Common Weakness Enumeration

CWE-273

Allowed

Improper Check for Dropped Privileges

Abstraction: Base · Status: Incomplete

API response cwe.mitre.org

The product attempts to drop privileges but does not check or incorrectly checks to see if the drop succeeded.

69 vulnerabilities reference this CWE, most recent first.

CVE-2026-101306 (GCVE-0-2026-101306)

Vulnerability from cvelistv5 – Published: 2026-10-15 06:46 – Updated: 2026-10-15 06:46
VLAI
Title
Multiple jail filesystem root escapes
Summary
SCM_RIGHTS file descriptor passing did not preserve FD_RESOLVE_BENEATH when a descriptor was transferred. A process could clear the restriction by sending the descriptor to itself over a Unix domain socket. A process in a jail that has received a directory file descriptor from another jail can use these techniques to escape the jail's filesystem root restriction.
Severity
No CVSS data available.
CWE
  • CWE-273 - Improper Check for Dropped Privileges
  • CWE-281 - Improper Preservation of Permissions
Assigner
freebsd CNA under the mitre root
CNA scorecard D 60/100 over 69 records in the last 180 days details
References
Impacted products
Vendor Product Version
FreeBSD FreeBSD Affected: 15.1-RELEASE , < p4 (release)
Affected: 15.0-RELEASE , < p14 (release)
Affected: 14.5-RELEASE , < p1 (release)
Affected: 14.4-RELEASE , < p10 (release)
Create a notification for this product.
Date Public
2026-09-29 20:30
Credits
Jan Bramkamp
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "modules": [
            "jail"
          ],
          "product": "FreeBSD",
          "vendor": "FreeBSD",
          "versions": [
            {
              "lessThan": "p4",
              "status": "affected",
              "version": "15.1-RELEASE",
              "versionType": "release"
            },
            {
              "lessThan": "p14",
              "status": "affected",
              "version": "15.0-RELEASE",
              "versionType": "release"
            },
            {
              "lessThan": "p1",
              "status": "affected",
              "version": "14.5-RELEASE",
              "versionType": "release"
            },
            {
              "lessThan": "p10",
              "status": "affected",
              "version": "14.4-RELEASE",
              "versionType": "release"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Jan Bramkamp"
        }
      ],
      "datePublic": "2026-09-29T20:30:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "SCM_RIGHTS file descriptor passing did not preserve FD_RESOLVE_BENEATH when a descriptor was transferred.  A process could clear the restriction by sending the descriptor to itself over a Unix domain socket.\n\nA process in a jail that has received a directory file descriptor from another jail can use these techniques to escape the jail\u0027s filesystem root restriction."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-273",
              "description": "CWE-273: Improper Check for Dropped Privileges",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-281",
              "description": "CWE-281: Improper Preservation of Permissions",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-15T06:46:25.804Z",
        "orgId": "63664ac6-956c-4cba-a5d0-f46076e16109",
        "shortName": "freebsd"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.freebsd.org/advisories/FreeBSD-SA-26:66.jail.asc"
        }
      ],
      "title": "Multiple jail filesystem root escapes",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "63664ac6-956c-4cba-a5d0-f46076e16109",
    "assignerShortName": "freebsd",
    "cveId": "CVE-2026-101306",
    "datePublished": "2026-10-15T06:46:25.804Z",
    "dateReserved": "2026-09-28T13:33:02.323Z",
    "dateUpdated": "2026-10-15T06:46:25.804Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-101305 (GCVE-0-2026-101305)

