines-runtime-generic-rhel9:sha256:93436f429cc5fd089a464f22ed51a00505db398fe90c02565c83a6f72f265f45
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift AI 2.25Fixed in: rhoai/odh-ml-pipelines-runtime-generic-rhel9:sha256:816d8f81196bb0acfe5bbc792f9768916724bdecea3671172412eeb6948c4ff7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Quay 3.1Fixed in: quay/quay-rhel8:sha256:5cf58b1f54219b67c725f4a5066d9e757e7b5ece39d5de1a474a8be6a3490401
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Quay 3.15Fixed in: quay/quay-rhel8:sha256:a8daa359ab7a0bc9722b25fb87aa6fd253506632640bfe7f31c9c92868421ecb
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Quay 3.16Fixed in: quay/quay-rhel9:sha256:96588daff01f27db2ee335dcd957e9dec7f38a2c573e2968d9bc5835edc2957b
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Quay 3.9Fixed in: quay/quay-rhel8:sha256:8bd901f9d03817e599a73b4f4355236320bec1b803bd9507383277f27fde4319
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Satellite 6.18Fixed in: satellite/foreman-mcp-server-rhel9:sha256:ff4edaa605127e763ada037ec63ab7cc2054b853f079e7e28a0355234b24b2a0
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Trusted Artifact Signer 1.2Fixed in: rhtas/segment-reporting-rhel9:sha256:433385e5a9d3524baea007bf67ea785b2ee76b8218debf21fedf935950ab284e
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Trusted Artifact Signer 1.3Fixed in: rhtas/segment-reporting-rhel9:sha256:423348319f3ddebd67770f0d74ec7cc245be7a73fd1787793888238407e08508
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Discovery 2Fixed in: discovery/discovery-server-rhel9:sha256:cdf9b1062c961f67ee4f5dd3e23b26420517f884a51d2034efacff6847d47b5f
View patch
redhatpatch availablevia redhat_api
Product: Discovery 2 for RHEL 10Fixed in: discovery-cli-0:2.4.3-2.el10
View patch
ubuntupatch availablevia ubuntu_usn
Product: wheel (noble)Fixed in: 0.42.0-2ubuntu0.1~esm1
redhatno patchvia redhat_api
Product: Red Hat OpenShift Container Platform 4Fixed in: openshift4/ose-dpu-cni-rhel9
redhatno patchvia redhat_api
Product: Red Hat OpenShift Container Platform 4Fixed in: openshift4/ose-dpu-intel-ipu-vsp-rhel9
redhatno patchvia redhat_api
Product: Red Hat OpenShift Container Platform 4Fixed in: openshift4/ose-dpu-rhel9-operator
redhatno patchvia redhat_api
Product: Red Hat OpenShift Dev SpacesFixed in: devspaces/devspaces-operator-bundle
redhatno patchvia redhat_api
Product: Red Hat OpenShift Dev SpacesFixed in: devspaces/udi-base-rhel10
redhatno patchvia redhat_api
Product: Red Hat OpenShift Dev SpacesFixed in: devspaces/udi-base-rhel9
redhatno patchvia redhat_api
Product: Red Hat OpenShift Dev SpacesFixed in: devspaces/udi-rhel9
redhatno patchvia redhat_api
Product: Red Hat Trusted Artifact SignerFixed in: rhtas/model-transparency-rhel9
redhatno patchvia redhat_api
Product: Service Telemetry Framework 1.5Fixed in: stf/prometheus-webhook-snmp-rhel9
redhatno patchvia redhat_api
Product: Service Telemetry Framework 1.5Fixed in: stf/service-telemetry-rhel9-operator
redhatno patchvia redhat_api
Product: Service Telemetry Framework 1.5Fixed in: stf/smart-gateway-rhel9-operator
redhatno patchvia redhat_api
Product: Migration Toolkit for VirtualizationFixed in: migration-toolkit-virtualization/mtv-rhel9-operator
redhatno patchvia redhat_api
Product: OpenShift LightspeedFixed in: openshift-lightspeed/lightspeed-service-api-rhel9
redhatno patchvia redhat_api
Product: OpenShift LightspeedFixed in: openshift-lightspeed/lightspeed-to-dataverse-exporter-rhel9
redhatno patchvia redhat_api
Product: OpenShift LightspeedFixed in: openshift-lightspeed-tech-preview/lightspeed-rag-tool-rhel9
redhatno patchvia redhat_api
Product: Red Hat AI Inference ServerFixed in: rhai/base-image-rocm-rhel9
redhatno patchvia redhat_api
Product: Red Hat AI Inference ServerFixed in: rhaiis/model-opt-cuda-rhel9
redhatno patchvia redhat_api
Product: Red Hat AI Inference ServerFixed in: rhaiis-preview/vllm-cuda-rhel9
redhatno patchvia redhat_api
Product: Red Hat AI Inference ServerFixed in: rhaiis/vllm-cuda-rhel9
