{"id":"CVE-2026-110330","kind":"vulnerability","aliases":["CVE-2026-110330"],"related":[],"title":"abrt: local users can read other processes' environment data via dumps","description":"A flaw was found in abrt. abrt-server trusts a client-supplied PID when creating problem dumps over abrt.socket and, running as root, copies that process's /proc data (including environ) into a dump directory owned by the connecting unprivileged user. This allows a local attacker to read environment variables and related metadata of other users' or root processes when abrtd is running.","summary":"abrt-server trusts a PID supplied by the client when creating problem dumps over abrt.socket, and as root copies that process's /proc data, including its environment, into a directory the unprivileged caller owns. A local attacker can read environment variables and metadata from other users' or root's processes while abrtd runs.","severity":"medium","cvss":5.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"abrt","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["abrt","linux","other","self-hosted"],"not_affected_if":["abrt-not-installed","abrtd-not-running"],"how_to_check":"- Check whether abrtd is installed and running, for example with `systemctl status abrtd`\n- Check the installed abrt version with `abrt-cli --version` or your package manager","fix":null,"status":"open","published_at":"2026-11-13T22:17:21+00:00","first_seen_at":"2026-11-13T22:33:34+00:00","triaged_at":"2026-11-13T22:34:38+00:00","updated_at":"2026-11-13T22:34:38+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-13T22:34:38Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"abrt: local users can read other processes' environment data via dumps","impact":"medium","summary":"abrt-server trusts a PID supplied by the client when creating problem dumps over abrt.socket, and as root copies that process's /proc data, including its environment, into a directory the unprivileged caller owns. A local attacker can read environment variables and metadata from other users' or root's processes while abrtd runs.","audience":"businesses","category":"other","nicknames":[],"who_cares":["linux","abrt","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user reads secrets from root process environments","analyst_note":"Find the affected and fixed abrt versions and the upstream patch from the NVD entry or the abrt project advisory.","how_to_check":"- Check whether abrtd is installed and running, for example with `systemctl status abrtd`\n- Check the installed abrt version with `abrt-cli --version` or your package manager\n- unknown for a specific vulnerable version range, as the sources do not give one","plain_action":"","product_name":"abrt","needs_analyst":true,"not_affected_if":["abrt-not-installed","abrtd-not-running"],"who_is_affected":"Systems where the abrt crash-reporting service (abrtd and abrt.socket) is installed and running, so that local users can submit dump requests. Machines without abrt are not exposed. The sources do not give the affected version range or a fixed version.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000737,"input_tokens":4543,"output_tokens":566,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-110330':14A,17A '-2026':13A,16A '/proc':48B,108C 'abrt':1A,18A,19B,26B,84C,86C 'abrt-serv':25B,85C 'abrt.socket':40B,99C 'abrtd':77B,141C 'allow':123C 'attack':62B,126C 'caller':58B 'client':34B,91C 'client-suppli':90C 'connect':119C 'copi':44B,104C 'creat':36B,95C 'cve':12A,15A 'data':9A,49B,109C 'directori':55B,115C 'dump':11A,38B,97C,114C 'environ':8A,52B,65B,111C,129C 'flaw':80C 'found':82C 'host':24B 'includ':50B,110C 'linux':20B 'local':2A,61B,125C 'metadata':68B,133C 'own':59B,116C 'pid':30B,93C 'problem':37B,96C 'process':7A,46B,75B,106C,139C 'read':5A,64B,128C 'relat':132C 'root':43B,73B,103C,138C 'run':78B,101C,143C 'self':23B 'self-host':22B 'server':27B,87C 'suppli':31B,92C 'trust':28B,88C 'unprivileg':57B,120C 'user':3A,71B,121C,136C 'variabl':66B,130C 'via':10A","nicknames":[],"mitigations":[],"who_affected":"Systems where the abrt crash-reporting service (abrtd and abrt.socket) is installed and running, so that local users can submit dump requests. Machines without abrt are not exposed. The sources do not give the affected version range or a fixed version.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["abrt"],"ptokens":["abrt"],"labels":["abrt","linux","medium","other","selfhosted","vendor"],"campaign_type":null,"search_a":"'-110330':14A,17A '-2026':13A,16A 'abrt':1A,18A 'cve':12A,15A 'data':9A 'dump':11A 'environ':8A 'local':2A 'process':7A 'read':5A 'user':3A 'via':10A","search_b":"'/proc':48B 'abrt':19B,26B 'abrt-serv':25B 'abrt.socket':40B 'abrtd':77B 'attack':62B 'caller':58B 'client':34B 'copi':44B 'creat':36B 'data':49B 'directori':55B 'dump':38B 'environ':52B,65B 'host':24B 'includ':50B 'linux':20B 'local':61B 'metadata':68B 'own':59B 'pid':30B 'problem':37B 'process':46B,75B 'read':64B 'root':43B,73B 'run':78B 'self':23B 'self-host':22B 'server':27B 'suppli':31B 'trust':28B 'unprivileg':57B 'user':71B 'variabl':66B","search_c":"'/proc':108C 'abrt':84C,86C 'abrt-serv':85C 'abrt.socket':99C 'abrtd':141C 'allow':123C 'attack':126C 'client':91C 'client-suppli':90C 'connect':119C 'copi':104C 'creat':95C 'data':109C 'directori':115C 'dump':97C,114C 'environ':111C,129C 'flaw':80C 'found':82C 'includ':110C 'local':125C 'metadata':133C 'own':116C 'pid':93C 'problem':96C 'process':106C,139C 'read':128C 'relat':132C 'root':103C,138C 'run':101C,143C 'server':87C 'suppli':92C 'trust':88C 'unprivileg':120C 'user':121C,136C 'variabl':130C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T22:17:21+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110330","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110330","severity":null,"published_at":"2026-11-13T22:17:21+00:00","modified_at":"2026-11-13T22:17:21+00:00","first_seen_at":"2026-11-13T22:33:34+00:00","fetched_at":"2026-11-13T22:33:34+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}