Pelican Web UI Privilege Escalation Vulnerability: Early Warning
- Severity
- HIGH
- Affected component
- pelican (go)
- Affected versions
- < 0.0.0-20260408120501-7f73b9c3e677
- Patched version
- Not yet available
An early warning has been issued for a privilege escalation vulnerability in the Pelican Web UI. Authenticated users may gain admin privileges under certain configurations, leading to potential data tampering and federation-wide impacts.
What happened
An early warning has been issued for a critical vulnerability in the Pelican Web UI, tracked as GHSA-RPFR-X88X-XWCW and CVE-2026-42571. This vulnerability allows authenticated users to escalate their privileges to admin level under specific configurations. The impact of this vulnerability could result in data tampering and have federation-wide consequences. The vulnerability affects versions of the pelican (go) package prior to 0.0.0-20260408120501-7f73b9c3e677.
The vulnerability was first flagged on 2026-05-04T21:24:50+00:00. It is currently under investigation and has not been exploited in the wild. Users are advised to assess their exposure by checking the versions of pelican (go) in use within their environments.
What to do about it
- Upgrade to a version of pelican (go) beyond v7.24 to mitigate the risk.
- Apply necessary configuration changes to ensure that the vulnerability cannot be exploited.
- Monitor the primary sources for updates on the vulnerability and any official fixes that may be released.
- Consult the GitHub Advisory Database for the latest information on affected and patched versions.
How 0Day would have caught this
pelican is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if you are using a version of pelican (go) prior to 0.0.0-20260408120501-7f73b9c3e677.
What should I do right now?
Upgrade to a version of pelican (go) beyond v7.24 or apply necessary configuration changes to mitigate the risk.
Is there an official fix available?
No official fix has been published yet. Monitor the sources below for updates.
Where can I find more information?
Consult the primary sources, including the GitHub Advisory Database, for the latest information.