CVE-2026-58015

Summary

A flaw was found in GLib. The D-Bus client-side implementation of the DBUS_COOKIE_SHA1 SASL authentication mechanism does not validate the cookie_context parameter received from the server. A malicious D-Bus server can supply a cookie_context containing path traversal sequences, causing the client to read an arbitrary file and exfiltrate sensitive data by verifying guessed file contents against a generated hash.

Affected Software

VendorProductVersion RangeStatus
GNOMEGLib0 < 2.88.1affected
Red HatRed Hat Enterprise Linux 100:2.80.4-12.el10_2.21 < *unaffected
Red HatRed Hat Enterprise Linux 80:2.70.1-9.el8_10 < *unaffected
Red HatRed Hat Enterprise Linux 90:2.68.4-19.el9_8.9 < *unaffected
Red HatRed Hat Enterprise Linux 90:2.68.4-19.el9_8.9 < *unaffected

Weaknesses

  • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Workarounds

To mitigate this vulnerability, ensure that applications only connect to trusted D-Bus servers and operate within secure, isolated networks to prevent man-in-the-middle (MitM) attacks. If feasible, configuring the D-Bus connection to strictly require the EXTERNAL authentication mechanism and disabling DBUS_COOKIE_SHA1 will completely neutralize this issue.

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References