Flaw in Clevis PKCS#11 Pin in Clevis Tool by Red Hat
CVE-2026-109971

4.7MEDIUM

Key Information:

Vendor: Red Hat
Status: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9
Vendor: CVE Published:; 14 October 2026

What is CVE-2026-109971?

A vulnerability exists in the Clevis PKCS#11 integration where the clevis-decrypt-pkcs11 script exposes the PKCS#11 token PIN as a command-line argument passed to pkcs11-tool. This can potentially allow local users to view sensitive information through process listings or the /proc filesystem. Such exposure of authentication credentials could lead to unauthorized access or exploitation of services relying on Clevis' PKCS#11 functionality.

References

https://access.redhat.com/security/cve/CVE-2026-109971

vdb-entryx_refsource_REDHAT

https://bugzilla.redhat.com/show_bug.cgi?id=2550363

issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:

4.7

Severity:

MEDIUM

Confidentiality:

High

Integrity:

None

Availability:

High

Attack Vector:

Local

Attack Complexity:

High

Privileges Required:

Low

User Interaction:

None

Scope:

Unchanged

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Oct 14, 2026
Vulnerability Reserved
Oct 13, 2026

Credit

This issue was discovered by Sergio Correia (Red Hat).

CVE-2026-109971 Data

JSON