Critical, CVSS 9.0GoPublished
Pelican Web UI Affected by a Privilege Escalation Attack
CVE-2026-42571 · GHSA-rpfr-x88x-xwcw
- Affected
- Go github.com/pelicanplatform/pelican < 0.0.0-20260408120501-7f73b9c3e677
- Fixed in
- 0.0.0-20260408120501-7f73b9c3e677· Vendor fix available
- Issue
- Background On April 2nd, 2026, a Claude coding agent alerted Pelican PI Brian Bockelman to a privilege escalation vulnerability affecting Pelican's Web User Interface (WebUI) for various versions between v7.21 and v7.24. Upon further investigation, the Pelican team discovered this attack allows any user authenticated to the WebUI via OAuth to gain admin privileges under certain configurations. These may include servers with the following configuration variables enabled: - Server.UIAdminUsers: Affected if any of the listed admin users or the default admin account have not previously logged in to the server. - Server.AdminGroups: Affected if Issuer.GroupSource is set to internal and an admin of the group has not previously logged in to the server. The OSDF operations team has mitigated these for core services, origins, and caches operated by the PATh project. However, mitigation may be needed for caches and origins not centrally operated. Pelican Command Line has not currently…
Recommended action: Upgrade to 0.0.0-20260408120501-7f73b9c3e677 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.