PACKAGEKIT · CVE-2026-104620 · Infrastructure
NO FIX YET · SEE WHAT TO DO
PackageKit's Zypp backend has a path traversal flaw in its action simulation code before version 1.4.1. A local user can use it to gain root privileges on the machine.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Systems running PackageKit with the Zypp backend, which is used on openSUSE and SUSE Linux installs, are exposed to local privilege escalation. Multi-user Linux hosts and shared workstations carry the most risk, since any local account could exploit it. Machines without PackageKit or without the Zypp backend can skip it.
Not affected if no-packagekit, no-zypp-backend
Who cares linux, opensuse, packagekit, suse, zypp
pkcon --version or packagekitd --version, and confirm the Zypp backend is present (rpm -q PackageKit-backend-zypp or dpkg -l | grep packagekit)1.4.1 or laterA path traversal attack in simulation of actions in the Zypp backend of PackageKit before 1.4.1 could be used by local attackers to gain root privileges.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.