Unrated

UBUNTU-CVE-2026-54160

Type: withdrawalSource: OSV1 source record

Network UPS Tools is a collection of programs which provide a common interface for monitoring and administering UPS, PDU and SCD hardware. Prior to commits 658b24e and 1aa31d1, the GitHub Actions script used to prepare NUT tarballs and update GitHub Checks statuses and PR comments about it was mis-structured in terms of mixing code running with higher privileges (single-use token generated with write permissions) and untrusted inputs (PR source branch). A malicious PR run from a fork could extract the GITHUB_TOKEN value. It could potentially be abused while it was valid (while the GHA job ran) to manipulate Git repository contents, commit checks/statuses, or issue/PR comments, according to permissions it was issued with. This issue has been patched via commits 658b24e and 1aa31d1.

Announced 28 Sept 2026Source revision 1

Original source ↗

UBUNTU-CVE-2026-54160

Primary source · Revision 1 · Withdrawn

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:UBUNTU-CVE-2026-54160

nut

Source reference: /affected/0/package/name

Affected versions: 2.6.4-2.3ubuntu2
Source reference: /affected/0/versions
2.7.1-1ubuntu1
Source reference: /affected/0/versions
2.7.1-1ubuntu1.2
Source reference: /affected/0/versions
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

nut

Source reference: /affected/1/package/name

Affected versions: 2.7.1-1ubuntu5
Source reference: /affected/1/versions
2.7.1-1ubuntu6
Source reference: /affected/1/versions
2.7.2-4ubuntu1
Source reference: /affected/1/versions
2.7.2-4ubuntu1.2
Source reference: /affected/1/versions
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

nut

Source reference: /affected/2/package/name

Affected versions: 2.7.4-5ubuntu4
Source reference: /affected/2/versions
2.7.4-5.1ubuntu1
Source reference: /affected/2/versions
2.7.4-5.1ubuntu2
Source reference: /affected/2/versions
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

nut

Source reference: /affected/3/package/name

Affected versions: 2.7.4-9ubuntu1
Source reference: /affected/3/versions
2.7.4-11ubuntu3
Source reference: /affected/3/versions
2.7.4-11ubuntu4
Source reference: /affected/3/versions
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

nut

Source reference: /affected/4/package/name

Affected versions: 2.7.4-13ubuntu5
Source reference: /affected/4/versions
2.7.4-14ubuntu1
Source reference: /affected/4/versions
2.7.4-14ubuntu2
Source reference: /affected/4/versions
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

nut

Source reference: /affected/5/package/name

Affected versions: 2.8.0-7
Source reference: /affected/5/versions
2.8.1-3ubuntu1
Source reference: /affected/5/versions
2.8.1-3.1ubuntu1
Source reference: /affected/5/versions
2.8.1-3.1ubuntu2
Source reference: /affected/5/versions
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

