highCVSS 8.8
October 1, 2026
Arbitrary file write on the client host via archive auto-unpacking and recursive downloads
GHSA-cc42-7jx5-834x
Patched in: v7.26.3
Read the advisory
Security
Security Advisories
Published advisories for Pelican, mirrored from the project’s GitHub Security Advisories. Each entry lists the affected versions and the releases that fix them.
Reporting a vulnerability
If you believe you have found a security issue in Pelican, please email security@pelicanplatform.org rather than opening a public issue. See the security policy for what to include in a report. How reports are handled, and how Pelican is developed securely, is described in CHTC’s Software Development Controls for Cybersecurity.
mediumCVSS 5.4
August 19, 2026
Missing ownership check in the Registry downtime API
GHSA-6xf9-9g8h-jc9v
Patched in: 7.26.1
Read the advisory
mediumCVSS 5.4
August 19, 2026
Unexpected server downtime via unbound server name in Director advertisements
GHSA-67rq-r35h-mq3f
Patched in: 7.26.1
Read the advisory
lowCVSS 3.1
August 19, 2026
Pending registration takeover via attacker-supplied verification key in Registry PUT
GHSA-cr7j-pjhr-2jrw
Patched in: 7.26.1
Read the advisory
criticalCVSS 9.0
April 23, 2026
Privilege Escalation Attack affecting Pelican Web UI
GHSA-rpfr-x88x-xwcwCVE-2026-42571
Patched in: v7.21.5, v7.22.3, v7.23.3, v7.24.2
Read the advisory