Vulnerability from cvelistv5 – Published: 2026-10-15 06:46 – Updated: 2026-10-15 06:46
VLAI
Title
Multiple jail filesystem root escapes
Summary
renameat(2) did not enforce FD_RESOLVE_BENEATH on its directory arguments. A jailed process could rename a directory relative to a restricted descriptor, then escape the jail root via fchdir(2). This requires the directory to reside on a filesystem that is also reachable from the jail's root. A process in a jail that has received a directory file descriptor from another jail can use these techniques to escape the jail's filesystem root restriction.
Severity
No CVSS data available.
CWE
  • CWE-273 - Improper Check for Dropped Privileges
Assigner
freebsd CNA under the mitre root
CNA scorecard D 60/100 over 69 records in the last 180 days details
References
Impacted products
Vendor Product Version
FreeBSD FreeBSD Affected: 15.1-RELEASE , < p4 (release)
Affected: 15.0-RELEASE , < p14 (release)
Affected: 14.5-RELEASE , < p1 (release)
Affected: 14.4-RELEASE , < p10 (release)
Create a notification for this product.
Date Public
2026-09-29 20:30
Credits
Jan Bramkamp
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "modules": [
            "jail"
          ],
          "product": "FreeBSD",
          "vendor": "FreeBSD",
          "versions": [
            {
              "lessThan": "p4",
              "status": "affected",
              "version": "15.1-RELEASE",
              "versionType": "release"
            },
            {
              "lessThan": "p14",
              "status": "affected",
              "version": "15.0-RELEASE",
              "versionType": "release"
            },
            {
              "lessThan": "p1",
              "status": "affected",
              "version": "14.5-RELEASE",
              "versionType": "release"
            },
            {
              "lessThan": "p10",
              "status": "affected",
              "version": "14.4-RELEASE",
              "versionType": "release"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Jan Bramkamp"
        }
      ],
      "datePublic": "2026-09-29T20:30:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "renameat(2) did not enforce FD_RESOLVE_BENEATH on its directory arguments.  A jailed process could rename a directory relative to a restricted descriptor, then escape the jail root via fchdir(2).  This requires the directory to reside on a filesystem that is also reachable from the jail\u0027s root.\n\nA process in a jail that has received a directory file descriptor from another jail can use these techniques to escape the jail\u0027s filesystem root restriction."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-273",
              "description": "CWE-273: Improper Check for Dropped Privileges",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-15T06:46:16.471Z",
        "orgId": "63664ac6-956c-4cba-a5d0-f46076e16109",
        "shortName": "freebsd"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.freebsd.org/advisories/FreeBSD-SA-26:66.jail.asc"
        }
      ],
      "title": "Multiple jail filesystem root escapes",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "63664ac6-956c-4cba-a5d0-f46076e16109",
    "assignerShortName": "freebsd",
    "cveId": "CVE-2026-101305",
    "datePublished": "2026-10-15T06:46:16.471Z",
    "dateReserved": "2026-09-28T13:33:02.323Z",
    "dateUpdated": "2026-10-15T06:46:16.471Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-101304 (GCVE-0-2026-101304)