nut

Source reference: /affected/6/package/name

Affected versions: 2.8.3-2
Source reference: /affected/6/versions
2.8.4+really-2
Source reference: /affected/6/versions
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          }
        ]
      }
    ],
    "package": {
      "name": "nut",
      "purl": "pkg:deb/ubuntu/nut?arch=source&distro=trusty",
      "ecosystem": "Ubuntu:14.04:LTS"
    },
    "versions": [
      "2.6.4-2.3ubuntu2",
      "2.7.1-1ubuntu1",
      "2.7.1-1ubuntu1.2"
    ],
    "database_specific": {
      "source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-54160.json"
    },
    "ecosystem_specific": {
      "binaries": [
        {
          "binary_name": "libups-nut-perl",
          "binary_version": "2.7.1-1ubuntu1.2"
        },
        {
          "binary_name": "libupsclient3",
          "binary_version": "2.7.1-1ubuntu1.2"
        },
        {
          "binary_name": "nut",
          "binary_version": "2.7.1-1ubuntu1.2"
        },
        {
          "binary_name": "nut-cgi",
          "binary_version": "2.7.1-1ubuntu1.2"
        },
        {
          "binary_name": "nut-client",
          "binary_version": "2.7.1-1ubuntu1.2"
        },
        {
          "binary_name": "nut-ipmi",
          "binary_version": "2.7.1-1ubuntu1.2"
        },
        {
          "binary_name": "nut-monitor",
          "binary_version": "2.7.1-1ubuntu1.2"
        },
        {
          "binary_name": "nut-server",
          "binary_version": "2.7.1-1ubuntu1.2"
        },
        {
          "binary_name": "nut-snmp",
          "binary_version": "2.7.1-1ubuntu1.2"
        },
        {
          "binary_name": "nut-xml",
          "binary_version": "2.7.1-1ubuntu1.2"
        },
        {
          "binary_name": "python-nut",
          "binary_version": "2.7.1-1ubuntu1.2"
        }
      ]
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          }
        ]
      }
    ],
    "package": {
      "name": "nut",
      "purl": "pkg:deb/ubuntu/nut?arch=source&distro=xenial",
      "ecosystem": "Ubuntu:16.04:LTS"
    },
    "versions": [
      "2.7.1-1ubuntu5",
      "2.7.1-1ubuntu6",
      "2.7.2-4ubuntu1",
      "2.7.2-4ubuntu1.2"
    ],
    "database_specific": {
      "source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-54160.json"
    },
    "ecosystem_specific": {
      "binaries": [
        {
          "binary_name": "libups-nut-perl",
          "binary_version": "2.7.2-4ubuntu1.2"
        },
        {
          "binary_name": "libupsclient4",
          "binary_version": "2.7.2-4ubuntu1.2"
        },
        {
          "binary_name": "nut",
          "binary_version": "2.7.2-4ubuntu1.2"
        },
        {
          "binary_name": "nut-cgi",
          "binary_version": "2.7.2-4ubuntu1.2"
        },
        {
          "binary_name": "nut-client",
          "binary_version": "2.7.2-4ubuntu1.2"
        },
        {
          "binary_name": "nut-ipmi",
          "binary_version": "2.7.2-4ubuntu1.2"
        },
        {
          "binary_name": "nut-monitor",
          "binary_version": "2.7.2-4ubuntu1.2"
        },
        {
          "binary_name": "nut-server",
          "binary_version": "2.7.2-4ubuntu1.2"
        },
        {
          "binary_name": "nut-snmp",
          "binary_version": "2.7.2-4ubuntu1.2"
        },
        {
          "binary_name": "nut-xml",
          "binary_version": "2.7.2-4ubuntu1.2"
        },
        {
          "binary_name": "python-nut",
          "binary_version": "2.7.2-4ubuntu1.2"
        }
      ]
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          }
        ]
      }
    ],
    "package": {
      "name": "nut",
      "purl": "pkg:deb/ubuntu/nut?arch=source&distro=bionic",
      "ecosystem": "Ubuntu:18.04:LTS"
    },
    "versions": [
      "2.7.4-5ubuntu4",
      "2.7.4-5.1ubuntu1",
      "2.7.4-5.1ubuntu2"
    ],
    "database_specific": {
      "source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-54160.json"
    },
    "ecosystem_specific": {
      "binaries": [
        {
          "binary_name": "libnutclient0",
          "binary_version": "2.7.4-5.1ubuntu2"
        },
        {
          "binary_name": "libups-nut-perl",
          "binary_version": "2.7.4-5.1ubuntu2"
        },
        {
          "binary_name": "libupsclient4",
          "binary_version": "2.7.4-5.1ubuntu2"
        },
        {
          "binary_name": "nut",
          "binary_version": "2.7.4-5.1ubuntu2"
        },
        {
          "binary_name": "nut-cgi",
