D-Bus Method Vulnerability in dnf5daemon-server by Red Hat

CVE-2026-123177

What is CVE-2026-123177?

A security flaw exists in the dnf5daemon-server where unauthenticated D-Bus methods can be exploited. Attackers can manipulate caller-controlled URLs or RPM path patterns, potentially leading to exposure of sensitive information through a root-privileged command-line package loader. This flaw may allow the fetched content to be stored in a world-readable cache without size restrictions or permit access to local paths with root privileges. As a result, attackers could disclose privileged content and even execute a denial-of-service attack through disk exhaustion.

References