Local Session Management Vulnerability in dnf5daemon-server by Red Hat

CVE-2026-111253

What is CVE-2026-111253?

A vulnerability exists in dnf5daemon-server where session methods on dynamically exported D-Bus session objects fail to verify that the caller is the legitimate sender that initiated the session. This oversight allows a local attacker to interfere with another user's ongoing package management session, potentially altering the transaction plan as it is being executed. If the original session owner later approves the transaction, the attacker could manipulate the execution of package operations to their advantage, leading to unauthorized changes in the system.

References