A vulnerability has been found in PackageKit up to 1.3.5. Affected is the function g_file_test of the file src/pk-transaction.c of the component API. Such manipulation of the argument frontend-socket leads to improper authorization. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:3404-1 advisory.

    - CVE-2026-10294: manipulation of the argument frontend-socket can lead to improper authorization     (bsc#1267250).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2026:3405-1 advisory.

    This update for PackageKit fixes the following issue:

    - CVE-2026-10294: manipulation of the argument frontend-socket can lead to improper authorization     (bsc#1267250).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES16 / SLES_SAP16 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:22860-1 advisory.

    Security issue fixed:

    - CVE-2026-10294: manipulation of the argument frontend-socket can lead to improper authorization     (bsc#1267250).

    Non security issue fixed:

    - KDE Discover ignores package locks (bsc#1263252).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21425-1 advisory.

    Security issue fixed:

    - CVE-2026-10294: manipulation of the argument frontend-socket can lead to improper authorization     (bsc#1267250).

    Non security issue fixed:

    - KDE Discover ignores package locks (bsc#1263252).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A vulnerability has been found in PackageKit up to 1.3.5. Affected is the function g_file_test of the file     src/pk-transaction.c of the component API. Such manipulation of the argument frontend-socket leads to     improper authorization. The attack can be executed remotely. The exploit has been disclosed to the public     and may be used. (CVE-2026-10294)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
331467	SUSE SLED15: PackageKit / PackageKit-backend-zypp / PackageKit-devel / etc (SUSE-SU-2026:3404-1)	Nessus	SuSE Local Security Checks	medium
331417	SUSE SLES12: PackageKit / PackageKit-backend-zypp / PackageKit-devel / etc (SUSE-SU-2026:3405-1)	Nessus	SuSE Local Security Checks	medium
330312	SUSE SLES16: PackageKit / PackageKit-backend-zypp / PackageKit-branding-upstream / etc (SUSE-SU-2026:22860-1)	Nessus	SuSE Local Security Checks	medium
329515	openSUSE 16: PackageKit / PackageKit-backend-dnf / PackageKit-backend-zypp / etc (openSUSE-SU-2026:21425-1)	Nessus	SuSE Local Security Checks	medium
318343	Linux Distros Unpatched Vulnerability : CVE-2026-10294	Nessus	Misc.	medium

Detections

Analytics

CVE-2026-10294

medium

Tenable Plugins

medium

medium

medium

medium

medium