Live › vulnerability › CVE-2021-3560
Go to dashboardPolkit, the Linux service that decides which local users may perform privileged actions, can be tricked into skipping its credential check on D-Bus requests. A local user with no special rights gets root.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Red Hat Polkit | vendor | – | – |
| polkit project polkit | vendor | < 0.119 | 0.119 |
| debian linux | vendor | = 11.0 | – |
| canonical ubuntu linux | vendor | = 20.04 | – |
| redhat virtualization | vendor | = 4.0 | – |
| redhat virtualization host | vendor | = 4.0 | – |
| redhat openshift container platform | vendor | = 4.7 | – |
Unknown from the sources.
Apply the polkit update from your OS vendor, as CISA directs; the sources do not name the fixed version.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privileges of the requestor to the root user. This flaw could be used by an unprivileged local attacker to, for example, create a new local administrator. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
This page as .md · .json · in your agent: get_signal("CVE-2021-3560")
CISA KEV catalog, Creative Commons 0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.