IP-DB.com
Türkçe English Deutsch Español
Entrar Obtener clave API
7.3Alta

CVE-2026-91151Cockpit: cockpit: local privilege escalation via insecure symlink handling in public key addition helper

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 10.2 Extended Update Support; Red Hat Red Hat Enterprise Linux 8; Red Hat Red Hat Enterpr… Publicada: (hace 2 días)

Descripción

A flaw was found in Cockpit. A local authenticated user with control over a target account's home directory can exploit a privileged symlink dereference vulnerability in the `ssh-add-public-key.sh` helper. When this helper runs with elevated privileges, it can be tricked into following attacker-controlled symlinks within the `.ssh` or `authorized_keys` paths. This allows the attacker to arbitrarily change file ownership and modes, potentially leading to local privilege escalation and impacting the integrity, confidentiality, and availability of the system.

Debilidad (CWE): CWE-59

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

FabricanteProductoVersiones
enterprise linux 8 —
enterprise linux 9 —
Red Hat Red Hat Enterprise Linux 10 all versions
Red Hat Red Hat Enterprise Linux 10.2 Extended Update Support all versions
Red Hat Red Hat Enterprise Linux 7 all versions
Red Hat Red Hat Enterprise Linux 8 all versions
Red Hat Red Hat Enterprise Linux 9 all versions
Red Hat Red Hat Enterprise Linux 9.8 Extended Update Support all versions
Red Hat Red Hat OpenShift Dev Spaces all versions
rhel eus 9.8 —

Referencias y parches

CVE recientes del mismo producto — Red Hat Enterprise Linux

5.5Media
CVE-2026-110330

Abrt: abrt: abrt-server trusts client-supplied pid= allowing unprivileged read of other processes' /proc environ

Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8

A flaw was found in abrt. abrt-server trusts a client-supplied PID when creating problem dumps over abrt.socket and, running as root, copies that process's /proc data (including environ) into a dump directory owned by the connecting unprivileged user. This al…

7.8Alta
CVE-2026-110331

Abrt: abrt: incomplete cve-2026-54228/54229 fix — completeness gate bypassed via attacker-supplied count element

Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8

A flaw was found in abrt. The completeness check introduced to mitigate CVE-2026-54228 and CVE-2026-54229 only verifies that a dump directory contains a "count" element, which an unprivileged user can create. This allows a local attacker to bypass the guard a…