{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata — refreshed continuously.","feed_url":"https://feed.craftedsignal.io/products/pelicanplatform/pelican/","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cves":[],"_cs_exploited":false,"_cs_products":["pelicanplatform/pelican","github.com"],"_cs_severities":["critical"],"_cs_tags":["privilege-escalation","webui","pelican"],"_cs_type":"advisory","_cs_vendors":["Pelican","GitHub"],"content_html":"\u003cp\u003eOn April 2nd, 2026, a privilege escalation vulnerability was identified in the Pelican Web User Interface (WebUI) affecting versions v7.21 to v7.24. This vulnerability allows any authenticated user via OAuth to gain admin privileges under specific configurations, including servers with \u003ccode\u003eServer.UIAdminUsers\u003c/code\u003e where listed users haven\u0026rsquo;t logged in or \u003ccode\u003eServer.AdminGroups\u003c/code\u003e with \u003ccode\u003eIssuer.GroupSource\u003c/code\u003e set to \u003ccode\u003einternal\u003c/code\u003e where an admin hasn\u0026rsquo;t logged in. Successful exploitation permits attackers to modify server configurations, create API tokens, and change admin passwords. The OSDF operations team mitigated this vulnerability for core services, but mitigation may be required for other caches and origins. There is currently no evidence this attack has been exploited in services managed by OSDF operators.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker gains initial access to the Pelican WebUI by authenticating via OIDC.\u003c/li\u003e\n\u003cli\u003eThe attacker identifies a valid \u003ccode\u003eServer.UIAdminUsers\u003c/code\u003e username or \u003ccode\u003eServer.AdminGroups\u003c/code\u003e group name for an admin who has not yet logged into the WebUI.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts malicious database records designed to grant admin privileges upon subsequent login.\u003c/li\u003e\n\u003cli\u003eThe attacker injects these records into the Pelican server\u0026rsquo;s SQLite database, potentially using API endpoints or other methods to interact with the database.\u003c/li\u003e\n\u003cli\u003eThe attacker logs out of the WebUI.\u003c/li\u003e\n\u003cli\u003eThe attacker logs back into the WebUI.\u003c/li\u003e\n\u003cli\u003eThe server grants the attacker admin privileges based on the manipulated database records.\u003c/li\u003e\n\u003cli\u003eThe attacker modifies server configurations, creates persistent API tokens, or changes admin passwords.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe successful exploitation of this vulnerability poses a significant risk to Pelican servers and the wider federation they support. A compromised Director service could have high federation-wide impact, enabling denial of service and redirection to malicious registries. Registry services also have high federation-wide impact, with attackers potentially poisoning namespaces. Compromised Origins could lead to high data exposure and tampering risks by enabling unauthorized writes and changing export paths. Caches present a medium data exposure risk, as attackers could expose cached protected data.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eRun the provided mitigation script (\u003ccode\u003emitigate-user-escalation.sh\u003c/code\u003e from \u003ca href=\"https://gist.github.com/jhiemstrawisc/8c4b2b3ec5cb2ca06537d9439dc16cc9\"\u003ehttps://gist.github.com/jhiemstrawisc/8c4b2b3ec5cb2ca06537d9439dc16cc9\u003c/a\u003e) to audit the database for signs of exploitation and block further exploitation.\u003c/li\u003e\n\u003cli\u003eUpgrade Pelican servers to a patched release (\u0026gt;=v7.21.5, \u0026gt;=v7.22.3, \u0026gt;=v7.23.3, \u0026gt;=v7.24.2).\u003c/li\u003e\n\u003cli\u003eIf unable to upgrade immediately, disable the vulnerable configuration by commenting out \u003ccode\u003eUIAdminUsers\u003c/code\u003e and \u003ccode\u003eAdminGroups\u003c/code\u003e settings in the \u003ccode\u003epelican.yaml\u003c/code\u003e configuration file.\u003c/li\u003e\n\u003cli\u003eMonitor process executions for the \u003ccode\u003emitigate-user-escalation.sh\u003c/code\u003e script and review associated user and API token changes. Deploy the provided Sigma rule to detect potential malicious activity.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-05-04T21:24:50Z","date_published":"2026-05-04T21:24:50Z","id":"/briefs/2026-05-pelican-privesc/","summary":"A privilege escalation vulnerability in Pelican WebUI versions v7.21 to v7.24 allows authenticated users to gain admin privileges by manipulating database records, potentially leading to configuration modification, API token creation, and password changes.","title":"Pelican Web UI Privilege Escalation Vulnerability","url":"https://feed.craftedsignal.io/briefs/2026-05-pelican-privesc/"}],"language":"en","title":"CraftedSignal Threat Feed — Pelicanplatform/Pelican","version":"https://jsonfeed.org/version/1.1"}