CVE-2026-109970

Published: Oct 14, 2026Modified: Oct 15, 2026

4.7

Vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 1.0 / Impact: 3.6

Source: secalert@redhat.com (Secondary)

Description

A flaw was found in the clevis PKCS#11 pin. The clevis-luks-pkcs11-askpin script writes the PKCS#11 token PIN in plaintext to a file without setting restrictive permissions. Under the default process umask, the file is world-readable. Additionally, the PIN file is not reliably cleaned up if the decryption script exits early, leaving the PIN accessible indefinitely.

Related CWEs

CWE-538

Insertion of Sensitive Information into Externally-Accessible File or Directory

The product places sensitive information into files or directories that are accessible to actors who are allowed to have access to the files, but not to the sensitive information.

References (2)

https://access.redhat.com/security/cve/CVE-2026-109970

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=2550362

Source: secalert@redhat.com

Timeline

No history available yet.