openCryptoki is a PKCS#11 library and provides tooling for Linux and AIX. Versions 2.3.2 and above are vulnerable to symlink-following when running in privileged contexts. A token-group user can redirect file operations to arbitrary filesystem targets by planting symlinks in group-writable token directories, resulting in privilege escalation or data exposure. Token and lock directories are 0770 (group-writable for token users), so any token-group member can plant files and symlinks inside them. When run as root, the base code handling token directory file access, as well as several openCryptoki tools used for administrative purposes, may reset ownership or permissions on existing files inside the token directories. An attacker with token-group membership can exploit the system when an administrator runs a PKCS#11 application or administrative tool that performs chown on files inside the token directory during normal maintenance. This issue is fixed in commit 5e6e4b4, but has not been included in a released version at the time of publication.

The remote AlmaLinux 10 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2026:4717 advisory.

    * openCryptoki: openCryptoki: Privilege Escalation or Data Exposure via Symlink Following (CVE-2026-23893)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-4717 advisory.

    [3.25.0-5.2]
    - Resolves: RHEL-144815, Privilege Escalation or Data Exposure via Symlink Following

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:4717 advisory.

    The opencryptoki packages contain version 2.11 of the PKCS#11 API, implemented for IBM Cryptocards, such     as IBM 4764 and 4765 crypto cards. These packages includes support for the IBM 4758 Cryptographic     CoProcessor (with the PKCS#11 firmware loaded), the IBM eServer Cryptographic Accelerator (FC 4960 on IBM     eServer System p), the IBM Crypto Express2 (FC 0863 or FC 0870 on IBM System z), and the IBM CP Assist for     Cryptographic Function (FC 3863 on IBM System z). The opencryptoki packages also bring a software token     implementation that can be used without any cryptographic hardware. These packages contain the Slot Daemon     (pkcsslotd) and general utilities.

    Security Fix(es):

    * openCryptoki: openCryptoki: Privilege Escalation or Data Exposure via Symlink Following (CVE-2026-23893)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2026:0581-1 advisory.

    - CVE-2026-23893: Privilege Escalation or Data Exposure via Symlink Following (bsc#1257116).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES16 / SLES_SAP16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:20434-1 advisory.

    Upgrade openCryptoki to 3.26 (jsc#PED-14609)

    Security fixes:

     - CVE-2026-22791: supplying malformed compressed EC public key can lead to heap corruption or denial-of-     service (bsc#1256673).
     - CVE-2026-23893: Privilege Escalation or Data Exposure via Symlink Following (bsc#1257116).

    Other fixes:

      * Soft: Add support for RSA keys up to 16K bits.
      * CCA: Add support for RSA keys up to 8K bits (requires CCA v8.4 or v7.6 or later).
      * p11sak: Add support for generating RSA keys up to 16K bits.
      * Soft/ICA: Add support for SHA512/224 and SHA512/256 key derivation mechanism     (CKM_SHA512_224_KEY_DERIVATION and CKM_SHA512_256_KEY_DERIVATION).
      * Soft/ICA/CCA/EP11: Add support for SHA-HMAC key types CKK_SHAxxx_HMAC and key gen mechanisms     CKM_SHAxxx_KEY_GEN.
      * p11sak: Add support for SHA-HMAC key types and key generation.
      * p11sak: Add support for key wrap and unwrap commands to export and import private and secret keys by     means of key wrapping/unwrapping         with various key wrapping mechanism.
      * p11kmip: Add support for using an HSM-protected TLS client key via a PKCS#11 provider.
      * p11sak: Add support for exporting non-sensitive private keys to password protected PEM files.
      * Add support for canceling an operation via NULL mechanism pointer at C_XxxInit() call as an     alternative to C_SessionCancel() (PKCS#11 v3.0).
      * EP11: Add support for pairing friendly BLS12-381 EC curve for sign/verify using CKM_IBM_ECDSA_OTHER     and signature/public key aggregation using CKM_IBM_EC_AGGREGATE.
      * p11sak: Add support for generating BLS12-381 EC keys.
      * EP11: Add support for IBM-specific ML-DSA and ML-KEM key types and mechanisms (requires an EP11 host     library v4.2 or later, and         a CEX8P crypto card with firmware v9.6 or later on IBM z17, and v8.39 or later on IBM z16).
      * CCA: Add support for IBM-specific ML-DSA and ML-KEM key types and mechanisms (requires CCA v8.4 or     later).
      * Soft: Add support for IBM-specific ML-DSA and ML-KEM key types and mechanisms (requires OpenSSL 3.5 or     later, or the OQS-provider must be configured).
      * p11sak: Add support for IBM-specific ML-DSA and ML-KEM key types.
      * Bug fixes.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the opencryptoki-3.26.0-2.el9 build changelog.

  - openCryptoki is a PKCS#11 library and provides tooling for Linux and AIX. Versions 2.3.2 and above are     vulnerable to symlink-following when running in privileged contexts. A token-group user can redirect file     operations to arbitrary filesystem targets by planting symlinks in group-writable token directories,     resulting in privilege escalation or data exposure. Token and lock directories are 0770 (group-writable     for token users), so any token-group member can plant files and symlinks inside them. When run as root,     the base code handling token directory file access, as well as several openCryptoki tools used for     administrative purposes, may reset ownership or permissions on existing files inside the token     directories. An attacker with token-group membership can exploit the system when an administrator runs a     PKCS#11 application or administrative tool that performs chown on files inside the token directory during     normal maintenance. This issue is fixed in commit 5e6e4b4, but has not been included in a released version     at the time of publication. (CVE-2026-23893)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20233-1 advisory.

