It was discovered that Canonical's Pebble service manager read-file API and the associated pebble pull command, before v1.10.2, allowed unprivileged… (CVE-2024-3250)
A vulnerability in Canonical's Pebble service manager read-file API and the associated pebble pull command before version 1.10.2 allows unprivileged local users to read files with root-equivalent permissions when Pebble is running as root. Fixes are available in version 1.10.2 and backported to versions 1.1.1, 1.4.2, and 1.7.4. This issue affects multiple version ranges prior to these fixed versions.
AI Analysis
Technical Summary
CVE-2024-3250 is a local privilege escalation vulnerability in Canonical's Pebble service manager. The read-file API and the pebble pull command, when Pebble runs as root, allow unprivileged local users to read files with root-equivalent permissions. This vulnerability affects versions before 1.10.2, with backported fixes available in 1.1.1, 1.4.2, and 1.7.4. The vulnerability is medium severity and no CVSS score is provided.
Potential Impact
Unprivileged local users can read files with root-equivalent permissions, potentially exposing sensitive information or configuration files that should be restricted. This could lead to information disclosure on affected systems where Pebble runs as root.
Mitigation Recommendations
Apply the official fixes available in Pebble version 1.10.2 or the backported versions 1.1.1, 1.4.2, and 1.7.4. Upgrading to these versions will remediate the vulnerability. No additional mitigation steps are indicated.
It was discovered that Canonical's Pebble service manager read-file API and the associated pebble pull command, before v1.10.2, allowed unprivileged… (CVE-2024-3250)
Description
A vulnerability in Canonical's Pebble service manager read-file API and the associated pebble pull command before version 1.10.2 allows unprivileged local users to read files with root-equivalent permissions when Pebble is running as root. Fixes are available in version 1.10.2 and backported to versions 1.1.1, 1.4.2, and 1.7.4. This issue affects multiple version ranges prior to these fixed versions.
Affected software
pkg:bitnami/pebbleRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2024-3250 is a local privilege escalation vulnerability in Canonical's Pebble service manager. The read-file API and the pebble pull command, when Pebble runs as root, allow unprivileged local users to read files with root-equivalent permissions. This vulnerability affects versions before 1.10.2, with backported fixes available in 1.1.1, 1.4.2, and 1.7.4. The vulnerability is medium severity and no CVSS score is provided.
Potential Impact
Unprivileged local users can read files with root-equivalent permissions, potentially exposing sensitive information or configuration files that should be restricted. This could lead to information disclosure on affected systems where Pebble runs as root.
Mitigation Recommendations
Apply the official fixes available in Pebble version 1.10.2 or the backported versions 1.1.1, 1.4.2, and 1.7.4. Upgrading to these versions will remediate the vulnerability. No additional mitigation steps are indicated.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- BIT-pebble-2024-3250
- Osv Schema Version
- 1.6.2
- Aliases
- ["CVE-2024-3250"]
- Ecosystems
- ["Bitnami"]
- Database Specific Severity
- Medium
Threat ID: 6aa005e2acd9273b49ab60d5
Added to database: 09/08/2026, 12:56:02 UTC
Last enriched: 09/08/2026, 13:28:35 UTC
Last updated: 09/10/2026, 19:36:48 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.