CVE-2026-111253

MediumCVSS 6.6/10Last modified Nov 5, 2026

Description

A flaw was found in dnf5daemon-server. Session methods on dynamically exported D-Bus session objects do not verify that the caller is the unique sender that created the session. A local attacker can modify another user's live package-management session and replace its resolved transaction plan. If the legitimate session party later authorizes execution, the root daemon may apply the attacker-chosen package operations.

Metrics

CVSS 3.1 6.6/10CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-862

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Red Hat	Red Hat Hardened Images	—

References

Timeline

Published: Nov 5, 2026
Last modified: Nov 5, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-1112547.2The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and CVE-2026-1112557.5The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to Arbitrary File Upload in all CVE-2026-111256When JAX-WS or JAX-RS endpoints are published by the embedded OpenEJB HTTP server rather than Tomcat, some configured authentication methods CVE-2026-111257With the default configuration and no users defined in the default user database, TomEE silently adds an administrative user with a well-kno CVE-2026-111258The optional request routing feature forwards requests to their configured destination without applying the security constraints of that des CVE-2026-111259The embedded server generates HTTP session identifiers with a non-cryptographic random number generator by default. A remote attacker who ob CVE-2026-111264.3Inappropriate implementation in DevTools in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malic CVE-2026-111260The Jakarta Security OpenID Connect authentication mechanism generates the state and nonce values with a non-cryptographic random number gen CVE-2026-111261The Jakarta Security LDAP identity store accepts an empty password as valid if the directory server allows unauthenticated binds, which some CVE-2026-111262The Jakarta Security LDAP identity store does not neutralize special characters in the caller name before using it in directory queries. A r CVE-2026-111263Authentication configured for an EJB JAX-WS endpoint in the TomEE deployment descriptor is not enforced when the endpoint is published withi CVE-2026-111264The security constraint generated for EJB JAX-WS endpoints with configured authentication protects only some HTTP methods. A remote unauthen