Vulnerability from cvelistv5 – Published: 2026-10-15 06:46 – Updated: 2026-10-15 06:46
VLAI
Title
Multiple jail filesystem root escapes
Summary
When fdescfs(4) was mounted in a jail with the "nodup" option, opening /dev/fd/N returned a descriptor that did not inherit FD_RESOLVE_BENEATH or the Capsicum capability rights of descriptor N. A process in a jail that has received a directory file descriptor from another jail can use these techniques to escape the jail's filesystem root restriction.
Severity
No CVSS data available.
CWE
  • CWE-273 - Improper Check for Dropped Privileges
  • CWE-273 - CWE-278: Insecure Preserved Inherited Permissions
Assigner
freebsd CNA under the mitre root
CNA scorecard D 60/100 over 69 records in the last 180 days details
References
Impacted products
Vendor Product Version
FreeBSD FreeBSD Affected: 15.1-RELEASE , < p4 (release)
Affected: 15.0-RELEASE , < p14 (release)
Affected: 14.5-RELEASE , < p1 (release)
Affected: 14.4-RELEASE , < p10 (release)
Create a notification for this product.
Date Public
2026-09-29 20:30
Credits
Jan Bramkamp
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "modules": [
            "jail"
          ],
          "product": "FreeBSD",
          "vendor": "FreeBSD",
          "versions": [
            {
              "lessThan": "p4",
              "status": "affected",
              "version": "15.1-RELEASE",
              "versionType": "release"
            },
            {
              "lessThan": "p14",
              "status": "affected",
              "version": "15.0-RELEASE",
              "versionType": "release"
            },
            {
              "lessThan": "p1",
              "status": "affected",
              "version": "14.5-RELEASE",
              "versionType": "release"
            },
            {
              "lessThan": "p10",
              "status": "affected",
              "version": "14.4-RELEASE",
              "versionType": "release"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Jan Bramkamp"
        }
      ],
      "datePublic": "2026-09-29T20:30:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "When fdescfs(4) was mounted in a jail with the \"nodup\" option, opening /dev/fd/N returned a descriptor that did not inherit FD_RESOLVE_BENEATH or the Capsicum capability rights of descriptor N.\n\nA process in a jail that has received a directory file descriptor from another jail can use these techniques to escape the jail\u0027s filesystem root restriction."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-273",
              "description": "CWE-273: Improper Check for Dropped Privileges",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-273",
              "description": "CWE-278: Insecure Preserved Inherited Permissions",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-15T06:46:03.792Z",
        "orgId": "63664ac6-956c-4cba-a5d0-f46076e16109",
        "shortName": "freebsd"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.freebsd.org/advisories/FreeBSD-SA-26:66.jail.asc"
        }
      ],
      "title": "Multiple jail filesystem root escapes",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "63664ac6-956c-4cba-a5d0-f46076e16109",
    "assignerShortName": "freebsd",
    "cveId": "CVE-2026-101304",
    "datePublished": "2026-10-15T06:46:03.792Z",
    "dateReserved": "2026-09-28T13:33:02.323Z",
    "dateUpdated": "2026-10-15T06:46:03.792Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-61897 (GCVE-0-2026-61897)

Vulnerability from cvelistv5 – Published: 2026-08-20 14:32 – Updated: 2026-08-26 19:50
VLAI
Title
accountsservice: incomplete privilege drop when running Ubuntu-specific language helper scripts
Summary
An Ubuntu-specific patch to AccountsService before 23.13.9-8ubuntu7 only partially drops privileges before launching language helper scripts. It changes the effective UID/GID to the target user but leaves the real UID as 0 (root). A shell spawned by a helper script inherits ruid=0 and may reset its effective UID to root, enabling local privilege escalation.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-26 19:43 UTC
CWE
  • CWE-273 - Improper Check for Dropped Privileges
Assigner
canonical CNA under the mitre root
CNA scorecard B 80/100 over 102 records in the last 180 days details
References
Impacted products
Vendor Product Version
Canonical accountsservice Affected: 22.07.5-2ubuntu1 , < 22.07.5-2ubuntu1.6 (dpkg)
Affected: 23.13.9-2ubuntu6 , < 23.13.9-2ubuntu6.1 (dpkg)
Affected: 23.13.9-8ubuntu5 , < 23.13.9-8ubuntu5.2 (dpkg)
Affected: 23.13.9-8ubuntu6 , < 23.13.9-8ubuntu7 (dpkg)
Create a notification for this product.
Credits
Deutsche Telekom Security GmbH Red Team
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-61897",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-26T19:43:37.600246Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-26T19:50:49.398Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageName": "accountsservice",
          "platforms": [
            "Ubuntu 14.04 LTS",
            "Ubuntu 16.04 LTS",
            "Ubuntu 18.04 LTS",
            "Ubuntu 20.04 LTS",
            "Ubuntu 22.04 LTS",
            "Ubuntu 24.04 LTS",
            "Ubuntu 26.04 LTS",
            "Ubuntu 26.10"
          ],
          "product": "accountsservice",
          "vendor": "Canonical",
          "versions": [
            {
              "lessThan": "22.07.5-2ubuntu1.6",
              "status": "affected",
              "version": "22.07.5-2ubuntu1",
              "versionType": "dpkg"
            },
            {
              "lessThan": "23.13.9-2ubuntu6.1",
              "status": "affected",
              "version": "23.13.9-2ubuntu6",
              "versionType": "dpkg"
            },
            {
              "lessThan": "23.13.9-8ubuntu5.2",
              "status": "affected",
              "version": "23.13.9-8ubuntu5",
              "versionType": "dpkg"
            },
            {
              "lessThan": "23.13.9-8ubuntu7",
              "status": "affected",
              "version": "23.13.9-8ubuntu6",
              "versionType": "dpkg"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Deutsche Telekom Security GmbH Red Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An Ubuntu-specific patch to AccountsService before 23.13.9-8ubuntu7 only partially drops privileges before launching language helper scripts. It changes the effective UID/GID to the target user but leaves the real UID as 0 (root). A shell spawned by a helper script inherits ruid=0 and may reset its effective UID to root, enabling local privilege escalation."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-273",
              "description": "CWE-273: Improper Check for Dropped Privileges",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-20T14:32:53.827Z",
        "orgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc",
        "shortName": "canonical"
      },
      "references": [
        {
          "name": "Launchpad Bug #2157985",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://bugs.launchpad.net/ubuntu/+source/accountsservice/+bug/2157985"
        },
        {
          "name": "Ubuntu CVE Tracker",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://ubuntu.com/security/CVE-2026-61897"
        }
      ],
      "title": "accountsservice: incomplete privilege drop when running Ubuntu-specific language helper scripts"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc",
    "assignerShortName": "canonical",
    "cveId": "CVE-2026-61897",
    "datePublished": "2026-08-20T14:32:53.827Z",
    "dateReserved": "2026-07-11T18:43:51.251Z",
    "dateUpdated": "2026-08-26T19:50:49.398Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-60085 (GCVE-0-2026-60085)

