---
id: "CVE-2026-123177"
page: "https://infrastack.ai/live/CVE-2026-123177"
kind: "vulnerability"
aliases: ["CVE-2026-123177"]
title: "dnf5daemon-server: unauthenticated D-Bus calls can read root files and fill disk"
severity: "high"
cvss: 8.4
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "dnf5daemon-server", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["dbus", "dnf5", "dnf5daemon-server", "fedora", "gnome-software", "infrastructure", "linux", "local", "rhel"]
not_affected_if: ["dnf5daemon-server-not-installed", "rhel"]
published_at: "2026-11-13T18:17:30+00:00"
first_seen_at: "2026-11-13T18:49:28+00:00"
updated_at: "2026-11-13T18:55:09+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123177", "first_seen_at": "2026-11-13T18:49:28+00:00"}, {"source": "analyst", "url": "https://access.redhat.com/security/cve/cve-2026-123177", "first_seen_at": "2026-11-13T18:55:09+00:00", "cites": ["https://access.redhat.com/security/cve/cve-2026-123177"]}]
exploit_sources: []
---

# dnf5daemon-server: unauthenticated D-Bus calls can read root files and fill disk

Link for people: https://infrastack.ai/live/CVE-2026-123177 (this .md is for agents)

dnf5daemon-server exposes D-Bus methods (add_cmdline_packages) without authorization. They pass caller-supplied URL or .rpm paths to a root cmdline package loader. This can store fetched content in a world-readable cache with no size limit, or open local paths as root. A local attacker can read privileged content and fill the disk. Red Hat rates it CVSS 8.4 and says RHEL is not affected. No fix is listed.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:dnf5daemon-server affected range not listed fixed no fixed version listed

## How to check

- Run rpm -q dnf5daemon-server. If it is not installed, you are not exposed.
- Check whether the daemon is reachable: systemctl status dbus-org.rpm.dnf.v0.service (unit name not confirmed by Red Hat; the D-Bus name is org.rpm.dnf.v0).
- Look for unexpected content in /var/cache/dnf5daemon-server, which Red Hat says to clear if exploitation cannot be ruled out.
- Affected and fixed versions are not published yet.

## Fix

No fixed package yet per Red Hat's page ('until a fixed package is available'). Mitigation from Red Hat: remove or disable dnf5daemon-server if GNOME Software/dnf5daemon-client is not needed, or restrict system D-Bus access to org.rpm.dnf.v0 to trusted users. If exploitation can't be ruled out, rotate exposed secrets (SSH host keys, service credentials, cloud role credentials) and clear /var/cache/dnf5daemon-server. Fixed version: unknown; watch Bugzilla 2567426 and Fedora dnf5 updates.

## Timeline

- 2026-11-13T18:49:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123177
- 2026-11-13T18:55:09+00:00 analyst https://access.redhat.com/security/cve/cve-2026-123177 — Red Hat CVE page read: no versions or fix published, RHEL not affected, mitigation given. No exploitation or PoC found; no X search done. Fedora affected versions unconfirmed; no product rows added.

## Documents

- [advisory] CVE-2026-123177 - Red Hat Customer Portal https://access.redhat.com/security/cve/cve-2026-123177

## From the sources

A flaw was found in dnf5daemon-server. Unauthenticated D-Bus methods pass caller-controlled URL or .rpm path patterns into a root-privileged cmdline package loader that may store fetched content in a world-readable cache without size limits, or open local paths as root, allowing a local attacker to disclose privileged content and to deny service via disk exhaustion.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_