CVE-2026-74020

The CVSS 7.5 rating correctly identifies the technical severity of an unauthenticated broken access control flaw in Koji, but the EPSS score of 0.00287 is creating dangerous analytical complacency. EPSS measures probability of active exploitation based on current threat intelligence — which reflects reachability of internet-facing services. For Koji, that's the wrong question. This isn't a web application where unauthenticated access means direct data theft. It's a build system that produces RPM packages distributed to thousands of endpoints. Broken access control here means an attacker can manipulate what gets built and signed, injecting malicious code into packages that downstream systems will trust based on cryptographic signatures. The attack surface isn't the Koji API itself — it's the software supply chain that depends on it. The low EPSS likely captures that Koji instances are typically internal infrastructure, but this misses the actual threat model. A successful exploit doesn't give you one compromised system. It gives you a single point of injection that propagates through automated trust mechanisms into thousands of systems that will never question whether the build was manipulated. That's not a vulnerability with a certain exploitation probability — that's a delivery mechanism with near-100% propagation once triggered. What you should actually do: determine whether your organization consumes packages from any Koji instance, audit that instance's access controls for the vulnerable paths in versions <=2.2.1, and critically — verify whether your artifact verification pipeline would catch a cryptographically valid but malicious package. Standard repo verification won't. Patching the CVE is table stakes. The real question is whether anyone has enumerated which deprecated Koji workflows, API endpoints, and access control paths are still active in your instance. If you can't answer that, you're not managing the vulnerability — you're hoping the CVE is the only exposure.

Reviewed through automated stages and approved by a human before publication.