Vulnerability from cvelistv5 – Published: 2026-07-15 11:25 – Updated: 2026-07-15 12:40
VLAI
Title
PraisonAI before 4.6.78 Unenforced Security Policy in Subprocess Sandbox
Summary
PraisonAI before 4.6.78 contains an unenforced security policy vulnerability in the default Subprocess Sandbox backend where blocked_commands, blocked_paths, blocked_imports, allow_subprocess, and allow_file_write restrictions are completely ignored. Attackers can execute arbitrary subprocess commands, read sensitive files, and perform destructive operations despite explicit security policy configuration.
Severity
8.7 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
SSVC
Exploitation: none Automatable: yes Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-15 12:40 UTC
CWE
  • CWE-273 - Improper Check for Dropped Privileges
Assigner
VulnCheck CNA under the mitre root
CNA scorecard B 84/100 over 6106 records in the last 180 days details
References
Impacted products
Vendor Product Version
MervinPraison PraisonAI Affected: 0 , < 4.6.78 (semver)
Unaffected: 4.6.78 (semver)
    cpe:2.3:a:praison:praisonai:*:*:*:*:*:*:*:*
Create a notification for this product.
Date Public
2026-06-25 00:00
Credits
LHMisme420
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-60085",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-15T12:40:28.602042Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-15T12:40:35.347Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:pypi/praisonai",
          "product": "PraisonAI",
          "vendor": "MervinPraison",
          "versions": [
            {
              "lessThan": "4.6.78",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "4.6.78",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:praison:praisonai:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.6.78",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "LHMisme420"
        }
      ],
      "datePublic": "2026-06-25T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "PraisonAI before 4.6.78 contains an unenforced security policy vulnerability in the default Subprocess Sandbox backend where blocked_commands, blocked_paths, blocked_imports, allow_subprocess, and allow_file_write restrictions are completely ignored. Attackers can execute arbitrary subprocess commands, read sensitive files, and perform destructive operations despite explicit security policy configuration."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-273",
              "description": "Improper Check for Dropped Privileges",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-15T11:25:36.195Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-5r6c-gj4g-r697)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-5r6c-gj4g-r697"
        },
        {
          "name": "VulnCheck Advisory: PraisonAI before 4.6.78 Unenforced Security Policy in Subprocess Sandbox",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/praisonai-before-unenforced-security-policy-in-subprocess-sandbox"
        }
      ],
      "title": "PraisonAI before 4.6.78 Unenforced Security Policy in Subprocess Sandbox",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-60085",
    "datePublished": "2026-07-15T11:25:36.195Z",
    "dateReserved": "2026-07-08T12:14:28.344Z",
    "dateUpdated": "2026-07-15T12:40:35.347Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-58089 (GCVE-0-2026-58089)

