CVE-2026-10294
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
A vulnerability has been found in PackageKit up to 1.3.5. Affected is the function g_file_test of the file src/pk-transaction.c of the component API. Such manipulation of the argument frontend-socket leads to improper authorization. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.
Risk Assessment
An attacker can remotely bypass PackageKit authorization mechanisms, potentially installing or removing packages without proper privileges, which could lead to system compromise.
Recommendation
It is recommended to immediately update PackageKit to a version later than 1.3.5 and monitor systems for signs of exploitation.
Other vulnerabilities in PackageKit
Original NVD description (English source)
A vulnerability has been found in PackageKit up to 1.3.5. Affected is the function g_file_test of the file src/pk-transaction.c of the component API. Such manipulation of the argument frontend-socket leads to improper authorization. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.