PackageKit is a a D-Bus abstraction layer that allows the user to manage packages in a secure way using a cross-distro, cross-architecture API. PackageKit between and including versions 1.0.2 and 1.3.4 is vulnerable to a time-of-check time-of-use (TOCTOU) race condition on transaction flags that allows unprivileged users to install packages as root and thus leads to a local privilege escalation. This is patched in version 1.3.5. A local unprivileged user can install arbitrary RPM packages as root, including executing RPM scriptlets, without authentication. The vulnerability is a TOCTOU race condition on `transaction->cached_transaction_flags` combined with a silent state-machine guard that discards illegal backward transitions while leaving corrupted flags in place. Three bugs exist in `src/pk-transaction.c`: 1. Unconditional flag overwrite (line 4036): `InstallFiles()` writes caller-supplied flags to `transaction->cached_transaction_flags` without checking whether the transaction has already been authorized/started. A second call blindly overwrites the flags even while the transaction is RUNNING. 2. Silent state-transition rejection (lines 873–882): `pk_transaction_set_state()` silently discards backward state transitions (e.g. `RUNNING` → `WAITING_FOR_AUTH`) but the flag overwrite at step 1 already happened. The transaction continues running with corrupted flags. 3. Late flag read at execution time (lines 2273–2277): The scheduler's idle callback reads cached_transaction_flags at dispatch time, not at authorization time. If flags were overwritten between authorization and execution, the backend sees the attacker's flags.

amazon_alas ALAS2023-2026-1639: Amazon Linux 2023 Security Advisory:ALAS2023-2026-1639

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:17560 advisory.

    PackageKit is a D-Bus abstraction layer that allows the session user to manage packages in a secure way     using a cross-distribution, cross-architecture API.

    Security Fix(es):

    * PackageKit: race condition vulnerability leads to arbitrary package installation as root     (CVE-2026-41651)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:17558 advisory.

    PackageKit is a D-Bus abstraction layer that allows the session user to manage packages in a secure way     using a cross-distribution, cross-architecture API.

    Security Fix(es):

    * PackageKit: race condition vulnerability leads to arbitrary package installation as root     (CVE-2026-41651)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:17561 advisory.

    PackageKit is a D-Bus abstraction layer that allows the session user to manage packages in a secure way     using a cross-distribution, cross-architecture API.

    Security Fix(es):

    * PackageKit: race condition vulnerability leads to arbitrary package installation as root     (CVE-2026-41651)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of PackageKit installed on the remote host is prior to 1.1.5-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3282 advisory.

    PackageKit is a a D-Bus abstraction layer that allows the user to manage packages in a secure way using a     cross-distro, cross-architecture API. PackageKit between and including versions 1.0.2 and 1.3.4 is     vulnerable to a time-of-check time-of-use (TOCTOU) race condition on transaction flags that allows     unprivileged users to install packages as root and thus leads to a local privilege escalation. This is     patched in version 1.3.5. A local unprivileged user can install arbitrary RPM packages as root, including     executing RPM scriptlets, without authentication. The vulnerability is a TOCTOU race condition on     `transaction->cached_transaction_flags` combined with a silent state-machine guard that discards illegal     backward transitions while leaving corrupted flags in place. Three bugs exist in `src/pk-transaction.c`:
    1. Unconditional flag overwrite (line 4036): `InstallFiles()` writes caller-supplied flags to     `transaction->cached_transaction_flags` without checking whether the transaction has already been     authorized/started. A second call blindly overwrites the flags even while the transaction is RUNNING. 2.
    Silent state-transition rejection (lines 873-882): `pk_transaction_set_state()` silently discards backward     state transitions (e.g. `RUNNING` - `WAITING_FOR_AUTH`) but the flag overwrite at step 1 already happened.
    The transaction continues running with corrupted flags. 3. Late flag read at execution time (lines     2273-2277): The scheduler's idle callback reads cached_transaction_flags at dispatch time, not at     authorization time. If flags were overwritten between authorization and execution, the backend sees the     attacker's flags. (CVE-2026-41651)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:1700-1 advisory.

    This update for PackageKit fixes the following issue:

    - CVE-2026-41651: race condition allows for arbitrary RPM package installation as root and can lead to LPE       (bsc#1262220).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2026:1701-1 advisory.

    This update for PackageKit fixes the following issue:

    - CVE-2026-41651: race condition allows for arbitrary RPM package installation as root and can lead to LPE       (bsc#1262220).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES16 / SLES_SAP16 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:21427-1 advisory.

    - CVE-2026-41651: race condition allows for arbitrary RPM package installation as root and can lead to LPE       (bsc#1262220).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-529:01 advisory.

    * PackageKit: race condition vulnerability leads to arbitrary package installation as root     (CVE-2026-41651)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-537:02 advisory.

    * PackageKit: race condition vulnerability leads to arbitrary package installation as root     (CVE-2026-41651)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:20646-1 advisory.

    - CVE-2026-41651: race condition allows for arbitrary RPM package installation as root and can lead to LPE       (bsc#1262220).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:11635 advisory.

    * PackageKit: race condition vulnerability leads to arbitrary package installation as root     (CVE-2026-41651)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:11504 advisory.

    * PackageKit: race condition vulnerability leads to arbitrary package installation as root     (CVE-2026-41651)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:11504 advisory.