Vulnerability from cvelistv5 – Published: 2026-08-26 04:30 – Updated: 2026-08-26 15:24
VLAI
Title
hwpmc fails to detach PMCs during exec credential transitions
Summary
When a process calls execve(2) to execute a setuid or setgid image, hwpmc(4) is supposed to detach PMCs owned by unprivileged processes. An inverted check meant that this scenario was not handled properly. An unprivileged local user who has attached PMCs to a process can continue monitoring it after the process executes a setuid or setgid binary, contrary to the intended policy.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-26 15:23 UTC
CWE
  • CWE-273 - Improper Check for Dropped Privileges
Assigner
freebsd CNA under the mitre root
CNA scorecard D 60/100 over 69 records in the last 180 days details
References
Impacted products
Vendor Product Version
FreeBSD FreeBSD Affected: 15.1-RELEASE , < p3 (release)
Affected: 15.0-RELEASE , < p13 (release)
Affected: 14.4-RELEASE , < p9 (release)
Create a notification for this product.
Date Public
2026-08-25 19:45
Credits
Alexander Leidinger
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-58089",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-26T15:23:48.918745Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-26T15:24:26.038Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "modules": [
            "hwpmc"
          ],
          "product": "FreeBSD",
          "vendor": "FreeBSD",
          "versions": [
            {
              "lessThan": "p3",
              "status": "affected",
              "version": "15.1-RELEASE",
              "versionType": "release"
            },
            {
              "lessThan": "p13",
              "status": "affected",
              "version": "15.0-RELEASE",
              "versionType": "release"
            },
            {
              "lessThan": "p9",
              "status": "affected",
              "version": "14.4-RELEASE",
              "versionType": "release"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Alexander Leidinger"
        }
      ],
      "datePublic": "2026-08-25T19:45:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "When a process calls execve(2) to execute a setuid or setgid image, hwpmc(4) is supposed to detach PMCs owned by unprivileged processes.  An inverted check meant that this scenario was not handled properly.\n\nAn unprivileged local user who has attached PMCs to a process can continue monitoring it after the process executes a setuid or setgid binary, contrary to the intended policy."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-273",
              "description": "CWE-273: Improper Check for Dropped Privileges",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-26T04:30:06.543Z",
        "orgId": "63664ac6-956c-4cba-a5d0-f46076e16109",
        "shortName": "freebsd"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.freebsd.org/advisories/FreeBSD-SA-26:56.hwpmc.asc"
        }
      ],
      "title": "hwpmc fails to detach PMCs during exec credential transitions",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "63664ac6-956c-4cba-a5d0-f46076e16109",
    "assignerShortName": "freebsd",
    "cveId": "CVE-2026-58089",
    "datePublished": "2026-08-26T04:30:06.543Z",
    "dateReserved": "2026-06-29T01:40:17.498Z",
    "dateUpdated": "2026-08-26T15:24:26.038Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-58086 (GCVE-0-2026-58086)

