Description
wheel is a command line tool for manipulating Python wheel files, as defined in PEP 427. In versions 0.40.0 through 0.46.1, the unpack function is vulnerable to file permission modification through mishandling of file permissions after extraction. The logic blindly trusts the filename from the archive header for the chmod operation, even though the extraction process itself might have sanitized the path. Attackers can craft a malicious wheel file that, when unpacked, changes the permissions of critical system files (e.g., /etc/passwd, SSH keys, config files), allowing for Privilege Escalation or arbitrary code execution by modifying now-writable scripts. This issue has been fixed in version 0.46.2.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| pypa | wheel | >= 0.40.0, < 0.46.2 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | wheel | 0.46.3-1 | — |
| Debian 13 | wheel | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 25.10 | wheel +1 | No fix yet | — |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 24.04 LTS | wheel | 0.42.0-2ubuntu0.1~esm1 | USN-8221-1 |
| Ubuntu Pro 20.04 LTS | python-pip | No fix yet | — |
| Ubuntu Pro 18.04 LTS | python-pip | No fix yet | — |
| Ubuntu Pro 16.04 LTS | python-pip | No fix yet | — |
| Ubuntu Pro 14.04 LTS | python-pip | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | python-wheel +2 | 1:0.41.2-5.el10_1.1 | RHSA-2026:1902 |
| RHEL 9 | python3.12-wheel +1 | 0.41.2-3.el9_7.1 | RHSA-2026:1939 |
| RHEL 8 | python3.12-wheel +1 | 0.41.2-4.el8_10 | RHSA-2026:2090 |
Show 7 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10.0 EUS | python-wheel +2 | 1:0.41.2-5.el10_0.1 | RHSA-2026:2865 |
| RHEL 9.6 EUS | python3.12-wheel +1 | 0.41.2-3.el9_6.1 | RHSA-2026:2710 |
| RHEL 9.4 EUS | python3.12-wheel +1 | 0.41.2-3.el9_4.1 | RHSA-2026:2866 |
| Red Hat Discovery 2 | discovery-cli | 2.4.3-2.el8 | RHSA-2026:2823 |
| Red Hat Ansible Automation Platform Inside 2 | receptor +1 | 1.6.3-4.el8ap | RHSA-2026:3959, RHSA-2026:3958 |
| Red Hat Ansible Automation Platform Developer 2 | automation-controller +1 | 4.6.26-1.el8ap | RHSA-2026:3959, RHSA-2026:3958 |
| Red Hat Ansible Automation Platform Developer 2 | python3.12-django | 4.2.28-1.el8ap | RHSA-2026:3959, RHSA-2026:3958 |
| Red Hat Ansible Automation Platform Developer 2 | receptor +1 | 1.6.3-4.el8ap | RHSA-2026:3959, RHSA-2026:3958 |
| Red Hat Ansible Automation Platform 2 | automation-controller +4 | 4.6.26-1.el8ap | RHSA-2026:3959, RHSA-2026:3958 |
| Red Hat Ansible Automation Platform 2 | automation-gateway +2 | 2.5.20260225-1.el8ap | RHSA-2026:3959 |
| Red Hat Ansible Automation Platform 2 | automation-platform-ui | 2.6.6-1.el9ap | RHSA-2026:3958 |
| Red Hat Ansible Automation Platform 2 | python3.12-aiohttp | 3.13.3-2.el8ap | RHSA-2026:3959, RHSA-2026:3958 |
| Red Hat Ansible Automation Platform 2 | python3.12-django | 4.2.28-1.el8ap | RHSA-2026:3959, RHSA-2026:3958 |
| Red Hat Ansible Automation Platform 2 | python3.12-protobuf | 5.29.6-1.el8ap | RHSA-2026:3959, RHSA-2026:3958 |
| Red Hat Ansible Automation Platform 2 | receptor +1 | 1.6.3-4.el8ap | RHSA-2026:3959, RHSA-2026:3958 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | python3-wheel +1 | 1:0.41.2-5.el10_1.1 | ALSA-2026:1902 |
| AlmaLinux 9 | python3.12-wheel +1 | 0.41.2-3.el9_7.1 | ALSA-2026:1939 |
| AlmaLinux 8 | python3.12-wheel +1 | 0.41.2-4.el8_10 | ALSA-2026:2090 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | python-wheel | 1:0.41.2-5.el10_1.1 | RLSA-2026:1902 |
| Rocky Linux 9 | python3.12-wheel | 0.41.2-3.el9_7.1 | RLSA-2026:1939 |
