7.1Alta

CVE-2026-54369acl < 2.4.0 Symlink Traversal Privilege Escalation via libacl Functions

acl project acl; Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Red Hat Enterprise Linux 8 Publicada: 2026-06-29 15:37 (hace 4 meses)

Descripción

acl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() that allows local attackers to escalate privileges by replacing any pathname component with a symbolic link. Attackers who control any component of a pathname processed by a privileged caller can redirect ACL read or write operations to arbitrary files or directories, enabling unauthorized manipulation of access control lists and local privilege escalation.

Debilidad (CWE): CWE-59

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

Fabricante	Producto	Versiones
acl project	acl	< 2.4.0
discovery	2	—
insights proxy	1.5	—
openshift	4.22	—
openshift distributed tracing	3.10	—
Red Hat	Red Hat Discovery 2	all versions
Red Hat	Red Hat Enterprise Linux 10	all versions
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	all versions
Red Hat	Red Hat Enterprise Linux 6	all versions
Red Hat	Red Hat Enterprise Linux 7	all versions
Red Hat	Red Hat Enterprise Linux 8	all versions
Red Hat	Red Hat Enterprise Linux 9	all versions
Red Hat	Red Hat Hardened Images	all versions
Red Hat	Red Hat Insights proxy 1.5	all versions
Red Hat	Red Hat OpenShift Container Platform 4	all versions
Red Hat	Red Hat OpenShift Container Platform 4.22	all versions
Red Hat	Red Hat OpenShift distributed tracing 3.10.2	all versions
Red Hat	Red Hat Update Infrastructure 5	all versions
rhui	5	—

Referencias y parches

Puntuación CVSS

7.1Alta

Fuente: VulnCheck · CVSS 3.1

Vector de ataque: Local
Complejidad: Baja
Privilegios: Bajos
Interacción del usuario: Ninguna
Alcance: Sin cambio
Confidencialidad: Alto
Integridad: Alto
Disponibilidad: Ninguno

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Todas las puntuaciones (6)

cna	CVSS 4.0	8.4Alta
cna	CVSS 3.1	7.1Alta
redhat-SADP	CVSS 3.1	7.1Alta
disclosure@vulncheck.com	CVSS 4.0	8.4Alta
disclosure@vulncheck.com	CVSS 3.1	7.1Alta
0b0ca135-0b70-47e7-9f44-1890c2a1c46c	CVSS 3.1	7.1Alta

EPSS (probabilidad de explotación en 30 días)

0.15%

superior al 5 % de todas las CVE

Evaluación de CISA (SSVC)

Explotación: none
Automatizable: no
Impacto técnico: total

Cronología

ID reservado2026-06-12
Publicada2026-06-29 15:37
Llegó a IP-DB2026-10-24 23:47
Última actualización2026-10-26 00:10

Asignada por (CNA): VulnCheck
Estado en NVD: Deferred

Ver en la fuente: CVE.org · NVD

Reciba un aviso cuando estos productos tengan una vulnerabilidad nueva

Activar alertas por correo

Gratis · con cuenta · se desactiva cuando quiera

CVE recientes del mismo producto — Red Hat Enterprise Linux

6.2Media

CVE-2026-128886 hace 23 horas

Dbus: server accept watch can be stalled by blocking nonce-tcp accept_with_noncefile path

Red Hat Red Hat Enterprise Linux 10

A flaw was found in dbus when configured with the nonce-tcp transport. An unauthenticated attacker able to connect to an exposed listener can cause a Denial of Service (DoS) by opening a connection and withholding the expected authentication token. Because th…

5.5Media

CVE-2026-110330 hace 23 horas

Abrt: abrt: abrt-server trusts client-supplied pid= allowing unprivileged read of other processes' /proc environ

Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8

A flaw was found in abrt. abrt-server trusts a client-supplied PID when creating problem dumps over abrt.socket and, running as root, copies that process's /proc data (including environ) into a dump directory owned by the connecting unprivileged user. This al…

7.8Alta

CVE-2026-110331 hace 23 horas

Abrt: abrt: incomplete cve-2026-54228/54229 fix — completeness gate bypassed via attacker-supplied count element

Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8

A flaw was found in abrt. The completeness check introduced to mitigate CVE-2026-54228 and CVE-2026-54229 only verifies that a dump directory contains a "count" element, which an unprivileged user can create. This allows a local attacker to bypass the guard a…

6.2Media

CVE-2026-128987 hace 23 horas

Dbus: infinite cpu-spin loop in libdbus socket transport when epipe is received during write operations

Red Hat Red Hat Enterprise Linux 10

A flaw was found in dbus. A local attacker can exploit this vulnerability by connecting to an affected service, requesting a response, and stopping socket reads while keeping the connection open. Because the socket transport handles broken pipe write errors a…

5.5Media

CVE-2026-128885 hace 23 horas

Dbus: stack out-of-bounds write in dbus _dbus_poll() select() fallback when file descriptor exceeds fd_setsize

Red Hat Red Hat Enterprise Linux 10

A flaw was found in D-Bus. In configurations where the daemon falls back to using the Unix select() mechanism for event monitoring, it does not verify whether file descriptor numbers exceed allocated limits. A local attacker can exploit this flaw by opening a…

8.8Alta

CVE-2026-18379 hace 2 días

Yggdrasil-worker-package-manager: yggdrasil-worker-package-manager: path traversal via unsanitized repo name in addrepo/removerepo

Red Hat Red Hat Enterprise Linux 10

A flaw was found in yggdrasil-worker-package-manager. An authenticated attacker can exploit this issue to achieve arbitrary file modification or potential privilege escalation. The vulnerability exists because repository management operations fail to sanitize…