Vulnerability from cvelistv5 – Published: 2026-08-19 07:42 – Updated: 2026-08-27 15:54
VLAI
Title
ktrace(2) privilege incorrectly validated in jails
Summary
As an inadvertent side effect of an unrelated code change, PRIV_KTRACE was always denied to a jailed root user. Tracing configured by a jailed root user was therefore not flagged as privileged. An unprivileged user in a jail that has permission to debug the target process can modify the jailed root user's ktrace(2) flags, or disable tracing outright. A jailed root user therefore cannot reliably trace unprivileged processes.
Severity
8.1 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-27 15:54 UTC
CWE
  • CWE-273 - Improper Check for Dropped Privileges
Assigner
freebsd CNA under the mitre root
CNA scorecard D 60/100 over 69 records in the last 180 days details
References
Impacted products
Vendor Product Version
FreeBSD FreeBSD Affected: 15.1-RELEASE , < p2 (release)
Affected: 15.0-RELEASE , < p12 (release)
Create a notification for this product.
Date Public
2026-07-29 22:40
Credits
Alexander Leidinger
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.1,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-58086",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-27T15:54:51.867264Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-27T15:54:55.678Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "modules": [
            "ktrace"
          ],
          "product": "FreeBSD",
          "vendor": "FreeBSD",
          "versions": [
            {
              "lessThan": "p2",
              "status": "affected",
              "version": "15.1-RELEASE",
              "versionType": "release"
            },
            {
              "lessThan": "p12",
              "status": "affected",
              "version": "15.0-RELEASE",
              "versionType": "release"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Alexander Leidinger"
        }
      ],
      "datePublic": "2026-07-29T22:40:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "As an inadvertent side effect of an unrelated code change, PRIV_KTRACE was always denied to a jailed root user.  Tracing configured by a jailed root user was therefore not flagged as privileged.\n\nAn unprivileged user in a jail that has permission to debug the target process can modify the jailed root user\u0027s ktrace(2) flags, or disable tracing outright.  A jailed root user therefore cannot reliably trace unprivileged processes."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-273",
              "description": "CWE-273: Improper Check for Dropped Privileges",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T07:42:10.902Z",
        "orgId": "63664ac6-956c-4cba-a5d0-f46076e16109",
        "shortName": "freebsd"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.freebsd.org/advisories/FreeBSD-SA-26:53.ktrace.asc"
        }
      ],
      "title": "ktrace(2) privilege incorrectly validated in jails",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "63664ac6-956c-4cba-a5d0-f46076e16109",
    "assignerShortName": "freebsd",
    "cveId": "CVE-2026-58086",
    "datePublished": "2026-08-19T07:42:10.902Z",
    "dateReserved": "2026-06-29T01:40:17.498Z",
    "dateUpdated": "2026-08-27T15:54:55.678Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-54552 (GCVE-0-2026-54552)

Vulnerability from cvelistv5 – Published: 2026-08-18 17:37 – Updated: 2026-08-18 18:44
VLAI
Title
sh _uid does not drop supplementary groups (incomplete privilege drop)
Summary
sh provides Python process launching. Prior to 2.2.4, the _uid option in sh.py performs an incomplete privilege drop on Linux and Unix-like systems. When sh runs from an elevated process and launches a command with _uid set to an unprivileged user, the child changes its UID but can retain the parent process's supplementary groups because the privilege-drop sequence does not fully establish the target user's UID, primary GID, and supplementary groups. The child can therefore retain access to files or resources granted to privileged groups such as root, docker, disk, shadow, or sudo, violating the expected _uid privilege boundary. This issue is fixed in version 2.2.4.
Severity
7.9 (High)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-18 18:44 UTC
CWE
  • CWE-273 - Improper Check for Dropped Privileges
Assigner
GitHub_M CNA under the mitre root
CNA scorecard C 72/100 over 7637 records in the last 180 days details
References
Impacted products
Vendor Product Version
amoffat sh Affected: < 2.2.4
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-54552",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-18T18:44:23.350805Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-18T18:44:38.505Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "sh",
          "vendor": "amoffat",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.2.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "sh provides Python process launching. Prior to 2.2.4, the _uid option in sh.py performs an incomplete privilege drop on Linux and Unix-like systems. When sh runs from an elevated process and launches a command with _uid set to an unprivileged user, the child changes its UID but can retain the parent process\u0027s supplementary groups because the privilege-drop sequence does not fully establish the target user\u0027s UID, primary GID, and supplementary groups. The child can therefore retain access to files or resources granted to privileged groups such as root, docker, disk, shadow, or sudo, violating the expected _uid privilege boundary. This issue is fixed in version 2.2.4."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 7.9,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-273",
              "description": "CWE-273: Improper Check for Dropped Privileges",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-18T17:37:40.430Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/amoffat/sh/security/advisories/GHSA-q38v-wp89-2w55",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/amoffat/sh/security/advisories/GHSA-q38v-wp89-2w55"
        },
        {
          "name": "https://github.com/amoffat/sh/pull/776",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/amoffat/sh/pull/776"
        },
        {
          "name": "https://github.com/amoffat/sh/commit/3d855daba91f87a089b490c0d1cf1df3faace2f1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/amoffat/sh/commit/3d855daba91f87a089b490c0d1cf1df3faace2f1"
        },
        {
          "name": "https://github.com/amoffat/sh/releases/tag/2.2.4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/amoffat/sh/releases/tag/2.2.4"
        }
      ],
      "source": {
        "advisory": "GHSA-q38v-wp89-2w55",
        "discovery": "UNKNOWN"
      },
      "title": "sh _uid does not drop supplementary groups (incomplete privilege drop)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-54552",
    "datePublished": "2026-08-18T17:37:40.430Z",
    "dateReserved": "2026-06-15T19:04:14.456Z",
    "dateUpdated": "2026-08-18T18:44:38.505Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-49421 (GCVE-0-2026-49421)

