Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-12080— Qemu-kvm: qemu-guest-agent: local privilege escalation via symlink attack in guest-ssh-add-authorized-keys

Quick assessment

Affected
Red Hat Red Hat Enterprise Linux 10
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

qemu是QEMU组织开源的一款虚拟化模拟器。 QEMU存在后置链接漏洞，该漏洞源于guest-ssh-add-authorized-keys命令处理程序中的符号链接操纵问题，可能通过确定性的目录符号链接绕过或TOCTOU文件符号链接竞争条件被利用，导致本地非特权用户获取任意root拥有文件或目录的所有权，从而获得root访问权限。

CVSS 7.3 · High EPSS 0.14% · P4

Affected Version Matrix 8

VendorProduct Version RangeStatus
Red Hat Red Hat Enterprise Linux 10 any affected
Red Hat Red Hat Enterprise Linux 6 any unaffected
Red Hat Red Hat Enterprise Linux 7 any unaffected
any unaffected
Red Hat Red Hat Enterprise Linux 8 any affected
Red Hat Red Hat Enterprise Linux 9 any affected
Red Hat Red Hat Enterprise Linux for NVIDIA 26 any unknown
Red Hat Red Hat OpenShift Container Platform 4 any affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-12080

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Qemu-kvm: qemu-guest-agent: local privilege escalation via symlink attack in guest-ssh-add-authorized-keys
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in the QEMU Guest Agent (qga). A local unprivileged user can exploit a vulnerability in the guest-ssh-add-authorized-keys command handler by manipulating symbolic links. This can occur either through a deterministic directory-symlink bypass or a Time-of-Check to Time-of-Use (TOCTOU) file-symlink race. Successful exploitation allows the attacker to gain ownership of arbitrary root-owned files or directories, leading to root access. This vulnerability requires an external management layer (e.g., libvirt) to trigger the affected code path.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
CWE-61
Source: CVE Program / CVE List V5
Vulnerability Title
QEMU 后置链接漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
qemu是QEMU组织开源的一款虚拟化模拟器。 QEMU存在后置链接漏洞，该漏洞源于guest-ssh-add-authorized-keys命令处理程序中的符号链接操纵问题，可能通过确定性的目录符号链接绕过或TOCTOU文件符号链接竞争条件被利用，导致本地非特权用户获取任意root拥有文件或目录的所有权，从而获得root访问权限。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Red Hat Red Hat Enterprise Linux 10 - cpe:/o:redhat:enterprise_linux:10
Red Hat Red Hat Enterprise Linux 6 - cpe:/o:redhat:enterprise_linux:6
Red Hat Red Hat Enterprise Linux 7 - cpe:/o:redhat:enterprise_linux:7
Red Hat Red Hat Enterprise Linux 7 - cpe:/o:redhat:enterprise_linux:7
Red Hat Red Hat Enterprise Linux 8 - cpe:/o:redhat:enterprise_linux:8
Red Hat Red Hat Enterprise Linux 9 - cpe:/o:redhat:enterprise_linux:9
Red Hat Red Hat Enterprise Linux for NVIDIA 26 - cpe:/a:redhat:enterprise_linux_nvidia:
Red Hat Red Hat OpenShift Container Platform 4 - cpe:/a:redhat:openshift:4

II. Public POCs for CVE-2026-12080

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-12080

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-12080 (1)

Vendor Advisories for CVE-2026-12080 (2)

Same Patch Batch · Red Hat · 2026-07-20 · 8 CVEs total

CVE-2026-16242 9.4 CRITICAL Hypershift: konnectivity proxy-server accepts agent connections without validating client
CVE-2026-12701 9.0 CRITICAL Pulpcore: pulpcore: relative_path_validator bypass via directory traversal in filesystemex
CVE-2026-64612 7.5 HIGH Libcupsfilters: cups-filters: libcupsfilters: cups image filter process abort via malforme
CVE-2026-15813 6.5 MEDIUM Kronosnet: kronosnet: memory corruption and out-of-bounds access via malformed network pac
CVE-2026-16277 6.5 MEDIUM Rpcbind: rpcbind: stack buffer overflow in rpcinfo rpcbaddrlist()
CVE-2026-15588 5.3 MEDIUM Gdbusserver: glib2: gdbusserver pre-authentication dos via unbounded sasl line buffering
CVE-2026-16254 4.3 MEDIUM Claircore: claircore: denial of service via out-of-bounds slice in claircore's apk install

IV. Related Vulnerabilities

Same product: Red Hat Enterprise Linux 10
Same vendor: Red Hat
Same weakness: CWE-61

V. Comments for CVE-2026-12080

No comments yet

Leave a comment