redhatno patchvia redhat_api
Product: Red Hat AI Inference ServerFixed in: rhaiis/vllm-rocm-rhel9
redhatno patchvia redhat_api
Product: Red Hat AI Inference ServerFixed in: rhaiis/vllm-spyre-rhel9
redhatno patchvia redhat_api
Product: Red Hat AI Inference ServerFixed in: rhaiis/vllm-tpu-rhel9
redhatno patchvia redhat_api
Product: Red Hat Ansible Automation Platform 2Fixed in: ansible-automation-platform-24/ansible-builder-rhel8
redhatno patchvia redhat_api
Product: Red Hat Ansible Automation Platform 2Fixed in: ansible-automation-platform-24/ansible-builder-rhel9
redhatno patchvia redhat_api
Product: Red Hat Ansible Automation Platform 2Fixed in: ansible-automation-platform-24/ansible-python-toolkit-rhel8
redhatno patchvia redhat_api
Product: Red Hat Ansible Automation Platform 2Fixed in: ansible-automation-platform-24/ansible-python-toolkit-rhel9
redhatno patchvia redhat_api
Product: Red Hat Ansible Automation Platform 2Fixed in: ansible-automation-platform-25/ansible-builder-rhel8
redhatno patchvia redhat_api
Product: Red Hat Ansible Automation Platform 2Fixed in: ansible-automation-platform-25/ansible-builder-rhel9
redhatno patchvia redhat_api
Product: Red Hat Ansible Automation Platform 2Fixed in: ansible-automation-platform-25/ansible-python-toolkit-rhel8
redhatno patchvia redhat_api
Product: Red Hat Ansible Automation Platform 2Fixed in: ansible-automation-platform-25/ansible-python-toolkit-rhel9
redhatno patchvia redhat_api
Product: Red Hat Ansible Automation Platform 2Fixed in: ansible-automation-platform-25/controller-rhel8
redhatno patchvia redhat_api
Product: Red Hat Ansible Automation Platform 2Fixed in: ansible-automation-platform-26/ansible-builder-rhel9
redhatno patchvia redhat_api
Product: Red Hat Ansible Automation Platform 2Fixed in: ansible-automation-platform-26/controller-rhel9
redhatno patchvia redhat_api
Product: Red Hat Ansible Automation Platform 2Fixed in: ansible-automation-platform-26/controller-rhel9-operator
redhatno patchvia redhat_api
Product: Red Hat Ansible Automation Platform 2Fixed in: ansible-automation-platform-26/de-minimal-rhel9
redhatno patchvia redhat_api
Product: Red Hat Ansible Automation Platform 2Fixed in: ansible-automation-platform-26/de-supported-rhel9
redhatno patchvia redhat_api
Product: Red Hat Ansible Automation Platform 2Fixed in: ansible-automation-platform-26/eda-controller-rhel9-operator
redhatno patchvia redhat_api
Product: Red Hat Ansible Automation Platform 2Fixed in: ansible-automation-platform-26/gateway-rhel9
redhatno patchvia redhat_api
Product: Red Hat Ansible Automation Platform 2Fixed in: ansible-automation-platform-26/gateway-rhel9-operator
redhatno patchvia redhat_api
Product: Red Hat Ansible Automation Platform 2Fixed in: ansible-automation-platform-26/platform-resource-rhel9-operator
redhatno patchvia redhat_api
Product: Red Hat Ansible Automation Platform 2Fixed in: ansible-automation-platform-26/receptor-rhel9
redhatno patchvia redhat_api
Product: Red Hat Ansible Automation Platform 2Fixed in: automation-controller
redhatno patchvia redhat_api
Product: Red Hat Enterprise Linux AI (RHEL AI) 3Fixed in: rhelai3/bootc-aws-cuda-rhel9
redhatno patchvia redhat_api
Product: Red Hat Enterprise Linux AI (RHEL AI) 3Fixed in: rhelai3/bootc-azure-cuda-rhel9
redhatno patchvia redhat_api
Product: Red Hat Enterprise Linux AI (RHEL AI) 3Fixed in: rhelai3/bootc-cuda-rhel9
redhatno patchvia redhat_api
Product: Red Hat Enterprise Linux AI (RHEL AI) 3Fixed in: rhelai3/bootc-gcp-cuda-rhel9
redhatno patchvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-built-in-detector-rhel9
redhatno patchvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-caikit-nlp-rhel9
redhatno patchvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-feature-server-rhel9
redhatno patchvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-guardrails-detector-huggingface-runtime-rhel9
redhatno patchvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-modelmesh-runtime-adapter-rhel8