Vulnerability from cvelistv5 – Published: 2026-08-19 05:25 – Updated: 2026-08-26 17:44
VLAI
Title
unlinkat(2) ignores AT_RESOLVE_BENEATH flag
Summary
The kernel function that implements unlinkat(2) and funlinkat(2) validated the AT_RESOLVE_BENEATH flag but failed to pass it through to the underlying path lookup. The flag was silently dropped, so path resolution was not actually restricted. A process that uses AT_RESOLVE_BENEATH with unlinkat(2) or funlinkat(2) to confine path resolution can in fact resolve paths above the starting directory. A caller relying on this flag for path containment may delete files outside the intended directory tree.
Severity
7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-26 17:44 UTC
CWE
  • CWE-273 - Improper Check for Dropped Privileges
Assigner
freebsd CNA under the mitre root
CNA scorecard D 60/100 over 69 records in the last 180 days details
References
Impacted products
Vendor Product Version
FreeBSD FreeBSD Affected: 15.1-RELEASE , < p1 (release)
Affected: 15.0-RELEASE , < p11 (release)
Affected: 14.4-RELEASE , < p7 (release)
Affected: 14.3-RELEASE , < p16 (release)
Create a notification for this product.
Date Public
2026-06-30 20:00
Credits
Yuxiang Yang, Yizhou Zhao, Ao Wang, Xuewei Feng, Qi Li, and Ke Xu from Tsinghua University using GLM-5.1 from Z.ai
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.1,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-49421",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-26T17:44:11.280156Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-26T17:44:13.985Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "modules": [
            "libalias"
          ],
          "product": "FreeBSD",
          "vendor": "FreeBSD",
          "versions": [
            {
              "lessThan": "p1",
              "status": "affected",
              "version": "15.1-RELEASE",
              "versionType": "release"
            },
            {
              "lessThan": "p11",
              "status": "affected",
              "version": "15.0-RELEASE",
              "versionType": "release"
            },
            {
              "lessThan": "p7",
              "status": "affected",
              "version": "14.4-RELEASE",
              "versionType": "release"
            },
            {
              "lessThan": "p16",
              "status": "affected",
              "version": "14.3-RELEASE",
              "versionType": "release"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Yuxiang Yang, Yizhou Zhao, Ao Wang, Xuewei Feng, Qi Li, and Ke Xu from Tsinghua University using GLM-5.1 from Z.ai"
        }
      ],
      "datePublic": "2026-06-30T20:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The kernel function that implements unlinkat(2) and funlinkat(2) validated the AT_RESOLVE_BENEATH flag but failed to pass it through to the underlying path lookup.  The flag was silently dropped, so path resolution was not actually restricted.\n\nA process that uses AT_RESOLVE_BENEATH with unlinkat(2) or funlinkat(2) to confine path resolution can in fact resolve paths above the starting directory.  A caller relying on this flag for path containment may delete files outside the intended directory tree."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-273",
              "description": "CWE-273: Improper Check for Dropped Privileges",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T05:25:43.003Z",
        "orgId": "63664ac6-956c-4cba-a5d0-f46076e16109",
        "shortName": "freebsd"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.freebsd.org/advisories/FreeBSD-SA-26:42.unlinkat.asc"
        }
      ],
      "title": "unlinkat(2) ignores AT_RESOLVE_BENEATH flag",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "63664ac6-956c-4cba-a5d0-f46076e16109",
    "assignerShortName": "freebsd",
    "cveId": "CVE-2026-49421",
    "datePublished": "2026-08-19T05:25:43.003Z",
    "dateReserved": "2026-05-29T20:24:28.616Z",
    "dateUpdated": "2026-08-26T17:44:13.985Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-44073 (GCVE-0-2026-44073)