| Rocky Linux 8 | python3.12-wheel | 0.41.2-4.el8_10 | RLSA-2026:2090 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP6 | python-wheel | 0.42.0-150600.3.3.1 | SUSE-SU-2026:0424-1 |
| SLES 15 SP5 | python-wheel | 0.40.0-150400.13.10.1 | SUSE-SU-2026:0460-1 |
| SLES 15 SP4 | python-wheel | 0.40.0-150400.13.10.1 | SUSE-SU-2026:0460-1 |
| SLES 3 | python-wheel | 0.42.0-150600.3.3.1 | SUSE-SU-2026:0424-1 |
| SLES 3 | python313-wheel | 0.44.0-150700.3.3.1 | SUSE-SU-2026:0425-1 |
Show 7 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | python-wheel | 0.45.1-160000.3.1 | SUSE-SU-2026:20217-1 |
| SLES for SAP 15 SP6 | python-wheel | 0.42.0-150600.3.3.1 | SUSE-SU-2026:0424-1 |
| SLES for SAP 15 SP5 | python-wheel | 0.40.0-150400.13.10.1 | SUSE-SU-2026:0460-1 |
| SLES for SAP 15 SP4 | python-wheel | 0.40.0-150400.13.10.1 | SUSE-SU-2026:0460-1 |
| SLES 16.0 | python-wheel | 0.45.1-160000.3.1 | SUSE-SU-2026:20217-1 |
| SLE HPC 15 SP5 | python-wheel | 0.40.0-150400.13.10.1 | SUSE-SU-2026:0460-1 |
| SLE HPC 15 SP4 | python-wheel | 0.40.0-150400.13.10.1 | SUSE-SU-2026:0460-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | python-wheel | 0.46.3-1.1 | openSUSE-SU-2026:10151-1 |
| openSUSE Leap 16.0 | python-wheel | 0.45.1-160000.3.1 | openSUSE-SU-2026:20147-1 |
| openSUSE Leap 15.6 | python-wheel | 0.40.0-150400.13.10.1 | SUSE-SU-2026:0460-1, SUSE-SU-2026:0424-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | py3-wheel | 0.46.3-r0 | — |
| Alpine v3.23 | py3-wheel | 0.46.3-r0 | — |
| Alpine v3.22 | py3-wheel | 0.46.3-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | python3.12-wheel +1 | 1:0.45.1-1.amzn2023.0.1 | ALAS2023-2026-1410 |
| Amazon Linux 2023 | python3.13-wheel +1 | 1:0.43.0-104.amzn2023 | ALAS2023-2026-1414 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | python-virtualenv | 20.36.1-2 | — |
| Azure Linux 3 | python-wheel | 0.43.0-2 | — |
| Azure Linux 2 (CBL-Mariner) | python-virtualenv | No fix yet | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | python3-wheel +1 | 1:0.41.2-5.el10_1.1 | ELSA-2026-1902 |
| Oracle Linux 9 | python3.12-wheel +1 | 0.41.2-3.el9_7.1 | ELSA-2026-1939 |
| Oracle Linux 8 | python3.12-wheel +1 | 0.41.2-4.el8_10 | ELSA-2026-2090 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | airflow-3 | 3.1.6-r2 | — |
| Wolfi rolling | aws-cli-2 | 2.33.1-r0 | — |
| Wolfi rolling | dask-kubernetes | 2025.7.0-r8 | — |
| Wolfi rolling | datadog-agent-7.72 | 7.72.4-r7 | — |
| Wolfi rolling | datadog-agent-7.72-core-integrations | No fix yet | — |
| Wolfi rolling | datadog-agent-7.73 | 7.73.3-r4 | — |
| Wolfi rolling | datadog-agent-7.73-core-integrations | 7.73.3-r23 | — |
| Wolfi rolling | datadog-agent-7.79-core-integrations | 7.79.2-r9 | — |
| Wolfi rolling | datadog-agent-7.80 +1 | 7.80.4-r10 | — |
| Wolfi rolling | katib-earlystopping +6 | 0.19.0-r5 | — |
| Wolfi rolling | kserve-storage-controller | 0.16.0-r11 | — |
| Wolfi rolling | kubeflow-jupyter-web-app | 1.10.0-r11 | — |
| Wolfi rolling | open-webui | 0.8.3-r0 | — |
| Wolfi rolling | pip-zipapp | 26.0.1-r0 | — |
| Wolfi rolling | py3-cassandra-medusa | 0.27.0-r1 | — |
| Wolfi rolling | py3-semgrep | 1.150.0-r0 | — |
| Wolfi rolling | py3.10-ambassador +3 | 3.10.0-r19 | — |
| Wolfi rolling | py3.10-setuptools +4 | 80.10.2-r0 | — |
| Wolfi rolling | py3.10-virtualenv +3 | 21.5.0-r0 | — |
| Wolfi rolling | pypy-3.10 | 7.3.19-r14 | — |
| Wolfi rolling | pypy-3.11 | 7.3.20-r5 | — |
| Wolfi rolling | superset-6.0 | 6.0.0-r1 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
GitHub 1 repository
-
kriskimmerle/wheelaudit ★ 3 · Feb 5, 2026
