RHEL 8 update closes an urwid session flaw that can lead to remote code execution

Red Hat has shipped updated python-urwid packages for Red Hat Enterprise Linux 8 to close a predictable-session-ID flaw in urwid’s web display backend. RHSA-2026:58562, issued August 24, rates the update Important and lists RHEL 8 across x86_64, Arm 64, IBM Z and Power, including RHEL 8.10 Extended Life Cycle channels, as affected.

What changed

The flaw, CVE-2026-9323, comes from using a cryptographically insecure pseudorandom-number generator for web-session identifiers. Red Hat says a remote attacker can observe enough identifiers to reconstruct the generator’s state; a local attacker can instead enumerate active session tokens from temporary files.

A successful attack can expose a victim’s terminal screen, inject keystrokes with the victim’s privileges or terminate the session. Red Hat assigns the issue a CVSS 3.1 base score of 8.1, with a network attack vector, no required privileges and no user interaction, while noting that exploitation has high attack complexity.

The fixed RHEL 8 build is python-urwid-1.3.1-5.el8_10, according to the advisory. Red Hat provides updated packages for all listed architectures and directs customers to apply the security update through their normal RHEL patching process.

Who is affected

The vulnerable path is specifically urwid’s web display backend, not every terminal interface built with urwid. Teams should prioritize systems that expose that backend over a network or use it for privileged operational consoles. The Red Hat CVE record says exploitation can reach operating-system-level code execution with the victim’s privileges.

The advisory covers standard RHEL 8 channels as well as RHEL 8.10 Extended Life Cycle channels. Administrators can use Red Hat Lightspeed patch analysis from the advisory to identify affected subscribed systems.

What to do

Apply RHSA-2026:58562 and verify that installed python3-urwid packages come from the updated build. If patching cannot happen immediately, Red Hat recommends disabling the urwid web display backend when it is not essential.

Where the backend must remain available, Red Hat’s mitigation guidance is to restrict network access to trusted clients with firewall rules and prevent unauthorized local access to temporary files containing active tokens. Configuration changes may require restarting the service. Those controls reduce exposure, but the package update is the durable fix.