Vulnerability record/PUBLISHED/Published Oct 14, 2026 12:50:33 UTC
CVE-2026-109968
A flaw was found in the clevis PKCS#11 pin. The clevis-pkcs11-afunix-socket-unlock daemon logs LUKS disk encryption passphrases in plaintext to a log file. The log file is created without restrictive permissions, making it world-readable under the default process umask. A local attacker can read the log file to obtain the LUKS passphrase.
Base score5.5/ 10
SeverityMediumCVSS 3.1
Exploitability / impact
CVSS metric breakdown
Base severityMedium
Attack vectorLocalAV
Attack complexityLowAC
Privileges requiredLowPR
User interactionNoneUI
ScopeUnchangedS
Confidentiality impactHighC
Integrity impactNoneI
Availability impactNoneA
CVSS vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NCVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.
Record context
CVE Numbering Authorityredhat
Last updatedOct 30, 2026 07:22:42 UTC
PublishedOct 14, 2026 12:50:33 UTC
ReservedOct 13, 2026 11:32:07 UTC
Credits
- This issue was discovered by Sergio Correia (Red Hat).