Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-26104— Udisks: missing authorization check allows unprivileged users to back up luks headers via udisks d-bus api

Quick assessment

Affected
Red Hat Red Hat Enterprise Linux 10
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

udisks是storaged-project开源的一款用于查询和管理存储设备的守护程序。 udisks存在安全漏洞，该漏洞源于特权D-Bus方法缺少策略检查，可能导致非特权用户备份LUKS加密头，削弱存储卷的机密性。

CVSS 5.5 · Medium EPSS 0.10% · P1

Possible ATT&CK Techniques 1 AI

T1005 · Data from Local System
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-26104

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Udisks: missing authorization check allows unprivileged users to back up luks headers via udisks d-bus api
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in the udisks storage management daemon that allows unprivileged users to back up LUKS encryption headers without authorization. The issue occurs because a privileged D-Bus method responsible for exporting encryption metadata does not perform a policy check. As a result, sensitive cryptographic metadata can be read and written to attacker-controlled locations. This weakens the confidentiality guarantees of encrypted storage volumes.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Vulnerability Title
udisks 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
udisks是storaged-project开源的一款用于查询和管理存储设备的守护程序。 udisks存在安全漏洞，该漏洞源于特权D-Bus方法缺少策略检查，可能导致非特权用户备份LUKS加密头，削弱存储卷的机密性。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Red Hat Red Hat Enterprise Linux 10 0:2.10.90-6.el10_1.1 ~ * cpe:/o:redhat:enterprise_linux:10.1
Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support 0:2.10.90-5.el10_0.2 ~ * cpe:/o:redhat:enterprise_linux_eus:10.0
Red Hat Red Hat Enterprise Linux 6 - cpe:/o:redhat:enterprise_linux:6
Red Hat Red Hat Enterprise Linux 7 - cpe:/o:redhat:enterprise_linux:7
Red Hat Red Hat Enterprise Linux 8 - cpe:/o:redhat:enterprise_linux:8
Red Hat Red Hat Enterprise Linux 9 - cpe:/o:redhat:enterprise_linux:9

II. Public POCs for CVE-2026-26104

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-26104

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-26104 (4)

Same Patch Batch · Red Hat · 2026-02-25 · 3 CVEs total

CVE-2026-26103 7.1 HIGH Udisks: missing authorization check allows unprivileged users to restore luks headers via
CVE-2026-3118 6.5 MEDIUM Rhdh: graphql injection leading to platform-wide denial of service (dos) in rh developer h

IV. Related Vulnerabilities

Same product: Red Hat Enterprise Linux 10
Same vendor: Red Hat
Same weakness: CWE-862

V. Comments for CVE-2026-26104

No comments yet

Leave a comment