    * PackageKit: race condition vulnerability leads to arbitrary package installation as root     (CVE-2026-41651)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-11635 advisory.

    - Backport fix for CVE-2026-41651.

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:11635 advisory.

    PackageKit is a D-Bus abstraction layer that allows the session user to manage packages in a secure way     using a cross-distribution, cross-architecture API.

    Security Fix(es):

    * PackageKit: race condition vulnerability leads to arbitrary package installation as root     (CVE-2026-41651)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:11504 advisory.

    PackageKit is a D-Bus abstraction layer that allows the session user to manage packages in a secure way     using a cross-distribution, cross-architecture API.

    Security Fix(es):

    * PackageKit: race condition vulnerability leads to arbitrary package installation as root     (CVE-2026-41651)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-11504 advisory.

    - Backport fix for CVE-2026-41651.

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:11635 advisory.

    * PackageKit: race condition vulnerability leads to arbitrary package installation as root     (CVE-2026-41651)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - PackageKit is a a D-Bus abstraction layer that allows the user to manage packages in a secure way using a     cross-distro, cross-architecture API. PackageKit between and including versions 1.0.2 and 1.3.4 is     vulnerable to a time-of-check time-of-use (TOCTOU) race condition on transaction flags that allows     unprivileged users to install packages as root and thus leads to a local privilege escalation. This is     patched in version 1.3.5. A local unprivileged user can install arbitrary RPM packages as root, including     executing RPM scriptlets, without authentication. The vulnerability is a TOCTOU race condition on     `transaction->cached_transaction_flags` combined with a silent state-machine guard that discards illegal     backward transitions while leaving corrupted flags in place. Three bugs exist in `src/pk-transaction.c`:
    1. Unconditional flag overwrite (line 4036): `InstallFiles()` writes caller-supplied flags to     `transaction->cached_transaction_flags` without checking whether the transaction has already been     authorized/started. A second call blindly overwrites the flags even while the transaction is RUNNING. 2.
    Silent state-transition rejection (lines 873882): `pk_transaction_set_state()` silently discards backward     state transitions (e.g. `RUNNING`  `WAITING_FOR_AUTH`) but the flag overwrite at step 1 already happened.
    The transaction continues running with corrupted flags. 3. Late flag read at execution time (lines     22732277): The scheduler's idle callback reads cached_transaction_flags at dispatch time, not at     authorization time. If flags were overwritten between authorization and execution, the backend sees the     attacker's flags. (CVE-2026-41651)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
314748	RHEL 8 : PackageKit (RHSA-2026:17560)	Nessus	Red Hat Local Security Checks	high
314699	RHEL 8 : PackageKit (RHSA-2026:17558)	Nessus	Red Hat Local Security Checks	high
314692	RHEL 8 : PackageKit (RHSA-2026:17561)	Nessus	Red Hat Local Security Checks	high
314573	Amazon Linux 2 : PackageKit, --advisory ALAS2-2026-3282 (ALAS-2026-3282)	Nessus	Amazon Linux Local Security Checks	high
313668	SUSE SLES15 Security Update : PackageKit (SUSE-SU-2026:1700-1)	Nessus	SuSE Local Security Checks	high
313659	SUSE SLES12 Security Update : PackageKit (SUSE-SU-2026:1701-1)	Nessus	SuSE Local Security Checks	high
312124	SUSE SLES16 Security Update : PackageKit (SUSE-SU-2026:21427-1)	Nessus	SuSE Local Security Checks	high
311838	MiracleLinux 8 : PackageKit-1.1.12-8.el8_10 (AXSA:2026-529:01)	Nessus	Miracle Linux Local Security Checks	high
311832	MiracleLinux 9 : PackageKit-1.2.6-2.el9_7 (AXSA:2026-537:02)	Nessus	Miracle Linux Local Security Checks	high
311772	openSUSE 16 Security Update : PackageKit (openSUSE-SU-2026:20646-1)	Nessus	SuSE Local Security Checks	high
311277	RockyLinux 8 : PackageKit (RLSA-2026:11635)	Nessus	Rocky Linux Local Security Checks	high
311191	AlmaLinux 9 : PackageKit (ALSA-2026:11504)	Nessus	Alma Linux Local Security Checks	high
311179	RockyLinux 9 : PackageKit (RLSA-2026:11504)	Nessus	Rocky Linux Local Security Checks	high
311170	Oracle Linux 8 : PackageKit (ELSA-2026-11635)	Nessus	Oracle Linux Local Security Checks	high
311124	RHEL 8 : PackageKit (RHSA-2026:11635)	Nessus	Red Hat Local Security Checks	high
311123	RHEL 9 : PackageKit (RHSA-2026:11504)	Nessus	Red Hat Local Security Checks	high
311091	Oracle Linux 9 : PackageKit (ELSA-2026-11504)	Nessus	Oracle Linux Local Security Checks	high
311087	AlmaLinux 8 : PackageKit (ALSA-2026:11635)	Nessus	Alma Linux Local Security Checks	high
309713	Linux Distros Unpatched Vulnerability : CVE-2026-41651	Nessus	Misc.	high

Detections

Analytics

CVE-2026-41651

high

Tenable Plugins

Coming Soon

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high