CVE-2026-58015: Glib: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receive
A flaw was found in GLib. The D-Bus client-side implementation of the DBUSCOOKIESHA1 SASL authentication mechanism does not validate the cookiecontext parameter received from the server. A malicious D-Bus server can supply a cookiecontext containing path traversal sequences, causing the client to read an arbitrary file and exfiltrate sensitive data by verifying guessed file contents against a generated hash.
Other sources
Glib: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyringlookupentry and mechanismclientdatareceive
— Microsoft
The GLib D-Bus client-side implementation of the DBUSCOOKIESHA1 SASL authentication mechanism does not validate the cookiecontext parameter received from the server. The D-Bus specification explicitly states that cookie context names must not contain the characters /, \, . (period), spaces, or ASCII control characters. However, GLib's client-side code accepts this value verbatim and uses it to construct a filesystem path via gbuildfilename(). A malicious D-Bus server can supply a cookiecontext containing path traversal sequences such as ../.targetfile, causing the client to read an arbitrary file outside the ~/.dbus-keyrings/ directory. The file contents (specifically the third space-separated token of the first matching line) are then incorporated into a SHA1 hash computation and sent back to the server as part of the authentication response. The server can verify guessed file contents against this SHA1 hash, enabling data exfiltration.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.78.6-10
Event History
Frequently Asked Questions
What is the severity of CVE-2026-58015?
The severity of CVE-2026-58015 is classified as high with a score of 7.5.
What impact does CVE-2026-58015 have?
CVE-2026-58015 can allow a malicious D-Bus server to exploit the client through path traversal sequences.
How do I fix CVE-2026-58015?
To mitigate CVE-2026-58015, ensure that you update GLib to the latest version that addresses this vulnerability.
Which systems are affected by CVE-2026-58015?
CVE-2026-58015 affects GLib and is particularly relevant for users of Red Hat Enterprise Linux and GNOME.
How does CVE-2026-58015 affect D-Bus authentication?
CVE-2026-58015 affects the D-Bus client-side implementation of the DBUS_COOKIE_SHA1 SASL authentication mechanism by not properly validating the cookie_context parameter.