redhatno patchvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-modelmesh-runtime-adapter-rhel9
redhatno patchvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9
redhatno patchvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-pipeline-runtime-minimal-cpu-py312-rhel9
redhatno patchvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9
redhatno patchvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9
redhatno patchvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9
redhatno patchvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9
redhatno patchvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9
redhatno patchvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-ta-lmes-job-rhel9
redhatno patchvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-training-cuda121-torch24-py311-rhel9
redhatno patchvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-training-cuda124-torch25-py311-rhel9
redhatno patchvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-training-rocm62-torch24-py311-rhel9
redhatno patchvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-training-rocm62-torch25-py311-rhel9
redhatno patchvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-trustyai-ragas-lls-provider-dsp-rhel9
redhatno patchvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-vllm-cpu-rhel9
redhatno patchvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-vllm-gaudi-rhel9
redhatno patchvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9
redhatno patchvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9
redhatno patchvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-workbench-jupyter-minimal-cpu-py312-rhel9
redhatno patchvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-workbench-jupyter-minimal-cuda-py312-rhel9
redhatno patchvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-workbench-jupyter-minimal-rocm-py312-rhel9
redhatno patchvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9
redhatno patchvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9
redhatno patchvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9
redhatno patchvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9
redhatno patchvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9
redhatno patchvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9
redhatno patchvia redhat_api
Product: Red Hat OpenShift Container Platform 4Fixed in: openshift4/ose-ansible-operator
redhatno patchvia redhat_api
Product: Red Hat OpenShift Container Platform 4Fixed in: openshift4/ose-aws-efs-csi-driver-container-rhel9
redhatno patchvia redhat_api
Product: Red Hat OpenShift Container Platform 4Fixed in: openshift4/ose-dpu-daemon-rhel9
redhatno patchvia redhat_api
Product: Red Hat OpenShift Container Platform 4Fixed in: openshift4/ose-dpu-intel-ipu-p4sdk-rhel9
redhatend of lifevia redhat_api
Product: Logging Subsystem for Red Hat OpenShiftFixed in: openshift-logging/elasticsearch-rhel9-operator
redhatend of lifevia redhat_api
Product: Logging Subsystem for Red Hat OpenShiftFixed in: openshift-logging/kibana6-rhel8
redhatend of lifevia redhat_api
Product: Logging Subsystem for Red Hat OpenShiftFixed in: openshift-logging/logging-curator5-rhel9
redhatend of lifevia redhat_api
Product: Red Hat Ansible Automation Platform 2Fixed in: ansible-automation-platform-24/controller-rhel8
redhatend of lifevia redhat_api
Product: Migration Toolkit for VirtualizationFixed in: mtv-candidate/mtv-rhel9-operator
redhatend of lifevia redhat_api
Product: Red Hat Enterprise Linux 6Fixed in: taglib
redhatend of lifevia redhat_api
Product: Logging Subsystem for Red Hat OpenShiftFixed in: openshift-logging/elasticsearch-operator-bundle
redhatend of lifevia redhat_api
Product: Logging Subsystem for Red Hat OpenShiftFixed in: openshift-logging/elasticsearch6-rhel9
redhatend of lifevia redhat_api
Product: Red Hat Advanced Cluster Security 4Fixed in: advanced-cluster-security/rhacs-operator-bundle
redhatend of lifevia redhat_api
Product: Logging Subsystem for Red Hat OpenShiftFixed in: openshift-logging/elasticsearch-proxy-rhel9

