~2,300 Fedora/EPEL security tracking bugs became private on bugzilla.redhat.com (2026-09-07/08)

Project Discussion
, ,
1

Hi all,

A large number of Fedora/EPEL security tracking bugs on bugzilla.redhat.com
recently became inaccessible to anonymous users, and we would like to know
whether this is intentional.

What we observed

  • 2,304 Fedora/EPEL security tracking bugs, linked from 1,273 Bodhi security
    updates, can no longer be viewed anonymously.
    • show_bug.cgi?ctype=xml returns error="NotPermitted".
    • The REST API returns code 102 (“You are not authorized to access bug #…”).
  • Timing: most of them (1,879) changed between our fetches at
    2026-09-07 04:11 UTC and 2026-09-08 04:38 UTC. We first saw the remaining 425
    at 2026-09-09 04:32 UTC.
  • None of them had become visible again as of 2026-09-11.
  • All of them have the SecurityTracking keyword.
    • Products/versions: Fedora 41-45, rawhide, and EPEL 8/9/10.
    • Status: almost all are CLOSED ERRATA.
  • Their parent Security Response flaw bugs are still public.
  • The change looks selective. About 2,500 other tracking bugs in the same bug ID
    range (2367560-2499226) are still public, for example 2388157 and 2412805. We
    could not find an attribute in the public data that separates the two groups.

Examples

  • FEDORA-2025-350a4ec835 (unbound)
    • Tracking bug 2381426, “CVE-2025-5994 unbound: Unbound Cache poisoning
      [fedora-42]”, is now private.
    • Its parent flaw bug, 2380949, is still public.
  • FEDORA-2025-0022827a20 (runc, CVE-2025-47906): tracking bugs 2399284
    [fedora-41] and 2399563 [fedora-42] are now private.
  • FEDORA-2025-d2d34aad4c and FEDORA-EPEL-2025-eeecc49b01 (dnsdist,
    CVE-2025-30193): tracking bugs 2367560 [epel-9] and 2367561 [fedora-41] are now
    private.

Impact

For anyone reading Bugzilla anonymously, these updates lose their link to CVEs:
the tracking bug → flaw bug relationship can no longer be followed. This
affects downstream security tooling that builds update-to-CVE mappings from
Bodhi and Bugzilla.

Questions

  1. Was this change intentional? If so, could you share the reason, or the
    criteria used to decide which tracking bugs became private?
  2. Should we expect more tracking bugs to become private over time?
  3. If it was not intentional, could these bugs be made public again?
  4. Is there a recommended public source for the update-to-CVE mapping that does
    not depend on the visibility of Bugzilla tracking bugs?

We have the full list (Bodhi update ID ↔ Bugzilla bug ID, 4,595 pairs, CSV)
and are happy to share it with whoever can look into this. We have not posted
all the IDs publicly in case the change was intentional.

Thanks,
MaineK00n

4

Thanks for reporting this.

The data got flagged as spam and hidden from view.

We’ll get it visible again.

5

All the bugs should be visible again as we’ve reversed the transactions. (We did this by adding an admin function to perform this type of reversal so that in the unlikely event that something similar happens again we’ll be able to reverse it quickly next time.)

6

Thanks Alasdair :slight_smile: