Unix Shell Injection Vulnerability in AccountsService by Ubuntu
CVE-2026-61898

7.8HIGH

Key Information:

Vendor

Canonical

Status
Accountsservice
Vendor
CVE Published:
20 August 2026

What is CVE-2026-61898?

A vulnerability exists in the AccountsService package for Ubuntu where user-controlled LANGUAGE entries in the ~/.pam_environment file are treated as trusted. This oversight allows attackers to exploit this trust by injecting malicious sed commands through the SetLanguage D-Bus method, leading to potential execution of arbitrary shell commands with root privileges. Proper validation and sanitization are crucial to prevent such exploits.

Affected Version(s)

accountsservice Ubuntu 14.04 LTS 22.07.5-2ubuntu1 < 22.07.5-2ubuntu1.6

accountsservice Ubuntu 14.04 LTS 23.13.9-2ubuntu6 < 23.13.9-2ubuntu6.1

accountsservice Ubuntu 14.04 LTS 23.13.9-8ubuntu5 < 23.13.9-8ubuntu5.2

References

https://bugs.launchpad.net/ubuntu/+source/accountsservice...
issue-tracking
https://ubuntu.com/security/CVE-2026-61898
vendor-advisory

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Deutsche Telekom Security GmbH Red Team
.