CVE-2026-26104

Katalog CVE

CVSS 5.5 · Medium EPSS 0,10%

Kerentanan Missing Authorization pada redhat enterprise linux, freedesktop udisks. Skor CVSS 3.1 5.5 (Medium) menurut redhat.com.

Deskripsi (NVD)

A flaw was found in the udisks storage management daemon that allows unprivileged users to back up LUKS encryption headers without authorization. The issue occurs because a privileged D-Bus method responsible for exporting encryption metadata does not perform a policy check. As a result, sensitive cryptographic metadata can be read and written to attacker-controlled locations. This weakens the confidentiality guarantees of encrypted storage volumes.

Rincian

Terbit di NVD

25 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.5 (Medium), sumber redhat.com
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-862: Missing Authorization

EPSS (30 hari)

0,10% peluang dieksploitasi; lebih tinggi dari 0,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://access.redhat.com/security/cve/CVE-2026-26104 advisory vendor
• https://bugzilla.redhat.com/show_bug.cgi?id=2433717 issue tracking · advisory vendor
• https://access.redhat.com/errata/RHSA-2026:3476
• https://access.redhat.com/errata/RHSA-2026:5831
• https://github.com/storaged-project/udisks/security/advisories/GHSA-fcvx-497g-6xmw