Vulnerability from cvelistv5 – Published: 2026-05-21 07:35 – Updated: 2026-05-21 12:23
VLAI
Title
seteuid failure ignored in auth modules
Summary
Authentication modules in Netatalk 1.5.0 through 4.4.2 fail to check the return value of seteuid(), which may allow a remote authenticated attacker to retain elevated privileges under error conditions.
Severity
4 (Medium)
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-21 12:22 UTC
CWE
  • CWE-273 - Improper Check for Dropped Privileges
Assigner
securin CNA under the mitre root
CNA scorecard B 80/100 over 71 records in the last 180 days details
References
Impacted products
Vendor Product Version
Netatalk Netatalk Affected: 1.5.0 , ≤ 4.4.2 (semver)
Unaffected: 4.5.0 (semver)
Create a notification for this product.
Date Public
2026-05-13 00:00
Credits
Arjun Basnet from Securin
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-44073",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-21T12:22:54.006379Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-21T12:23:53.854Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Netatalk",
          "vendor": "Netatalk",
          "versions": [
            {
              "lessThanOrEqual": "4.4.2",
              "status": "affected",
              "version": "1.5.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "4.5.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Arjun Basnet from Securin"
        }
      ],
      "datePublic": "2026-05-13T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Authentication modules in Netatalk 1.5.0 through 4.4.2 fail to check the return value of seteuid(), which may allow a remote authenticated attacker to retain elevated privileges under error conditions."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-273",
              "description": "Improper Check for Dropped Privileges",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-21T07:52:54.774Z",
        "orgId": "33c584b5-0579-4c06-b2a0-8d8329fcab9c",
        "shortName": "securin"
      },
      "references": [
        {
          "name": "Netatalk Security Advisory CVE-2026-44073",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://netatalk.io/security/CVE-2026-44073"
        }
      ],
      "title": "seteuid failure ignored in auth modules"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "33c584b5-0579-4c06-b2a0-8d8329fcab9c",
    "assignerShortName": "securin",
    "cveId": "CVE-2026-44073",
    "datePublished": "2026-05-21T07:35:06.589Z",
    "dateReserved": "2026-05-05T07:25:20.196Z",
    "dateUpdated": "2026-05-21T12:23:53.854Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}
Mitigation MIT-46
Architecture and Design

Strategy: Separation of Privilege

  • Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
  • Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Mitigation MIT-53
Implementation

Check the results of all functions that return a value and verify that the value is expected.

Mitigation
Implementation

In Windows, make sure that the process token has the SeImpersonatePrivilege(Microsoft Server 2003). Code that relies on impersonation for security must ensure that the impersonation succeeded, i.e., that a proper privilege demotion happened.

No CAPEC attack patterns related to this CWE.

← Back to the CWE list