CVE-2026-58015
CVE-2026-58015 · Glib: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receive
This page contains facts from public vulnerability sources. Check the original advisory before updating.
This page shows selected source facts. See the linked advisories for the complete description and affected versions.
A flaw was found in GLib. The D-Bus client-side implementation of the DBUS_COOKIE_SHA1 SASL authentication mechanism does not validate the cookie_context parameter received from the server. A malicious D-Bus server can supply a cookie_context containing path traversal sequences, causing the client to read an arbitrary file and exfiltrate sensitive data by verifying guessed file contents against a generated hash.
CVSS 5.9 · Medium · EPSS 0.8% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
glib
- Versions
- ≥ 0, < 2.88.1: Affected (semver)
Update to 2.88.1
red hat enterprise linux 10
- Versions
- ≥ 0:2.80.4-12.el10_2.21: Not affected (rpm)
No fix published
red hat enterprise linux 10.0 extended update support
- Versions
- ≥ 0:2.80.4-4.el10_0.17: Not affected (rpm)
No fix published
red hat enterprise linux 7 extended lifecycle support
- Versions
- ≥ 0:2.56.1-13.el7_9.1: Not affected (rpm)
No fix published
red hat enterprise linux 8
- Versions
- ≥ 0:2.70.1-9.el8_10: Not affected (rpm)
No fix published
red hat enterprise linux 8
- Versions
- ≥ 0:2.56.4-177.el8_10: Not affected (rpm)
No fix published
red hat enterprise linux 8.4 advanced mission critical update support
- Versions
- ≥ 0:2.56.4-10.el8_4.7: Not affected (rpm)
No fix published
red hat enterprise linux 8.4 extended update support long-life add-on
- Versions
- ≥ 0:2.56.4-10.el8_4.7: Not affected (rpm)
No fix published
red hat enterprise linux 8.6 advanced mission critical update support
- Versions
- ≥ 0:2.56.4-158.el8_6.7: Not affected (rpm)
No fix published
red hat enterprise linux 8.6 extended update support long-life add-on
- Versions
- ≥ 0:2.56.4-158.el8_6.7: Not affected (rpm)
No fix published
red hat enterprise linux 8.8 telecommunications update service
- Versions
- ≥ 0:2.56.4-165.el8_8.2: Not affected (rpm)
No fix published
red hat enterprise linux 8.8 update services for sap solutions
- Versions
- ≥ 0:2.56.4-165.el8_8.2: Not affected (rpm)
No fix published
red hat enterprise linux 9
- Versions
- ≥ 0:2.68.4-19.el9_8.9: Not affected (rpm)
No fix published
red hat enterprise linux 9.2 update services for sap solutions
- Versions
- ≥ 0:2.68.4-7.el9_2.7: Not affected (rpm)
No fix published
red hat enterprise linux 9.4 update services for sap solutions
- Versions
- ≥ 0:2.68.4-14.el9_4.8: Not affected (rpm)
No fix published
red hat enterprise linux 9.6 extended update support
- Versions
- ≥ 0:2.68.4-16.el9_6.7: Not affected (rpm)
No fix published
red hat openshift container platform 4.12
- Versions
- ≥ 412.86.202609171314-0: Not affected (rpm)
No fix published
red hat openshift container platform 4.13
- Versions
- ≥ 413.92.202609302032-0: Not affected (rpm)
No fix published
red hat openshift container platform 4.14
- Versions
- ≥ 414.92.202609282130-0: Not affected (rpm)
No fix published
red hat openshift container platform 4.15
- Versions
- ≥ 415.92.202610081130-0: Not affected (rpm)
No fix published
red hat openshift container platform 4.22
- Versions
- ≥ 4.22.9.8.202609081748-0: Not affected (rpm)
No fix published
cert manager support for red hat openshift release 1.17
- Versions
- ≥ 1791371080: Not affected (rpm)
No fix published
cert manager support for red hat openshift release 1.17
- Versions
- ≥ 1791371069: Not affected (rpm)
No fix published
cert manager support for red hat openshift release 1.17
- Versions
- ≥ 1791788287: Not affected (rpm)
No fix published
Original sources
- https://access.redhat.com/errata/RHSA-2026:49512
- https://access.redhat.com/errata/RHSA-2026:55440
- https://access.redhat.com/errata/RHSA-2026:57015
- https://access.redhat.com/errata/RHSA-2026:58981
- https://access.redhat.com/errata/RHSA-2026:61766
- https://access.redhat.com/errata/RHSA-2026:61783
- https://access.redhat.com/errata/RHSA-2026:63135
- https://access.redhat.com/errata/RHSA-2026:63138
- https://access.redhat.com/errata/RHSA-2026:63140
- https://access.redhat.com/errata/RHSA-2026:65762
- https://access.redhat.com/errata/RHSA-2026:65763
- https://access.redhat.com/errata/RHSA-2026:65767
- https://access.redhat.com/errata/RHSA-2026:65768
- https://access.redhat.com/errata/RHSA-2026:65769
- https://access.redhat.com/errata/RHSA-2026:65770
- https://access.redhat.com/errata/RHSA-2026:65771
- https://access.redhat.com/errata/RHSA-2026:65773
- https://access.redhat.com/errata/RHSA-2026:66018
- https://access.redhat.com/errata/RHSA-2026:66357
- https://access.redhat.com/errata/RHSA-2026:70646
- https://access.redhat.com/errata/RHSA-2026:72394
- https://access.redhat.com/errata/RHSA-2026:72395
- https://access.redhat.com/errata/RHSA-2026:72399
- https://nvd.nist.gov/vuln/detail/CVE-2026-58015