CVE-2026-24049 is a path traversal vulnerability in the python wheel tool's unpack function. The vulnerability arises because the unpack logic trusts filenames from the archive header for chmod operations without properly validating the paths after extraction. This can allow an attacker to craft a malicious wheel file that changes permissions on critical system files (e.g., /etc/passwd, SSH keys), enabling privilege escalation or arbitrary code execution. Red Hat OpenShift Container Platform versions prior to 4.17.54 are affected. Red Hat has issued a security advisory and released updated RPM packages and container images in version 4.17.54 to fix this issue.

An attacker with the ability to supply a malicious wheel file to be unpacked can exploit this vulnerability to modify permissions on critical system files. This can lead to privilege escalation or arbitrary code execution on the affected system. The integrity and availability of the system can be compromised, and security mechanisms may be bypassed. The vulnerability has a high severity rating by Red Hat, with a CVSS base score of 7.1 (Red Hat scoring). No known active exploitation has been reported.

Red Hat has released an official fix in OpenShift Container Platform version 4.17.54. Users should upgrade to this version or later to remediate the vulnerability. The advisory recommends applying the updated RPM packages and container images available in the appropriate release channels. No alternative mitigations meeting Red Hat's criteria are currently available. Follow Red Hat's official upgrade instructions to fully apply the update.