CVE-2026-104619 · Infrastructure
NO FIX YET · SEE WHAT TO DO
The PackageKit Zypp backend before 1.4.1 lets untrusted users roll back installed security updates on the system. Rolling back a patched package can reopen a flaw and allow privilege escalation.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Linux systems that use PackageKit with the Zypp backend (SUSE and openSUSE style systems that manage packages through zypper) before version 1.4.1 are exposed. Systems without PackageKit or without the Zypp backend installed are not affected. Local users who are not trusted are the ones who could abuse it.
Not affected if no-packagekit, no-zypp-backend, trusted-local-users-only
Who cares linux, opensuse, packagekit, self-hosted, suse, zypp
rpm -q PackageKit-backend-zypp or zypper info PackageKit-backend-zypp1.4.1 or laterUntrusted users could roll back security updates when using the PackageKit Zypp Backend before 1.4.1, allowing privilege escalation.
This page as .md · .json · CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.