{"id":"CVE-2021-3560","kind":"vulnerability","aliases":["CVE-2021-3560"],"related":[],"title":"It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the…","description":"It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privileges of the requestor to the root user. This flaw could be used by an unprivileged local attacker to, for example, create a new local administrator. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.","summary":"Polkit, the Linux service that decides which local users may perform privileged actions, can be tricked into skipping its credential check on D-Bus requests. A local user with no special rights gets root.","severity":"high","cvss":7.8,"epss":null,"exploited":true,"exploited_at":"2023-05-12T00:00:00+00:00","products":[{"name":"Red Hat Polkit","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"polkit project polkit","fixed":["0.119"],"affected":"< 0.119","ecosystem":"vendor"},{"name":"debian linux","fixed":[],"affected":"= 11.0","ecosystem":"vendor"},{"name":"canonical ubuntu linux","fixed":[],"affected":"= 20.04","ecosystem":"vendor"},{"name":"redhat virtualization","fixed":[],"affected":"= 4.0","ecosystem":"vendor"},{"name":"redhat virtualization host","fixed":[],"affected":"= 4.0","ecosystem":"vendor"},{"name":"redhat openshift container platform","fixed":[],"affected":"= 4.7","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","infrastructure","linux","polkit","self-hosted"],"not_affected_if":["fully-patched-polkit","no-local-users"],"how_to_check":null,"fix":"Apply the polkit update from your OS vendor, as CISA directs; the sources do not name the fixed version.","status":"open","published_at":"2022-02-16T19:15:08+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:06:47+00:00","updated_at":"2026-10-23T22:29:04+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T21:06:47Z","model":"claude-haiku-5-5","output":{"fix":"Apply the polkit update from your OS vendor, as CISA directs; the sources do not name the fixed version.\nunknown","reach":"local","impact":"high","summary":"Polkit, the Linux service that decides which local users may perform privileged actions, can be tricked into skipping its credential check on D-Bus requests. A local user with no special rights gets root.","category":"infrastructure","who_cares":["linux","polkit","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"local unprivileged user escalates to root on the machine","analyst_note":"Find the affected and fixed polkit package versions per distro in the Red Hat CVE page for CVE-2021-3560 and add a version check command.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-local-users","fully-patched-polkit"],"user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000445,"input_tokens":2797,"output_tokens":331,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2021':21A,24A '-3560':22A,25A 'action':65B 'administr':133C 'attack':125C 'avail':150C 'bus':17A,77B,104C 'bypass':10A,97C 'canonical':34A 'check':13A,73B,100C 'confidenti':143C 'container':44A 'could':6A,93C,118C 'creat':129C 'credenti':12A,72B,99C 'cve':20A,23A 'd':16A,76B,103C 'd-bus':15A,75B,102C 'data':142C 'debian':32A 'decid':58B 'elev':19A,106C 'exampl':128C 'exploit':46B 'flaw':117C 'found':3A,90C 'get':86B 'hat':27A 'highest':135C 'host':41A,52B 'infrastructur':47B 'integr':145C 'linux':33A,36A,48B,55B 'local':60B,80B,124C,132C 'may':62B 'new':131C 'openshift':43A 'perform':63B 'platform':45A 'polkit':5A,28A,29A,31A,49B,53B,92C 'privileg':64B,108C 'project':30A 'red':26A 'redhat':37A,39A,42A 'request':18A,78B,105C 'requestor':111C 'right':85B 'root':87B,114C 'self':51B 'self-host':50B 'servic':56B 'skip':70B 'special':84B 'system':149C 'threat':136C 'trick':8A,68B,95C 'ubuntu':35A 'unprivileg':123C 'use':120C 'user':61B,81B,115C 'virtualization':38A,40A 'vulner':139C 'well':147C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2022-02-16T19:15:08+00:00","kev":{"dateAdded":"2023-05-12","dueDate":"2023-06-02","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2021-3560","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-3560","severity":null,"published_at":"2023-05-12T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T17:39:56+00:00","note":null},{"source":"nvd","external_id":"CVE-2021-3560","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3560","severity":null,"published_at":"2022-02-16T19:15:08+00:00","modified_at":"2026-06-17T04:05:20+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}