Python Wheel File Security Scanner — scan .whl files for security issues before installation. Detects path traversal (CVE-2026-24049), RECORD tampering, command shadowing, secrets, zip bombs. Zero de…
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | wheel | >= 0.40.0, < 0.46.2 | 0.46.2 | GHSA-8rrh-rw8j-w5fx |
Advisories 30
- WID-SEC-2026-2189 Dell PowerProtect Data Domain: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 2, 2026
- ALSA-2026:1939 Important: python3.12-wheel security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:1902 Important: python-wheel security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:2090 Important: python3.12-wheel security update AlmaLinux Security Advisories · Oct 29, 2026
- USN-8221-1 wheel vulnerability Ubuntu Security Notices (USN) · Oct 27, 2026
- RHSA-2026:3959 Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:3958 Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:2865 Red Hat Security Advisory: python-wheel security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2026:2866 Red Hat Security Advisory: python3.12-wheel security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2026:2823 Red Hat Security Advisory: Updated discovery-cli release RPM versions 2.4.3 Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2026:2710 Red Hat Security Advisory: python3.12-wheel security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2026:2090 Red Hat Security Advisory: python3.12-wheel security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2026:1939 Red Hat Security Advisory: python3.12-wheel security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2026:1902 Red Hat Security Advisory: python-wheel security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- WID-SEC-2026-0302 Red Hat Enterprise Linux (python-wheel): Schwachstelle ermöglicht Privilegieneskalation und Codeausführung BSI CERT-Bund (WID) · Oct 13, 2026
- WID-SEC-2026-1730 Xerox FreeFlow Print Server: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff BSI CERT-Bund (WID) · Jul 16, 2026
- ELSA-2026-1939 Important: python3.12-wheel security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Apr 27, 2026
- openSUSE-SU-2026:20147-1 Security update for python-wheel SUSE / openSUSE Security Updates · Mar 23, 2026
- openSUSE-SU-2026:10151-1 python311-wheel-0.46.3-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2026:20217-1 Security update for python-wheel SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2026:0460-1 Security update for python-wheel SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2026:0424-1 Security update for python-wheel SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2026:0425-1 Security update for python313-wheel SUSE / openSUSE Security Updates · Mar 23, 2026
- ALAS2023-2026-1410 Important: python3.12-wheel security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Feb 18, 2026
- RLSA-2026:1902 Important: python-wheel security update Rocky Linux Security Advisories · Feb 6, 2026
- RLSA-2026:2090 Important: python3.12-wheel security update Rocky Linux Security Advisories · Feb 6, 2026
- ALAS2023-2026-1414 Important: python3.13-wheel security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Feb 5, 2026
- RLSA-2026:1939 Important: python3.12-wheel security update Rocky Linux Security Advisories · Feb 5, 2026
- ELSA-2026-1902 Important: python-wheel security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Feb 5, 2026
- ELSA-2026-2090 Important: python3.12-wheel security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Feb 5, 2026