{"id":"CVE-2026-123177","kind":"vulnerability","aliases":["CVE-2026-123177"],"related":[],"title":"dnf5daemon-server: unauthenticated D-Bus calls can read root files and fill disk","description":"A flaw was found in dnf5daemon-server. Unauthenticated D-Bus methods pass caller-controlled URL or .rpm path patterns into a root-privileged cmdline package loader that may store fetched content in a world-readable cache without size limits, or open local paths as root, allowing a local attacker to disclose privileged content and to deny service via disk exhaustion.","summary":"dnf5daemon-server exposes D-Bus methods (add_cmdline_packages) without authorization. They pass caller-supplied URL or .rpm paths to a root cmdline package loader. This can store fetched content in a world-readable cache with no size limit, or open local paths as root. A local attacker can read privileged content and fill the disk. Red Hat rates it CVSS 8.4 and says RHEL is not affected. No fix is listed.","severity":"high","cvss":8.4,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"dnf5daemon-server","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["dbus","dnf5","dnf5daemon-server","fedora","gnome-software","infrastructure","linux","local","rhel"],"not_affected_if":["dnf5daemon-server-not-installed","rhel"],"how_to_check":"- Run rpm -q dnf5daemon-server. If it is not installed, you are not exposed.\n- Check whether the daemon is reachable: systemctl status dbus-org.rpm.dnf.v0.service (unit name not confirmed by Red Hat; the D-Bus name is org.rpm.dnf.v0).\n- Look for unexpected content in /var/cache/dnf5daemon-server, which Red Hat says to clear if exploitation cannot be ruled out.\n- Affected and fixed versions are not published yet.","fix":"No fixed package yet per Red Hat's page ('until a fixed package is available'). Mitigation from Red Hat: remove or disable dnf5daemon-server if GNOME Software/dnf5daemon-client is not needed, or restrict system D-Bus access to org.rpm.dnf.v0 to trusted users. If exploitation can't be ruled out, rotate exposed secrets (SSH host keys, service credentials, cloud role credentials) and clear /var/cache/dnf5daemon-server. Fixed version: unknown; watch Bugzilla 2567426 and Fedora dnf5 updates.","status":"open","published_at":"2026-11-13T18:17:30+00:00","first_seen_at":"2026-11-13T18:49:28+00:00","triaged_at":"2026-11-13T18:51:27+00:00","updated_at":"2026-11-13T18:55:09+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-13T18:51:27Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"dnf5daemon-server: unauthenticated D-Bus calls can read root files and fill disk","impact":"medium","summary":"dnf5daemon-server exposes D-Bus methods without authentication that pass caller-supplied URL or .rpm paths into a root-privileged package loader. A local attacker can use this to read privileged content through a world-readable cache and to exhaust disk space.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["dnf5","fedora","rhel","linux","dbus"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"local user reads root-only content and exhausts disk space","analyst_note":"Confirm affected dnf5daemon-server versions and the fixed release from the NVD entry or the Fedora/Red Hat advisory; sources give no version or fix.","how_to_check":"- Check whether the `dnf5daemon-server` package is installed, for example with `rpm -q dnf5daemon-server`.\n- Check whether the D-Bus service is running, for example with `systemctl status dbus-org.rpm.dnf.v0.service` (unknown if the sources name this unit).","plain_action":"","product_name":"dnf5daemon-server","needs_analyst":true,"not_affected_if":["dnf5daemon-server-not-installed"],"who_is_affected":"Systems running dnf5daemon-server with its D-Bus interface reachable by local users are the ones exposed; the flaw requires local access and the daemon runs package loading as root. Hosts without dnf5daemon-server installed are not affected by this description.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000766,"input_tokens":4553,"output_tokens":621,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm affected dnf5daemon-server versions and the fixed release from the NVD entry or the Fedora/Red Hat advisory; sources give no version or fix.","search":"'-123177':18A,21A '-2026':17A,20A '8.4':103B 'add':46B 'affect':109B 'allow':164C 'attack':89B,167C 'author':50B 'bus':7A,44B,125C 'cach':76B,154C 'call':8A 'caller':54B,129C 'caller-control':128C 'caller-suppli':53B 'cmdline':47B,63B,141C 'content':70B,93B,148C,171C 'control':130C 'cve':16A,19A 'cvss':102B 'd':6A,43B,124C 'd-bus':5A,42B,123C 'dbus':25B 'deni':174C 'disclos':169C 'disk':15A,97B,177C 'dnf5':26B 'dnf5daemon':2A,23A,28B,39B,120C 'dnf5daemon-server':1A,22A,27B,38B,119C 'exhaust':178C 'expos':41B 