CVE-2026-58015CWE-22path-traversal

CVE-2026-58015

Medium · published June 30, 2026

CVSS v3.1

5.9

EPSS

1%

Percentile

55.3

In the wild

Unconfirmed

What it is

A flaw was found in GLib. The D-Bus client-side implementation of the DBUS_COOKIE_SHA1 SASL authentication mechanism does not validate the cookie_context parameter received from the server. A malicious D-Bus server can supply a cookie_context containing path traversal sequences, causing the client to read an arbitrary file and exfiltrate sensitive data by verifying guessed file contents against a generated hash.

The record

Technical detail

CVSS v3.1: 5.9 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0: Not supplied
EPSS: 0.00774 · 55.3th percentile
Weakness: CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published: 2026-06-30T17:19Z

Affected products (6)

Product	Versions	Fixed in
gnome/glib	< 2.88.1	2.88.1
redhat/enterprise_linux	all versions	—
redhat/enterprise_linux	all versions	—
redhat/enterprise_linux	all versions	—
redhat/enterprise_linux	all versions	—
redhat/enterprise_linux	all versions	—

References (81)

https://access.redhat.com/errata/RHSA-2026:49512 · [email protected]https://access.redhat.com/errata/RHSA-2026:55440 · [email protected]https://access.redhat.com/errata/RHSA-2026:57015 · [email protected]https://access.redhat.com/errata/RHSA-2026:58981 · [email protected]https://access.redhat.com/errata/RHSA-2026:61766 · [email protected]https://access.redhat.com/errata/RHSA-2026:61783 · [email protected]https://access.redhat.com/errata/RHSA-2026:63135 · [email protected]https://access.redhat.com/errata/RHSA-2026:63138 · [email protected]https://access.redhat.com/errata/RHSA-2026:63140 · [email protected]https://access.redhat.com/errata/RHSA-2026:65762 · [email protected]https://access.redhat.com/errata/RHSA-2026:65763 · [email protected]https://access.redhat.com/errata/RHSA-2026:65767 · [email protected]https://access.redhat.com/errata/RHSA-2026:65768 · [email protected]https://access.redhat.com/errata/RHSA-2026:65769 · [email protected]https://access.redhat.com/errata/RHSA-2026:65770 · [email protected]https://access.redhat.com/errata/RHSA-2026:65771 · [email protected]https://access.redhat.com/errata/RHSA-2026:65773 · [email protected]https://access.redhat.com/errata/RHSA-2026:66018 · [email protected]https://access.redhat.com/errata/RHSA-2026:66357 · [email protected]https://access.redhat.com/errata/RHSA-2026:70646 · [email protected]https://access.redhat.com/errata/RHSA-2026:72394 · [email protected]https://access.redhat.com/errata/RHSA-2026:72395 · [email protected]https://access.redhat.com/errata/RHSA-2026:72399 · [email protected]https://access.redhat.com/errata/RHSA-2026:72470 · [email protected]https://access.redhat.com/errata/RHSA-2026:72475 · [email protected]https://access.redhat.com/errata/RHSA-2026:72476 · [email protected]https://access.redhat.com/errata/RHSA-2026:72502 · [email protected]https://access.redhat.com/errata/RHSA-2026:73859 · [email protected]https://access.redhat.com/errata/RHSA-2026:73866 · [email protected]https://access.redhat.com/errata/RHSA-2026:73909 · [email protected]https://access.redhat.com/errata/RHSA-2026:82888 · [email protected]https://access.redhat.com/security/cve/CVE-2026-58015 · [email protected]https://bugzilla.redhat.com/show_bug.cgi?id=2492256 · [email protected]https://gitlab.gnome.org/GNOME/glib/-/issues/3931 · [email protected]https://access.redhat.com/errata/RHSA-2026:73929 · [email protected]https://access.redhat.com/errata/RHSA-2026:73930 · [email protected]https://access.redhat.com/errata/RHSA-2026:73959 · [email protected]https://access.redhat.com/errata/RHSA-2026:73960 · [email protected]https://access.redhat.com/errata/RHSA-2026:73961 · [email protected]https://access.redhat.com/errata/RHSA-2026:73962 · [email protected]https://access.redhat.com/errata/RHSA-2026:74458 · [email protected]https://access.redhat.com/errata/RHSA-2026:74459 · [email protected]https://access.redhat.com/errata/RHSA-2026:74460 · [email protected]https://access.redhat.com/errata/RHSA-2026:74461 · [email protected]https://access.redhat.com/errata/RHSA-2026:74462 · [email protected]https://access.redhat.com/errata/RHSA-2026:74463 · [email protected]https://access.redhat.com/errata/RHSA-2026:74674 · [email protected]https://access.redhat.com/errata/RHSA-2026:74677 · [email protected]https://access.redhat.com/errata/RHSA-2026:74678 · [email protected]https://access.redhat.com/errata/RHSA-2026:74679 · [email protected]https://access.redhat.com/errata/RHSA-2026:74681 · [email protected]https://access.redhat.com/errata/RHSA-2026:74683 · [email protected]https://access.redhat.com/errata/RHSA-2026:74685 · [email protected]https://access.redhat.com/errata/RHSA-2026:74687 · [email protected]https://access.redhat.com/errata/RHSA-2026:74688 · [email protected]https://access.redhat.com/errata/RHSA-2026:74771 · [email protected]https://access.redhat.com/errata/RHSA-2026:75652 · [email protected]https://access.redhat.com/errata/RHSA-2026:75654 · [email protected]https://access.redhat.com/errata/RHSA-2026:75655 · [email protected]https://access.redhat.com/errata/RHSA-2026:75657 · [email protected]https://access.redhat.com/errata/RHSA-2026:75658 · [email protected]https://access.redhat.com/errata/RHSA-2026:75659 · [email protected]https://access.redhat.com/errata/RHSA-2026:75660 · [email protected]https://access.redhat.com/errata/RHSA-2026:76042 · [email protected]https://access.redhat.com/errata/RHSA-2026:77320 · [email protected]https://access.redhat.com/errata/RHSA-2026:80769 · [email protected]https://access.redhat.com/errata/RHSA-2026:80771 · [email protected]https://access.redhat.com/errata/RHSA-2026:82059 · [email protected]https://access.redhat.com/errata/RHSA-2026:82061 · [email protected]https://access.redhat.com/errata/RHSA-2026:82066 · [email protected]https://access.redhat.com/errata/RHSA-2026:82304 · [email protected]https://access.redhat.com/errata/RHSA-2026:82322 · [email protected]https://access.redhat.com/errata/RHSA-2026:82336 · [email protected]https://access.redhat.com/errata/RHSA-2026:82347 · [email protected]https://access.redhat.com/errata/RHSA-2026:82354 · [email protected]https://access.redhat.com/errata/RHSA-2026:82368 · [email protected]https://access.redhat.com/errata/RHSA-2026:82371 · [email protected]https://access.redhat.com/errata/RHSA-2026:82372 · [email protected]https://access.redhat.com/errata/RHSA-2026:82415 · [email protected]https://access.redhat.com/errata/RHSA-2026:82811 · [email protected]https://access.redhat.com/errata/RHSA-2026:82857 · [email protected]

EPSS history

Timeline

30 JUN 13:02Z
Glib: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receive
cvelistv5