{"id":"CVE-2026-59597","kind":"vulnerability","aliases":["CVE-2026-59597"],"related":[],"title":"Android-style DataServiceManager keeps tunnel permissions after config updates, enabling local escalation","description":"In bindDataService of DataServiceManager.java, there is a possible way to retain privileged tunnel management permissions across configuration updates due to a logic error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","summary":"In bindDataService of DataServiceManager.java, a logic error lets an app retain privileged tunnel management permissions across configuration updates. An attacker with local code execution can escalate privileges without user interaction.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","local-privilege-escalation","other"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T20:19:30+00:00","first_seen_at":"2026-11-10T20:46:13+00:00","triaged_at":"2026-11-10T20:49:54+00:00","updated_at":"2026-11-10T20:49:54+00:00","category":"other","confidence":0.4,"triage":{"at":"2026-11-10T20:49:54Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Android-style DataServiceManager keeps tunnel permissions after config updates, enabling local escalation","impact":"high","summary":"In bindDataService of DataServiceManager.java, a logic error lets an app retain privileged tunnel management permissions across configuration updates. An attacker with local code execution can escalate privileges without user interaction.","audience":"businesses","category":"other","nicknames":[],"who_cares":["android","local-privilege-escalation"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"local attacker gains privileged tunnel management rights","analyst_note":"Identify the affected product and versions from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-59597 and find the fixed build.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"The sources do not name the affected product or versions. The flaw is local, so systems where untrusted code can run on the device are the ones to look at. unknown","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000663,"input_tokens":4532,"output_tokens":419,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-59597':16A,19A 'across':40B,70C 'addit':88C 'android':2A,20B 'android-styl':1A 'app':34B 'attack':44B 'binddataservic':26B,56C 'code':47B 'config':9A 'configur':41B,71C 'could':79C 'cve':14A,17A 'dataservicemanag':4A 'dataservicemanager.java':28B,58C 'due':73C 'enabl':11A 'error':31B,77C 'escal':13A,24B,50B,83C 'execut':48B,89C 'exploit':98C 'interact':54B,93C 'keep':5A 'lead':80C 'let':32B 'local':12A,22B,46B,82C 'local-privilege-escal':21B 'logic':30B,76C 'manag':38B,68C 'need':91C,96C 'permiss':7A,39B,69C 'possibl':62C 'privileg':23B,36B,51B,66C,85C,90C 'retain':35B,65C 'style':3A 'tunnel':6A,37B,67C 'updat':10A,42B,72C 'user':53B,92C 'way':63C 'without':52B","nicknames":[],"mitigations":[],"who_affected":"The sources do not name the affected product or versions. The flaw is local, so systems where untrusted code can run on the device are the ones to look at. unknown","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["android","localprivilegeescalation","other","unknown"],"campaign_type":null,"search_a":"'-2026':15A,18A '-59597':16A,19A 'android':2A 'android-styl':1A 'config':9A 'cve':14A,17A 'dataservicemanag':4A 'enabl':11A 'escal':13A 'keep':5A 'local':12A 'permiss':7A 'style':3A 'tunnel':6A 'updat':10A","search_b":"'across':40B 'android':20B 'app':34B 'attack':44B 'binddataservic':26B 'code':47B 'configur':41B 'dataservicemanager.java':28B 'error':31B 'escal':24B,50B 'execut':48B 'interact':54B 'let':32B 'local':22B,46B 'local-privilege-escal':21B 'logic':30B 'manag':38B 'permiss':39B 'privileg':23B,36B,51B 'retain':35B 'tunnel':37B 'updat':42B 'user':53B 'without':52B","search_c":"'across':70C 'addit':88C 'binddataservic':56C 'configur':71C 'could':79C 'dataservicemanager.java':58C 'due':73C 'error':77C 'escal':83C 'execut':89C 'exploit':98C 'interact':93C 'lead':80C 'local':82C 'logic':76C 'manag':68C 'need':91C,96C 'permiss':69C 'possibl':62C 'privileg':66C,85C,90C 'retain':65C 'tunnel':67C 'updat':72C 'user':92C 'way':63C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T20:19:30+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-59597","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59597","severity":null,"published_at":"2026-11-10T20:19:30+00:00","modified_at":"2026-11-10T20:19:30+00:00","first_seen_at":"2026-11-10T20:46:13+00:00","fetched_at":"2026-11-10T20:46:13+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}