          "binary_version": "2.7.4-5.1ubuntu2"
        },
        {
          "binary_name": "nut-client",
          "binary_version": "2.7.4-5.1ubuntu2"
        },
        {
          "binary_name": "nut-ipmi",
          "binary_version": "2.7.4-5.1ubuntu2"
        },
        {
          "binary_name": "nut-monitor",
          "binary_version": "2.7.4-5.1ubuntu2"
        },
        {
          "binary_name": "nut-server",
          "binary_version": "2.7.4-5.1ubuntu2"
        },
        {
          "binary_name": "nut-snmp",
          "binary_version": "2.7.4-5.1ubuntu2"
        },
        {
          "binary_name": "nut-xml",
          "binary_version": "2.7.4-5.1ubuntu2"
        },
        {
          "binary_name": "python-nut",
          "binary_version": "2.7.4-5.1ubuntu2"
        }
      ]
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          }
        ]
      }
    ],
    "package": {
      "name": "nut",
      "purl": "pkg:deb/ubuntu/nut?arch=source&distro=focal",
      "ecosystem": "Ubuntu:20.04:LTS"
    },
    "versions": [
      "2.7.4-9ubuntu1",
      "2.7.4-11ubuntu3",
      "2.7.4-11ubuntu4"
    ],
    "database_specific": {
      "source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-54160.json"
    },
    "ecosystem_specific": {
      "binaries": [
        {
          "binary_name": "libnutclient0",
          "binary_version": "2.7.4-11ubuntu4"
        },
        {
          "binary_name": "libnutscan1",
          "binary_version": "2.7.4-11ubuntu4"
        },
        {
          "binary_name": "libups-nut-perl",
          "binary_version": "2.7.4-11ubuntu4"
        },
        {
          "binary_name": "libupsclient4",
          "binary_version": "2.7.4-11ubuntu4"
        },
        {
          "binary_name": "nut",
          "binary_version": "2.7.4-11ubuntu4"
        },
        {
          "binary_name": "nut-cgi",
          "binary_version": "2.7.4-11ubuntu4"
        },
        {
          "binary_name": "nut-client",
          "binary_version": "2.7.4-11ubuntu4"
        },
        {
          "binary_name": "nut-ipmi",
          "binary_version": "2.7.4-11ubuntu4"
        },
        {
          "binary_name": "nut-powerman-pdu",
          "binary_version": "2.7.4-11ubuntu4"
        },
        {
          "binary_name": "nut-server",
          "binary_version": "2.7.4-11ubuntu4"
        },
        {
          "binary_name": "nut-snmp",
          "binary_version": "2.7.4-11ubuntu4"
        },
        {
          "binary_name": "nut-xml",
          "binary_version": "2.7.4-11ubuntu4"
        }
      ]
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          }
        ]
      }
    ],
    "package": {
      "name": "nut",
      "purl": "pkg:deb/ubuntu/nut?arch=source&distro=jammy",
      "ecosystem": "Ubuntu:22.04:LTS"
    },
    "versions": [
      "2.7.4-13ubuntu5",
      "2.7.4-14ubuntu1",
      "2.7.4-14ubuntu2"
    ],
    "database_specific": {
      "source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-54160.json"
    },
    "ecosystem_specific": {
      "binaries": [
        {
          "binary_name": "libnutclient0",
          "binary_version": "2.7.4-14ubuntu2"
        },
        {
          "binary_name": "libnutscan1",
          "binary_version": "2.7.4-14ubuntu2"
        },
        {
          "binary_name": "libups-nut-perl",
          "binary_version": "2.7.4-14ubuntu2"
        },
        {
          "binary_name": "libupsclient4",
          "binary_version": "2.7.4-14ubuntu2"
        },
        {
          "binary_name": "nut",
          "binary_version": "2.7.4-14ubuntu2"
        },
        {
          "binary_name": "nut-cgi",
          "binary_version": "2.7.4-14ubuntu2"
        },
        {
          "binary_name": "nut-client",
          "binary_version": "2.7.4-14ubuntu2"
        },
        {
          "binary_name": "nut-ipmi",
          "binary_version": "2.7.4-14ubuntu2"
        },
        {
          "binary_name": "nut-powerman-pdu",
          "binary_version": "2.7.4-14ubuntu2"
        },
        {
          "binary_name": "nut-server",
          "binary_version": "2.7.4-14ubuntu2"
        },
        {
          "binary_name": "nut-snmp",
          "binary_version": "2.7.4-14ubuntu2"
        },
        {
          "binary_name": "nut-xml",
          "binary_version": "2.7.4-14ubuntu2"
        }
      ]
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          }
        ]
      }
    ],
    "package": {
      "name": "nut",
