Detections
Analytics
CVE-2026-123177
high
Description
A flaw was found in dnf5daemon-server. Unauthenticated D-Bus methods pass caller-controlled URL or .rpm path patterns into a root-privileged cmdline package loader that may store fetched content in a world-readable cache without size limits, or open local paths as root, allowing a local attacker to disclose privileged content and to deny service via disk exhaustion.
References
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-125623