CVE-2026-123084

An expression language injection has been found in the HeaderContentGuard.permit function in publication.py of the content guard in the Pulpcore package. The guard is supposed to check a value in a request header. It saves a jq filter and runs that filter against the header when a client asks for...