Skip to content
Fencer Vulns
medium 6.8

CVE-2025-71176 json

pytest has vulnerable tmpdir handling

published 2026-01-22 9 mo ago modified 2026-09-10 1 mo ago also GHSA-6w46-j5rx-g56g , PYSEC-2026-1845 , EUVD-2026-4171

cvss
6.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 4%
public exploits
0
none known

Summary

pytest through 9.0.2 on UNIX relies on directories with the /tmp/pytest-of-{user} name pattern, which allows local users to cause a denial of service or possibly gain privileges.

Patch / fix

  • pypi pytest 9.0.3
  • pytest hummingbird 1 9.0.3-1.hum1
  • python3-pytest hummingbird 1 9.0.3-1.hum1

red hat advisories RHSA-2026:8580

  • python-pytest openSUSE Tumbleweed 9.0.3-1.1

opensuse advisories openSUSE-SU-2026:10666-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-71176 updated cvss 6.8

pytest: pytest: Denial of Service or Privilege Escalation via insecure temporary directory handling

  • Red Hat OpenShift Service Mesh 2 openshift-service-mesh/pilot-rhel8, openshift-service-mesh/grafana-rhel8, openshift-service-mesh/proxyv2-rhel9, openshift-service-mesh/istio-cni-rhel8, openshift-service-mesh/ratelimit-rhel8, openshift-service-mesh/istio-rhel8-operator, +2 more Red Hat AI Inference Server rhaiis/vllm-rocm-rhel9, rhaiis/vllm-spyre-rhel9 Red Hat Ansible Automation Platform 2 ansible-automation-platform-26/controller-rhel9, ansible-automation-platform-25/ansible-dev-tools-rhel8, ansible-automation-platform-26/ansible-dev-tools-rhel9, ansible-automation-platform-tech-preview/ansible-devspaces-rhel9, ansible-automation-platform-tech-preview/automation-dashboard-rhel9 Red Hat Enterprise Linux 7 pytest Red Hat Enterprise Linux 8 pytest, python2-pytest, python38-pytest, python39-pytest Red Hat Enterprise Linux 9 python3-pytest, python3.12-pytest, rhel9/bootc-image-builder
    +10 more products
    Red Hat Enterprise Linux 10 pytest Red Hat Enterprise Linux AI (RHEL AI) 3 rhelai3/bootc-cuda-rhel9, rhelai3/disk-image-cuda-rhel9 Red Hat OpenShift AI (RHOAI) rhoai/odh-vllm-rocm-rhel9, rhoai/odh-ta-lmes-job-rhel9, rhoai/odh-kserve-agent-rhel9, rhoai/odh-kserve-router-rhel9, rhoai/odh-model-registry-rhel8, rhoai/odh-model-registry-rhel9, +27 more Red Hat OpenShift Container Platform 4 pytest Red Hat OpenShift Dev Spaces devspaces/udi-rhel9, devspaces/udi-base-rhel9, devspaces/dashboard-rhel9, devspaces/udi-base-rhel10, devspaces/devspaces-operator-bundle Red Hat OpenStack Platform 16.2 python3-pytest, rhosp-rhel8/openstack-tempest Red Hat OpenStack Platform 17.1 rhosp-rhel9/openstack-tempest Red Hat OpenStack Platform 18.0 rhoso/openstack-tempest-all-rhel9 Red Hat Satellite 6 satellite/iop-vmaas-rhel9, satellite/iop-puptoo-rhel9, satellite/foreman-mcp-server-rhel9, satellite/iop-advisor-engine-rhel9, satellite/iop-host-inventory-rhel9, satellite/iop-insights-engine-rhel9, +1 more Red Hat Service Telemetry Framework 1.5 stf/prometheus-webhook-snmp-rhel8, stf/prometheus-webhook-snmp-rhel9
    affected: workaround, no fix available “Fix deferred”
  • Red Hat Hardened Images pytest 9.0.3-1.hum1, python3-pytest 9.0.3-1.hum1
    fixed: vendor fix RHSA-2026:8580

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
9 mo ago

Exploit prediction

0.15% chance of exploitation in the next 30 days, higher than 4% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 6.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
GitHub 3.1 6.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
OSV 3.1 6.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

Affected packages

ecosystem package affected fixed in
pypi pytest
<9.0.3
9.0.3

Affected products

  • pytest pytest

Classification

Weakness
  • CWE-379 Creation of Temporary File in Directory with Insecure Permissions

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.