CVE-2026-123177

Description

A flaw was found in dnf5daemon-server. Unauthenticated D-Bus methods pass caller-controlled URL or .rpm path patterns into a root-privileged cmdline package loader that may store fetched content in a world-readable cache without size limits, or open local paths as root, allowing a local attacker to disclose privileged content and to deny service via disk exhaustion.

Severity scores

Each score is shown as its source gave it. They are not averaged or merged.

• 8.4CVSS 3.1, Highfrom the CNA (redhat)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:H

What to do

• Until a fixed package is available, remove or disable dnf5daemon-server if GNOME Software / dnf5daemon-client is not required, or restrict system D-Bus access to org.rpm.dnf.v0 to trusted users. If non-root access to instance metadata is already blocked on a cloud host, also ensure the daemon cannot be used as a bypass, or disable the daemon. If exploitation cannot be ruled out, rotate exposed secrets (SSH host keys, service credentials, cloud role credentials where applicable) in addition to clearing /var/cache/dnf5daemon-server.CNA workaround statement

Historical context and remediation

This reference retains the original CVE publication date. A recent record update does not mean a new attack occurred.

No separately sourced impact summary is available on this page yet. Consult the description, version data and dated exploitation evidence.

Version statuses below come from the CNA. An “unaffected” version is not necessarily a currently supported release or proof of a patch date. EPSS is a dated risk estimate, not a count of historical attacks.

Read the original CVE record.

Affected products

Timeline

1. 29 Oct 2026 Reported to Red Hat.
2. 13 Nov 2026 Made public.
3. 13 Nov 2026 Published

Weakness

• CWE-862

References

• access.redhat.comvdb-entryx_refsource_REDHAT
• RHBZ#2567426issue-trackingx_refsource_REDHAT