CVE-2026-6357
published 2026-04-27CVE-2026-6357: pip prior to version 26.1 would run self-update check functionality after installing wheel files which required importing well-known Python modules names…
PriorityP422medium5.3CVSS 4.0
AVLACLATPPRHUIAVCHVIHVANSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.14%
3.2th percentile
pip prior to version 26.1 would run self-update check functionality after installing wheel files which required importing well-known Python modules names. These module imports were intentionally deferred to increase startup time of the pip CLI. The patch changes self-update functionality to run before wheels are installed to prevent newly-installed modules from being imported shortly after the installation of a wheel package. Users should still review package contents prior to installation.
Affected
94 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ansible-automation-platform-24 | controller-rhel8 | — | — |
| ansible-automation-platform-25 | controller-rhel8 | — | — |
| ansible-automation-platform-26 | controller-rhel9 | — | — |
| ansible-automation-platform-26 | controller-rhel9-operator | — | — |
| ansible-automation-platform-26 | eda-controller-rhel9-operator | — | — |
| ansible-automation-platform-26 | gateway-rhel9 | — | — |
| ansible-automation-platform-26 | gateway-rhel9-operator | — | — |
| ansible-automation-platform-26 | hub-rhel9-operator | — | — |
| ansible-automation-platform-26 | lightspeed-rhel9-operator | — | — |
| ansible-automation-platform-26 | platform-resource-rhel9-operator | — | — |
| ansible-automation-platform-tech-preview | metrics-service-rhel9-operator | — | — |
| ansible-automation-platform | automation-dashboard-rhel9 | — | — |
| devspaces | udi-rhel9 | — | — |
| discovery | discovery-server-rhel9 | — | — |
| exploit-intelligence-tech-preview | vulnerability-analysis-rhel9 | — | — |
| migration-toolkit-virtualization | mtv-rhel9-operator | — | — |
| mta | mta-rhel9-operator | — | — |
| mtv-candidate | mtv-rhel9-operator | — | — |
| openshift-lightspeed | lightspeed-service-api-rhel9 | — | — |
| openshift-service-mesh | kiali-rhel9-operator | — | — |
| openshift4 | ose-ansible-rhel9-operator | — | — |
| pen-drive | pen-drive-scanner-rhel9 | — | — |
| pip_maintainers | pip | < 26.1 | 26.1 |
| pypa | pip | >= 0 < 26.1 | 26.1 |
| quay | quay-rhel8 | — | — |
CVSS provenance
nvdv4.05.3MEDIUMCVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
pip: pip: Arbitrary code execution or information disclosure via malicious wheel package installation
vendor_redhat·2026-04-27·CVSS 5.3
CVE-2026-6357 [MEDIUM] CWE-94 pip: pip: Arbitrary code execution or information disclosure via malicious wheel package installation
pip: pip: Arbitrary code execution or information disclosure via malicious wheel package installation
A flaw was found in pip. Prior to version 26.1, pip's self-update check functionality would execute after installing wheel packages. This process involved importing newly installed Python modules. A malicious actor could craft a specially designed wheel package that, when installed, could lead to the execution of arbitrary code or information disclosure due to the premature import of its modules during the self-update check.
Package: exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 (Exploit Intelligence) - Out of support scope
Package: mta/mta-rhel9-operator (Migration Toolkit for Applications 8) - Fix deferred
Package: migration-toolkit-virtualization/mtv-rhel9-operator
GHSA
pip Vulnerable to Inclusion of Functionality from Untrusted Control Sphere
ghsa·2026-04-27
CVE-2026-6357 [MEDIUM] CWE-829 pip Vulnerable to Inclusion of Functionality from Untrusted Control Sphere
pip Vulnerable to Inclusion of Functionality from Untrusted Control Sphere
pip prior to version 26.1 would run self-update check functionality after installing wheel files which required importing well-known Python modules names. These module imports were intentionally deferred to increase startup time of the pip CLI. The patch changes self-update functionality to run before wheels are installed to prevent newly-installed modules from being imported shortly after the installation of a wheel package. Users should still review package contents prior to installation.
VulDB
pip up to 26.0 Self-update Check Local Privilege Escalation
vuldb·2026-04-27·CVSS 5.3
CVE-2026-6357 [MEDIUM] pip up to 26.0 Self-update Check Local Privilege Escalation
A vulnerability labeled as problematic has been found in pip up to 26.0. Affected by this vulnerability is an unknown functionality of the component Self-update Check. Such manipulation leads to Local Privilege Escalation.
This vulnerability is referenced as CVE-2026-6357. The attack can only be performed from a local environment. No exploit is available.
The affected component should be upgraded.
No detection rules found.
No public exploits indexed.
2026-04-27
Published