Vulnerability record/PUBLISHED/Published Oct 14, 2026 10:01:01 UTC
CVE-2026-109970
A flaw was found in the clevis PKCS#11 pin. The clevis-luks-pkcs11-askpin script writes the PKCS#11 token PIN in plaintext to a file without setting restrictive permissions. Under the default process umask, the file is world-readable. Additionally, the PIN file is not reliably cleaned up if the decryption script exits early, leaving the PIN accessible indefinitely.
Base score4.7/ 10
SeverityMediumCVSS 3.1
Exploitability / impact
CVSS metric breakdown
Base severityMedium
Attack vectorLocalAV
Attack complexityHighAC
Privileges requiredLowPR
User interactionNoneUI
ScopeUnchangedS
Confidentiality impactHighC
Integrity impactNoneI
Availability impactNoneA
CVSS vector string
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:NCVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.
Record context
CVE Numbering Authorityredhat
Last updatedOct 30, 2026 07:22:49 UTC
PublishedOct 14, 2026 10:01:01 UTC
ReservedOct 13, 2026 11:32:07 UTC
Credits
- This issue was discovered by Sergio Correia (Red Hat).