Vendor Advisories (3)

ubuntuUSN-8221-1

wheel vulnerability

Apr 29, 2026
pipGHSA-8rrh-rw8j-w5fxhigh

Wheel Affected by Arbitrary File Permission Modification via Path Traversal in wheel unpack

Jan 22, 2026
redhatCVE-2026-24049Important

wheel: wheel: Privilege Escalation or Arbitrary Code Execution via malicious wheel file unpacking

Jan 22, 2026

References

access.redhat.com / errata/RHSA-2026:10184
access.redhat.com / errata/RHSA-2026:13545
access.redhat.com / errata/RHSA-2026:14020
access.redhat.com / errata/RHSA-2026:1504
access.redhat.com / errata/RHSA-2026:17599
access.redhat.com / errata/RHSA-2026:1902
access.redhat.com / errata/RHSA-2026:1939
access.redhat.com / errata/RHSA-2026:1942
access.redhat.com / errata/RHSA-2026:19712
access.redhat.com / errata/RHSA-2026:20089
access.redhat.com / errata/RHSA-2026:2090
access.redhat.com / errata/RHSA-2026:2106
access.redhat.com / errata/RHSA-2026:2139
access.redhat.com / errata/RHSA-2026:2675
access.redhat.com / errata/RHSA-2026:2681
access.redhat.com / errata/RHSA-2026:2694
access.redhat.com / errata/RHSA-2026:2695
access.redhat.com / errata/RHSA-2026:2710
access.redhat.com / errata/RHSA-2026:2754
access.redhat.com / errata/RHSA-2026:2762
access.redhat.com / errata/RHSA-2026:2823
access.redhat.com / errata/RHSA-2026:2865
access.redhat.com / errata/RHSA-2026:2866
access.redhat.com / errata/RHSA-2026:2900
access.redhat.com / errata/RHSA-2026:2925
access.redhat.com / errata/RHSA-2026:3461
access.redhat.com / errata/RHSA-2026:3462
access.redhat.com / errata/RHSA-2026:3713
access.redhat.com / errata/RHSA-2026:3782
access.redhat.com / errata/RHSA-2026:3958
access.redhat.com / errata/RHSA-2026:3959
access.redhat.com / errata/RHSA-2026:3960
access.redhat.com / errata/RHSA-2026:4185
access.redhat.com / errata/RHSA-2026:4215
access.redhat.com / errata/RHSA-2026:4271
access.redhat.com / errata/RHSA-2026:4942
access.redhat.com / errata/RHSA-2026:5119
access.redhat.com / errata/RHSA-2026:6192
access.redhat.com / errata/RHSA-2026:6555
access.redhat.com / errata/RHSA-2026:6562
access.redhat.com / errata/RHSA-2026:6565
access.redhat.com / errata/RHSA-2026:7250
access.redhat.com / security/cve/CVE-2026-24049
bugzilla.redhat.com / show_bug.cgi
security.access.redhat.com / data/csaf/v2/vex/2026/cve-2026-24049.json
github.com / pypa/wheel/commit/7a7d2de96b22a9adf9208afcc9547e1001569fef
Patch
github.com / pypa/wheel/releases/tag/0.46.2
ProductRelease Notes
github.com / pypa/wheel/security/advisories/GHSA-8rrh-rw8j-w5fx
ExploitMitigationVendor Advisory