'fedora':30B 'fetch':69B,147C 'file':12A 'fill':14A,95B 'fix':111B 'flaw':115C 'found':117C 'gnome':32B 'gnome-softwar':31B 'hat':99B 'infrastructur':34B 'limit':80B,157C 'linux':35B 'list':113B 'loader':65B,143C 'local':36B,83B,88B,160C,166C 'may':145C 'method':45B,126C 'open':82B,159C 'packag':48B,64B,142C 'pass':52B,127C 'path':59B,84B,134C,161C 'pattern':135C 'privileg':92B,140C,170C 'rate':100B 'read':10A,91B 'readabl':75B,153C 'red':98B 'rhel':37B,106B 'root':11A,62B,86B,139C,163C 'root-privileg':138C 'rpm':58B,133C 'say':105B 'server':3A,24A,29B,40B,121C 'servic':175C 'size':79B,156C 'softwar':33B 'store':68B,146C 'suppli':55B 'unauthent':4A,122C 'url':56B,131C 'via':176C 'without':49B,155C 'world':74B,152C 'world-read':73B,151C","nicknames":[],"mitigations":[],"who_affected":"Linux hosts that have the dnf5daemon-server package installed and its D-Bus service (org.rpm.dnf.v0) reachable by local users, for example desktops using GNOME Software or dnf5daemon-client. A local user with low privileges can make the root daemon read files or download unbounded content into a world-readable cache, exposing privileged data and filling the disk. Red Hat says RHEL does not ship dnf5daemon-server, so RHEL is not affected. Hosts without the package can skip it. Red Hat does not list affected or fixed dnf5 versions, so Fedora version ranges are unconfirmed.","tier":"B","verified":{"fix":{"at":"2026-11-13T18:55:09Z","by":"analyst","doc":"https://access.redhat.com/security/cve/cve-2026-123177","run_id":3927},"who_affected":{"at":"2026-11-13T18:55:09Z","by":"analyst","doc":"https://access.redhat.com/security/cve/cve-2026-123177","run_id":3927}},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":["dnf5daemonserver"],"ptokens":["dnf5daemon","server"],"labels":["dbus","dnf5","dnf5daemonserver","fedora","gnomesoftware","high","infrastructure","linux","local","rhel","vendor"],"campaign_type":null,"search_a":"'-123177':18A,21A '-2026':17A,20A 'bus':7A 'call':8A 'cve':16A,19A 'd':6A 'd-bus':5A 'disk':15A 'dnf5daemon':2A,23A 'dnf5daemon-server':1A,22A 'file':12A 'fill':14A 'read':10A 'root':11A 'server':3A,24A 'unauthent':4A","search_b":"'8.4':103B 'add':46B 'affect':109B 'attack':89B 'author':50B 'bus':44B 'cach':76B 'caller':54B 'caller-suppli':53B 'cmdline':47B,63B 'content':70B,93B 'cvss':102B 'd':43B 'd-bus':42B 'dbus':25B 'disk':97B 'dnf5':26B 'dnf5daemon':28B,39B 'dnf5daemon-server':27B,38B 'expos':41B 'fedora':30B 'fetch':69B 'fill':95B 'fix':111B 'gnome':32B 'gnome-softwar':31B 'hat':99B 'infrastructur':34B 'limit':80B 'linux':35B 'list':113B 'loader':65B 'local':36B,83B,88B 'method':45B 'open':82B 'packag':48B,64B 'pass':52B 'path':59B,84B 'privileg':92B 'rate':100B 'read':91B 'readabl':75B 'red':98B 'rhel':37B,106B 'root':62B,86B 'rpm':58B 'say':105B 'server':29B,40B 'size':79B 'softwar':33B 'store':68B 'suppli':55B 'url':56B 'without':49B 'world':74B 'world-read':73B","search_c":"'allow':164C 'attack':167C 'bus':125C 'cach':154C 'caller':129C 'caller-control':128C 'cmdline':141C 'content':148C,171C 'control':130C 'd':124C 'd-bus':123C 'deni':174C 'disclos':169C 'disk':177C 'dnf5daemon':120C 'dnf5daemon-server':119C 'exhaust':178C 'fetch':147C 'flaw':115C 'found':117C 'limit':157C 'loader':143C 'local':160C,166C 'may':145C 'method':126C 'open':159C 'packag':142C 'pass':127C 'path':134C,161C 'pattern':135C 'privileg':140C,170C 'readabl':153C 'root':139C,163C 'root-privileg':138C 'rpm':133C 'server':121C 'servic':175C 'size':156C 'store':146C 'unauthent':122C 'url':131C 'via':176C 'without':155C 'world':152C 'world-read':151C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T18:17:30+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:H","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123177","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123177","severity":null,"published_at":"2026-11-13T18:17:30+00:00","modified_at":"2026-11-13T18:17:30+00:00","first_seen_at":"2026-11-13T18:49:28+00:00","fetched_at":"2026-11-13T18:49:28+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-123177:3927","url":"https://access.redhat.com/security/cve/cve-2026-123177","severity":null,"published_at":"2026-11-13T18:55:09+00:00","modified_at":"2026-11-13T18:55:09+00:00","first_seen_at":"2026-11-13T18:55:09+00:00","fetched_at":"2026-11-13T18:55:09+00:00","note":"Red Hat CVE page read: no versions or fix published, RHEL not affected, mitigation given. No exploitation or PoC found; no X search done. Fedora affected versions unconfirmed; no product rows added.","cites":["https://access.redhat.com/security/cve/cve-2026-123177"]}],"documents":[{"id":148678,"url":"https://access.redhat.com/security/cve/cve-2026-123177","title":"CVE-2026-123177 - Red Hat Customer Portal","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}