The flaw exists in the pulp-container component that handles authentication to upstream container registries. When a remote is synced, the credentials—basic username/pasword or bearer token—are stored and then reused by the same worker for any later remote sync operations. If an attacker can add a container remote whose upstream registry is under their control, and they have permission to sync that remote, they will obtain the stored credentials of a different remote and use them to authenticate to the upstream registry. The attacker can then pull images or otherwise use the registry as permitted, without affecting the data stored in Pulp or stopping the service.

The vulnerability applies to several Red Hat products that use or embed pulp-container. Red Hat Ansible Automation Platform 2, Red Hat Satellite 6, Red Hat Update Infrastructure 4 for Cloud Providers, and Red Hat Update Infrastructure 5 are all impacted when running the vulnerable version of pulp-container, as indicated by the corresponding CPE strings.

The CVSS score of 6.5 denotes a medium severity. EPSS is not available and the issue is not listed in the CISA KEV catalog. Exploitation requires that the attacker can create and sync a container remote within the affected service and control the upstream registry of that remote, which typically implies privileged access to the appliance. Once achieved, the attacker can reuse stored credentials to access other registries, potentially enabling broader unauthorized access.