      "purl": "pkg:deb/ubuntu/nut?arch=source&distro=noble",
      "ecosystem": "Ubuntu:24.04:LTS"
    },
    "versions": [
      "2.8.0-7",
      "2.8.1-3ubuntu1",
      "2.8.1-3.1ubuntu1",
      "2.8.1-3.1ubuntu2"
    ],
    "database_specific": {
      "source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-54160.json"
    },
    "ecosystem_specific": {
      "binaries": [
        {
          "binary_name": "libnutclient2t64",
          "binary_version": "2.8.1-3.1ubuntu2"
        },
        {
          "binary_name": "libnutscan2t64",
          "binary_version": "2.8.1-3.1ubuntu2"
        },
        {
          "binary_name": "libups-nut-perl",
          "binary_version": "2.8.1-3.1ubuntu2"
        },
        {
          "binary_name": "libupsclient6t64",
          "binary_version": "2.8.1-3.1ubuntu2"
        },
        {
          "binary_name": "nut",
          "binary_version": "2.8.1-3.1ubuntu2"
        },
        {
          "binary_name": "nut-cgi",
          "binary_version": "2.8.1-3.1ubuntu2"
        },
        {
          "binary_name": "nut-client",
          "binary_version": "2.8.1-3.1ubuntu2"
        },
        {
          "binary_name": "nut-i2c",
          "binary_version": "2.8.1-3.1ubuntu2"
        },
        {
          "binary_name": "nut-ipmi",
          "binary_version": "2.8.1-3.1ubuntu2"
        },
        {
          "binary_name": "nut-modbus",
          "binary_version": "2.8.1-3.1ubuntu2"
        },
        {
          "binary_name": "nut-monitor",
          "binary_version": "2.8.1-3.1ubuntu2"
        },
        {
          "binary_name": "nut-powerman-pdu",
          "binary_version": "2.8.1-3.1ubuntu2"
        },
        {
          "binary_name": "nut-server",
          "binary_version": "2.8.1-3.1ubuntu2"
        },
        {
          "binary_name": "nut-snmp",
          "binary_version": "2.8.1-3.1ubuntu2"
        },
        {
          "binary_name": "nut-xml",
          "binary_version": "2.8.1-3.1ubuntu2"
        },
        {
          "binary_name": "python3-nut",
          "binary_version": "2.8.1-3.1ubuntu2"
        }
      ]
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          }
        ]
      }
    ],
    "package": {
      "name": "nut",
      "purl": "pkg:deb/ubuntu/nut?arch=source&distro=resolute",
      "ecosystem": "Ubuntu:26.04:LTS"
    },
    "versions": [
      "2.8.3-2",
      "2.8.4+really-2"
    ],
    "database_specific": {
      "source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-54160.json"
    },
    "ecosystem_specific": {
      "binaries": [
        {
          "binary_name": "libnutclient2t64",
          "binary_version": "2.8.4+really-2"
        },
        {
          "binary_name": "libnutscan4",
          "binary_version": "2.8.4+really-2"
        },
        {
          "binary_name": "libups-nut-perl",
          "binary_version": "2.8.4+really-2"
        },
        {
          "binary_name": "libupsclient7",
          "binary_version": "2.8.4+really-2"
        },
        {
          "binary_name": "nut",
          "binary_version": "2.8.4+really-2"
        },
        {
          "binary_name": "nut-cgi",
          "binary_version": "2.8.4+really-2"
        },
        {
          "binary_name": "nut-client",
          "binary_version": "2.8.4+really-2"
        },
        {
          "binary_name": "nut-i2c",
          "binary_version": "2.8.4+really-2"
        },
        {
          "binary_name": "nut-ipmi",
          "binary_version": "2.8.4+really-2"
        },
        {
          "binary_name": "nut-modbus",
          "binary_version": "2.8.4+really-2"
        },
        {
          "binary_name": "nut-monitor",
          "binary_version": "2.8.4+really-2"
        },
        {
          "binary_name": "nut-powerman-pdu",
          "binary_version": "2.8.4+really-2"
        },
        {
          "binary_name": "nut-server",
          "binary_version": "2.8.4+really-2"
        },
        {
          "binary_name": "nut-snmp",
          "binary_version": "2.8.4+really-2"
        },
        {
          "binary_name": "nut-xml",
          "binary_version": "2.8.4+really-2"
        },
        {
          "binary_name": "python3-nut",
          "binary_version": "2.8.4+really-2"
        }
      ]
    }
  }
]

Publisher severity

No explicit severity was provided.

Event: #65228 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 20:31:49 GMT
Publisher date: Mon, 28 Sep 2026 17:17:00 GMT

Read the original announcement