CVE-2026-111253 · Infrastructure
NO FIX YET
dnf5daemon-server does not check that the caller of a D-Bus session method is the user who created the session. A local attacker can replace another user's resolved package transaction, and if that user later authorizes it, the root daemon may install or remove attacker-chosen packages.
first public Nov 5, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Systems running dnf5daemon-server, the D-Bus service behind dnf5 package management, where a local user can reach the system bus. The sources do not state affected versions or whether default installs run the daemon. Machines with no local untrusted users and the daemon not installed can skip it.
Not affected if daemon-not-installed, no-local-untrusted-users
Who cares dbus, dnf5, fedora, linux, rhel
Unknown from the sources.
No fix yet, per the sources.
A flaw was found in dnf5daemon-server. Session methods on dynamically exported D-Bus session objects do not verify that the caller is the unique sender that created the session. A local attacker can modify another user's live package-management session and replace its resolved transaction plan. If the legitimate session party later authorizes execution, the root daemon may apply the attacker-chosen package operations.
This page as .md · .json · CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.