Vulnerability record/PUBLISHED/Published Oct 14, 2026 10:01:05 UTC
CVE-2026-109971
A flaw was found in the clevis PKCS#11 pin. The clevis-decrypt-pkcs11 script passes the PKCS#11 token PIN as a command-line argument to pkcs11-tool, making it visible to any local user through process listing or the /proc filesystem.
Base score4.7/ 10
SeverityMediumCVSS 3.1
Exploitability / impact
CVSS metric breakdown
Base severityMedium
Attack vectorLocalAV
Attack complexityHighAC
Privileges requiredLowPR
User interactionNoneUI
ScopeUnchangedS
Confidentiality impactHighC
Integrity impactNoneI
Availability impactNoneA
CVSS vector string
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:NCVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.
Record context
CVE Numbering Authorityredhat
Last updatedOct 30, 2026 07:22:52 UTC
PublishedOct 14, 2026 10:01:05 UTC
ReservedOct 13, 2026 11:32:07 UTC
Credits
- This issue was discovered by Sergio Correia (Red Hat).