Pelican Web UI Affected by a Privilege Escalation Attack

Background

On April 2nd, 2026, a Claude coding agent alerted Pelican PI Brian Bockelman to a privilege escalation vulnerability affecting Pelican's Web User Interface (WebUI) for various versions between v7.21 and v7.24. Upon further investigation, the Pelican team discovered this attack allows any user authenticated to the WebUI via OAuth to gain admin privileges under certain configurations. These may include servers with the following configuration variables enabled:

• Server.UIAdminUsers: Affected if any of the listed admin users or the default admin account have not previously logged in to the server.

• Server.AdminGroups: Affected if Issuer.GroupSource is set to internal and an admin of the group has not previously logged in to the server.

The OSDF operations team has mitigated these for core services, origins, and caches operated by the PATh project. However, mitigation may be needed for caches and origins not centrally operated.

Pelican Command Line has not currently identified any evidence this attack has been exploited in the services managed by OSDF operators.

Severity and Impact

When leveraged, an attacker with any kind of authenticated session on the server can create database records that cause the server to grant them admin privileges on subsequent login. Critically, admin access enables modifying the server's configuration, creating persistent API tokens, and changing admin passwords. The table below summarizes potential implications of this exploit.

Service Data exposure risk Data tampering risk Federation-wide impact

Director Low (no data stored) High — can modify configuration to point to a different Registry High — can modify configuration to add GeoIP overrides to steer federation. Denial of service on the federation

Registry Low High — can modify existing or create malicious namespaces that impersonate trusted paths High — federation-wide namespace poisoning. Denial of service on the federation

Origin High — can expose protected paths via config or export object store/filesystem paths into a namespace High — can potentially enable writes + change export paths Medium — scoped to that origin's namespaces

Cache Medium — can expose cached protected data via config changes Low — caches don't originate data Low — scoped to that cache

Attack Preconditions

Both attacks share the same prerequisites:

• The server's OIDC logins must be enabled.

• The attacker must have some form of authenticated session on the server, typically from an OIDC login.

• The attacker must know or guess a relevant admin identifier (a Server.UIAdminUsers username or a Server.AdminGroups group name) for an admin who has not previously logged into the WebUI.

Immediate Mitigation Steps

1. Audit the consuming service's database

Before upgrading, Pelican Command Line recommends auditing the service's database to see if it has already been exploited and to block further exploitation. Upgrading an exploited server is insufficient to prevent future unauthorized access if the exploit has already occurred.

Pelican Command Line is providing a script mitigate-user-escalation.sh that:

• Displays all user records and group memberships for manual review, highlighting any that show fingerprints of the attack with [!] for explicit review — administrators should verify all entries, but especially those with this syntax highlighting. The highlighted changes do not guarantee an exploit occurred but that further examination is needed.

• Creates database records mitigating the attack vector.

• Displays all API tokens, which may have been created by an attacker for persistent access, for administrator review. Suspicious tokens should be deleted using the provided SQLite commands.

• Provides additional guidance about rotating secrets on the server.

This script is available as a github gist: https://gist.github.com/jhiemstrawisc/8c4b2b3ec5cb2ca06537d9439dc16cc9

To run the script:

# Run as the same user that runs the Pelican server (e.g., pelican):
$ sudo bash mitigate-user-escalation.sh

# If using a non-standard config file:
$ sudo bash mitigate-user-escalation.sh --config /path/to/pelican.yaml

# If the database is in a non-standard location:
$ sudo bash mitigate-user-escalation.sh --db-path /path/to/pelican.sqlite