CVE-2022-26526 json
Anaconda Anaconda3 (Anaconda Distribution) through 2021.11.0.0 and Miniconda3 through 4.11.0.0 can create a world-writable directory under…
published 2022-03-17 4 y ago modified 2026-06-17 4 mo ago also BIT-miniconda-2022-26526 , EUVD-2022-31083
- cvss
- 7.8
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 26%
- public exploits
- 0
- none known
Summary
Anaconda Anaconda3 (Anaconda Distribution) through 2021.11.0.0 and Miniconda3 through 4.11.0.0 can create a world-writable directory under %PROGRAMDATA% and place that directory into the system PATH environment variable. Thus, for example, local users can gain privileges by placing a Trojan horse file into that directory. (This problem can only happen in a non-default installation. The person who installs the product must specify that it is being installed for all users. Also, the person who installs the product must specify that the system PATH should be changed.
Patch / fix
- bitnami miniconda 4.11.0
Exploit prediction
0.33% chance of exploitation in the next 30 days, higher than 26% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- improsec.com https://improsec.com/tech-blog/privilege-escalation-vulnerability-in-anaconda3-and-miniconda3 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 4.6 | AV:L/AC:L/Au:N/C:P/I:P/A:P |
| OSV | 3.1 | 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| bitnami | miniconda | <4.11.0 |
4.11.0 |
Classification
- Weakness
-
- CWE-732 Incorrect Permission Assignment for Critical Resource
References
-
improsec.com
/tech-blog/privilege-escalation-vulnerability-in-anaconda3-and-miniconda3
exploit, third-party-advisory, web
-
docs.conda.io
/en/latest/miniconda.html
product, vendor-advisory, web
-
repo.anaconda.com
/miniconda/
vendor-advisory, web
-
github.com
/continuumio/anaconda-issues/issues
issue-tracking, third-party-advisory, web
Sources
- CVE List CVE-2022-26526
- NVD CVE-2022-26526
- OSV BIT-miniconda-2022-26526
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.