A flaw was found in Yggdrasil, which acts as a system broker, allowing the processes to communicate to other children's "worker" processes through the DBus component. Yggdrasil creates a DBus method to dispatch messages to workers. However, it misses authentication and authorization checks, allowing every system user to call it. One available Yggdrasil worker acts as a package manager with capabilities to create and enable new repositories and install or remove packages. This flaw allows an attacker with access to the system to leverage the lack of authentication on the dispatch message to force the Yggdrasil worker to install arbitrary RPM packages. This issue results in local privilege escalation, enabling the attacker to access and modify sensitive system data.

The Rocky Linux 10.0 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2025_7592 advisory.

    * yggdrasil: Local privilege escalation in yggdrasil (CVE-2025-3931)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2025:7592 advisory.

    * yggdrasil: Local privilege escalation in yggdrasil (CVE-2025-3931)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-7592 advisory.

    [0.4.5-3]
    - Fix CVE-2025-3931

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:7592 advisory.

    yggdrasil is a system daemon that subscribes to topics on an MQTT broker and routes any data received on     the topics to an appropriate child worker process, exchanging data with its worker processes through a     D-Bus message broker.

    Security Fix(es):

    * yggdrasil: Local privilege escalation in yggdrasil (CVE-2025-3931)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
355335	Rocky Linux 10.0 [CIQ] Security Update: yggdrasil / yggdrasil-debuginfo / yggdrasil-debugsource / etc Multiple Vulnerabilities (crlsa-2025_7592)	Nessus	Rocky Linux Local Security Checks	Local	high
266684	RockyLinux 10 : yggdrasil (RLSA-2025:7592)	Nessus	Rocky Linux Local Security Checks	Local	high
240879	Oracle Linux 10 : yggdrasil (ELSA-2025-7592)	Nessus	Oracle Linux Local Security Checks	Local	high
237847	RHEL 10 : yggdrasil (RHSA-2025:7592)	Nessus	Red Hat Local Security Checks	Local	high

Detections

Analytics

CVE-2025-3931

high

Tenable Plugins

high

high

high

high