CVE-2026-10294
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
A vulnerability has been found in PackageKit up to 1.3.5. Affected is the function g_file_test of the file src/pk-transaction.c of the component API. Such manipulation of the argument frontend-socket leads to improper authorization. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.
Risk Assessment
An attacker can remotely bypass PackageKit authorization mechanisms, potentially installing or removing packages without proper privileges, which could lead to system compromise.
Recommendation
It is recommended to immediately update PackageKit to a version later than 1.3.5 and monitor systems for signs of exploitation.
Other vulnerabilities in PackageKit
See all- CVE-2026-19816High
PackageKit skips the polkit authorization check for transactions carrying the SIMULATE (dry-run) flag. In the dnf5 backend, the RepoRemove handler ignores that contract and always executes the real transaction because its guard (role == REPO_REMOVE || !SIMULATE) is always true for RepoRemove. An unprivileged local user can therefore perform a genuine package uninstall while claiming to simulate.
- CVE-2026-41651High
PackageKit versions 1.0.2 through 1.3.4 contain a TOCTOU race condition on transaction flags, allowing unprivileged users to install packages as root. The vulnerability stems from three code issues: unconditional flag overwrite, silent state-transition rejection, and late flag reading at execution time.
Original NVD description (English source)
A vulnerability has been found in PackageKit up to 1.3.5. Affected is the function g_file_test of the file src/pk-transaction.c of the component API. Such manipulation of the argument frontend-socket leads to improper authorization. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS