CVE-2026-42571
Critical
Description
Pelican is a platform for creating data federations. From versions 7.21.0 to before 7.21.5, 7.22.0 to before 7.22.3, 7.23.0 to before 7.23.3, and 7.24.0 to before 7.24.2, there is a a privilege escalation vulnerability affecting Pelican's Web User Interface (WebUI). This attack allows any user authenticated to the WebUI via OAuth to gain admin privileges under certain configurations. This issue has been patched in versions 7.21.5, 7.22.3, 7.23.3, and 7.24.2.
SeverityCritical
CVSS9.0
Exploit probability—
ProductGithub.com/pelicanplatform/pelican
PublishedMay 9, 2026
First seenMay 9, 2026
Weakness typeCWE-863Incorrect authorization
How to fix
Update
- github.com/pelicanplatform/pelican0.0.0-20260408120501-7f73b9c3e677 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| github.com/pelicanplatform/pelicanGo | v < 0.0.0-20260408120501-7f73b9c3e677 | 0.0.0-20260408120501-7f73b9c3e677 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.