CVE-2026-58015: GLib D-Bus Path Traversal Authentication Flaw

Technical summary

The vulnerability exists in GLib's D-Bus client-side implementation of the DBUS_COOKIE_SHA1 SASL mechanism (CWE-22: Improper Limitation of a Pathname to a Restricted Directory). The authentication protocol expects the server to send a cookie_context value that identifies a location for a shared authentication cookie. The client code fails to sanitize or validate this input before using it in file path operations, permitting directory traversal attacks. By crafting a malicious cookie_context containing sequences like '../' or absolute paths, an attacker controlling a D-Bus service endpoint can cause the client to open and read files outside the intended directory. The client then uses HMAC-SHA1 to hash the file contents and compare against a server-supplied hash, allowing the attacker to confirm whether guessed file content matches reality—effectively exfiltrating sensitive data without direct file disclosure.

Business impact

Applications and system services that connect to untrusted or compromised D-Bus servers risk exposure of sensitive configuration files, credentials, private keys, or other confidential data stored on the client system. Enterprise environments where D-Bus is used for inter-process communication across trust boundaries are particularly vulnerable. The attack surface widens in containerized or multi-tenant environments where D-Bus sockets may be accessible to less-privileged workloads or adversaries with limited network access. Data exfiltration can compromise authentication tokens, API keys, database passwords, or proprietary application secrets.

Affected systems

The flaw affects GLib across multiple distributions and products. Red Hat Enterprise Linux systems across multiple versions are impacted, along with any third-party or upstream applications that depend on the vulnerable GLib library for D-Bus client functionality. Verify specific affected versions against Red Hat's advisory and check your organization's GLib package version using 'pkg-config --modversion glib-2.0' or equivalent package management tools.

Exploitability

Exploitation requires an attacker to operate or compromise a D-Bus service that the victim's client will connect to. The attack surface is limited by D-Bus access controls and socket permissions, but in scenarios where D-Bus sockets are shared across trust boundaries—such as the system bus in multi-user or containerized environments—an unprivileged attacker may establish a malicious service. The CVSS score of 5.9 (MEDIUM) reflects high confidentiality impact but high attack complexity: the attacker must guess file paths and content, and the client must initiate a connection to a compromised service. The vulnerability is not currently tracked in CISA's Known Exploited Vulnerabilities catalog.

Remediation

Update GLib to a patched version that properly validates the cookie_context parameter before using it in file path operations. Consult Red Hat's security advisory for specific version numbers and timelines. In the interim, apply network segmentation to restrict client access to trusted D-Bus services only, disable or isolate system D-Bus sockets where feasible, and monitor for unexpected D-Bus service registrations on the system bus.

Patch guidance

Contact your system vendor (Red Hat, Debian, Ubuntu, etc.) for patched GLib packages and apply them to affected systems. Verify the patch version against the vendor advisory before deployment. Prioritize systems that run services handling sensitive data or authentication. Test patches in a staging environment before rolling out to production, particularly if custom applications depend on D-Bus functionality.

Detection guidance

Monitor system logs for unusual D-Bus service registrations, particularly from low-privilege or container processes. Inspect D-Bus traffic using tools like dbus-monitor for unexpected path traversal sequences in authentication handshakes. Track file access patterns in security audit logs for reads of sensitive directories by D-Bus clients. Implement file integrity monitoring (FIM) on system configuration and credential storage directories to detect unauthorized access attempts.

Why prioritize this

Although the CVSS score is MEDIUM, prioritize patching in multi-user or containerized environments where D-Bus is exposed to untrusted processes, and in systems handling sensitive data. Single-user desktops with strict socket permissions face lower risk. Organizations should assess D-Bus trust boundaries in their architecture before deprioritizing this update.

Risk score, explained

The CVSS 3.1 score of 5.9 (MEDIUM severity) reflects high confidentiality impact (data exfiltration) but is tempered by high attack complexity (AC:H): the attacker must operate a malicious D-Bus service and guess file paths and contents. No authentication is required (PR:N), the vulnerability is network-accessible (AV:N), and no user interaction is needed (UI:N). The scope is unchanged and there is no integrity or availability impact. Organizations in environments where D-Bus trust boundaries are weak may assess this as higher risk than the base score suggests.

Frequently asked questions