{"id":"CVE-2026-104619","kind":"vulnerability","aliases":["CVE-2026-104619"],"related":[],"title":"PackageKit Zypp backend lets untrusted users roll back security updates","description":"Untrusted users could roll back security updates when using the PackageKit Zypp Backend before 1.4.1, allowing privilege escalation.","summary":"The PackageKit Zypp backend before 1.4.1 lets untrusted users roll back installed security updates on the system. Rolling back a patched package can reopen a flaw and allow privilege escalation.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","linux","opensuse","packagekit","self-hosted","suse","zypp"],"not_affected_if":["no-packagekit","no-zypp-backend","trusted-local-users-only"],"how_to_check":"- Check the installed PackageKit Zypp backend version against the fixed release, for example with `rpm -q PackageKit-backend-zypp` or `zypper info PackageKit-backend-zypp`\n- Confirm whether PackageKit with the Zypp backend is installed on the machine at all","fix":"- PackageKit Zypp backend: move to `1.4.1` or later","status":"open","published_at":"2026-11-10T10:16:42+00:00","first_seen_at":"2026-11-10T10:21:12+00:00","triaged_at":"2026-11-10T10:21:29+00:00","updated_at":"2026-11-10T10:21:29+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-10T10:21:29Z","model":"claude-haiku-5-5","output":{"fix":"- PackageKit Zypp backend: move to `1.4.1` or later","reach":"local","title":"PackageKit Zypp backend lets untrusted users roll back security updates","impact":"high","summary":"The PackageKit Zypp backend before 1.4.1 lets untrusted users roll back installed security updates on the system. Rolling back a patched package can reopen a flaw and allow privilege escalation.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["packagekit","zypp","opensuse","suse","linux","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"local user escalates privileges by rolling back security patches","analyst_note":"","how_to_check":"- Check the installed PackageKit Zypp backend version against the fixed release, for example with `rpm -q PackageKit-backend-zypp` or `zypper info PackageKit-backend-zypp`\n- Confirm whether PackageKit with the Zypp backend is installed on the machine at all","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["no-packagekit","no-zypp-backend","trusted-local-users-only"],"who_is_affected":"Linux systems that use PackageKit with the Zypp backend (SUSE and openSUSE style systems that manage packages through zypper) before version 1.4.1 are exposed. Systems without PackageKit or without the Zypp backend installed are not affected. Local users who are not trusted are the ones who could abuse it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000732,"input_tokens":4501,"output_tokens":564,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-104619':13A,16A '-2026':12A,15A '1.4.1':31B,70C 'allow':53B,71C 'back':8A,36B,44B,60C 'backend':3A,29B,68C 'could':58C 'cve':11A,14A 'escal':55B,73C 'flaw':51B 'host':23B 'infrastructur':17B 'instal':37B 'let':4A,32B 'linux':18B 'opensus':19B 'packag':47B 'packagekit':1A,20B,27B,66C 'patch':46B 'privileg':54B,72C 'reopen':49B 'roll':7A,35B,43B,59C 'secur':9A,38B,61C 'self':22B 'self-host':21B 'suse':24B 'system':42B 'untrust':5A,33B,56C 'updat':10A,39B,62C 'use':64C 'user':6A,34B,57C 'zypp':2A,25B,28B,67C","nicknames":[],"mitigations":[],"who_affected":"Linux systems that use PackageKit with the Zypp backend (SUSE and openSUSE style systems that manage packages through zypper) before version 1.4.1 are exposed. Systems without PackageKit or without the Zypp backend installed are not affected. Local users who are not trusted are the ones who could abuse it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","infrastructure","linux","opensuse","packagekit","selfhosted","suse","zypp"],"campaign_type":null,"search_a":"'-104619':13A,16A '-2026':12A,15A 'back':8A 'backend':3A 'cve':11A,14A 'let':4A 'packagekit':1A 'roll':7A 'secur':9A 'untrust':5A 'updat':10A 'user':6A 'zypp':2A","search_b":"'1.4.1':31B 'allow':53B 'back':36B,44B 'backend':29B 'escal':55B 'flaw':51B 'host':23B 'infrastructur':17B 'instal':37B 'let':32B 'linux':18B 'opensus':19B 'packag':47B 'packagekit':20B,27B 'patch':46B 'privileg':54B 'reopen':49B 'roll':35B,43B 'secur':38B 'self':22B 'self-host':21B 'suse':24B 'system':42B 'untrust':33B 'updat':39B 'user':34B 'zypp':25B,28B","search_c":"'1.4.1':70C 'allow':71C 'back':60C 'backend':68C 'could':58C 'escal':73C 'packagekit':66C 'privileg':72C 'roll':59C 'secur':61C 'untrust':56C 'updat':62C 'use':64C 'user':57C 'zypp':67C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T10:16:42+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"meissner@suse.de","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-104619","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104619","severity":null,"published_at":"2026-11-10T10:16:42+00:00","modified_at":"2026-11-10T10:16:42+00:00","first_seen_at":"2026-11-10T10:21:12+00:00","fetched_at":"2026-11-10T10:21:12+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}