authd prior to version 0.6.4 contains a logic error in primary group ID assignment that can lead to local privilege escalation. When a user's primary group ID (GID) differs from their UID, either because the account was created with authd prior to version 0.5.4 or because the primary group was manually changed via the `authctl group set-gid` command, and the user's identity provider record is updated, authd incorrectly resets the user's primary group ID to their UID upon next login. This causes newly created files and directories to be owned by the wrong group, causing denial of service issues, and potentially granting unintended access to other local users and allowing local privilege escalation.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - authd prior to version 0.6.4 contains a logic error in primary group ID assignment that can lead to local
    privilege escalation. When a user's primary group ID (GID) differs from their UID, either because the
    account was created with authd prior to version 0.5.4 or because the primary group was manually changed
    via the `authctl group set-gid` command, and the user's identity provider record is updated, authd
    incorrectly resets the user's primary group ID to their UID upon next login. This causes newly created
    files and directories to be owned by the wrong group, causing denial of service issues, and potentially
    granting unintended access to other local users and allowing local privilege escalation. (CVE-2026-6970)

The remote Ubuntu 26.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-8212-1 advisory.

    It was discovered that authd incorrectly assigned the primary group ID to users under certain conditions.
    A local attacker could possibly use this issue to achieve privilege escalation, or gain unauthorized     access to files belonging to other users.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
441195	SCA: security update for github.com/canonical/authd (GHSA-fg3j-5w9g-hmg7)	Tenable Cloud Security	SCA Checks	high
441195	SCA: security update for github.com/canonical/authd (GHSA-fg3j-5w9g-hmg7)	Tenable Self-Hosted Container Security	SCA Checks	high
311795	Ubuntu 26.04 LTS : authd vulnerability (USN-8212-1)	Nessus	Ubuntu Local Security Checks	high

Detections

Analytics

CVE-2026-6970

high

Tenable Plugins

high

high

high