    Upgrade openCryptoki to 3.26 (jsc#PED-14609)

    Security fixes:

     - CVE-2026-22791: supplying malformed compressed EC public key can lead to heap corruption or denial-of-     service (bsc#1256673).
     - CVE-2026-23893: Privilege Escalation or Data Exposure via Symlink Following (bsc#1257116).

    Other fixes:

      * Soft: Add support for RSA keys up to 16K bits.
      * CCA: Add support for RSA keys up to 8K bits (requires CCA v8.4 or v7.6 or later).
      * p11sak: Add support for generating RSA keys up to 16K bits.
      * Soft/ICA: Add support for SHA512/224 and SHA512/256 key derivation mechanism     (CKM_SHA512_224_KEY_DERIVATION and CKM_SHA512_256_KEY_DERIVATION).
      * Soft/ICA/CCA/EP11: Add support for SHA-HMAC key types CKK_SHAxxx_HMAC and key gen mechanisms     CKM_SHAxxx_KEY_GEN.
      * p11sak: Add support for SHA-HMAC key types and key generation.
      * p11sak: Add support for key wrap and unwrap commands to export and import private and secret keys by     means of key wrapping/unwrapping         with various key wrapping mechanism.
      * p11kmip: Add support for using an HSM-protected TLS client key via a PKCS#11 provider.
      * p11sak: Add support for exporting non-sensitive private keys to password protected PEM files.
      * Add support for canceling an operation via NULL mechanism pointer at C_XxxInit() call as an     alternative to C_SessionCancel() (PKCS#11 v3.0).
      * EP11: Add support for pairing friendly BLS12-381 EC curve for sign/verify using CKM_IBM_ECDSA_OTHER     and signature/public key aggregation using CKM_IBM_EC_AGGREGATE.
      * p11sak: Add support for generating BLS12-381 EC keys.
      * EP11: Add support for IBM-specific ML-DSA and ML-KEM key types and mechanisms (requires an EP11 host     library v4.2 or later, and         a CEX8P crypto card with firmware v9.6 or later on IBM z17, and v8.39 or later on IBM z16).
      * CCA: Add support for IBM-specific ML-DSA and ML-KEM key types and mechanisms (requires CCA v8.4 or     later).
      * Soft: Add support for IBM-specific ML-DSA and ML-KEM key types and mechanisms (requires OpenSSL 3.5 or     later, or the OQS-provider must be configured).
      * p11sak: Add support for IBM-specific ML-DSA and ML-KEM key types.
      * Bug fixes.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:0481-1 advisory.

    - CVE-2026-23893: Privilege Escalation or Data Exposure via Symlink Following (bsc#1257116).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - openCryptoki is a PKCS#11 library and provides tooling for Linux and AIX. Versions 2.3.2 and above are     vulnerable to symlink-following when running in privileged contexts. A token-group user can redirect file     operations to arbitrary filesystem targets by planting symlinks in group-writable token directories,     resulting in privilege escalation or data exposure. Token and lock directories are 0770 (group-writable     for token users), so any token-group member can plant files and symlinks inside them. When run as root,     the base code handling token directory file access, as well as several openCryptoki tools used for     administrative purposes, may reset ownership or permissions on existing files inside the token     directories. An attacker with token-group membership can exploit the system when an administrator runs a     PKCS#11 application or administrative tool that performs chown on files inside the token directory during     normal maintenance. This issue is fixed in commit 5e6e4b4, but has not been included in a released version     at the time of publication. (CVE-2026-23893)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2026:0351-1 advisory.

    - CVE-2026-23893: Fixed privilege escalation or data exposure       via symlink following (bsc#1257116)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
303210	AlmaLinux 10 : opencryptoki (ALSA-2026:4717)	Nessus	Alma Linux Local Security Checks	medium
302805	Oracle Linux 10 : opencryptoki (ELSA-2026-4717)	Nessus	Oracle Linux Local Security Checks	medium
302774	RHEL 10 : opencryptoki (RHSA-2026:4717)	Nessus	Red Hat Local Security Checks	medium
299714	SUSE SLES12 Security Update : openCryptoki (SUSE-SU-2026:0581-1)	Nessus	SuSE Local Security Checks	medium
299573	SUSE SLES16 Security Update : openCryptoki (SUSE-SU-2026:20434-1)	Nessus	SuSE Local Security Checks	medium
299200	CentOS 9 : opencryptoki-3.26.0-2.el9	Nessus	CentOS Local Security Checks	medium
299146	openSUSE 16 Security Update : openCryptoki (openSUSE-SU-2026:20233-1)	Nessus	SuSE Local Security Checks	medium
299049	SUSE SLES15 Security Update : openCryptoki (SUSE-SU-2026:0481-1)	Nessus	SuSE Local Security Checks	medium
297680	Linux Distros Unpatched Vulnerability : CVE-2026-23893	Nessus	Misc.	medium
297428	openSUSE 15 Security Update : openCryptoki (SUSE-SU-2026:0351-1)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2026-23893

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium