A flaw was found in udisks2. A local attacker with an active console session can exploit insufficient authorization checking on the 'as-user' option in the org.freedesktop.UDisks2.Filesystem.Mount() D-Bus method. This allows the attacker to spoof the 'as-user' parameter, mounting filesystems on behalf of arbitrary users, including privileged accounts. This can lead to local privilege escalation through mount point injection and manipulation of the mount namespace visible to privileged users.

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:53435 advisory.

    * udisks2: udisks2: Local Privilege Escalation via as-user option spoofing (CVE-2026-7867)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:53435 advisory.

    * udisks2: udisks2: Local Privilege Escalation via as-user option spoofing (CVE-2026-7867)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-53435 advisory.

    [2.11.0-2.0.1.el10_2.1]
    - Enable btrfs support for OL supported arches [Orabug: 37464632]

    [2.11.0-2.1]
    - Rework fstab mount authorization for as-user (CVE-2026-7867) (RHEL-173437)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:53435 advisory.

    The Udisks project provides a daemon, tools, and libraries to access and manipulate disks, storage     devices, and technologies.

    Security Fix(es):

    * udisks2: udisks2: Local Privilege Escalation via as-user option spoofing (CVE-2026-7867)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in udisks2. A local attacker with an active console session can exploit insufficient     authorization checking on the 'as-user' option in the org.freedesktop.UDisks2.Filesystem.Mount() D-Bus     method. This allows the attacker to spoof the 'as-user' parameter, mounting filesystems on behalf of     arbitrary users, including privileged accounts. This can lead to local privilege escalation through mount     point injection and manipulation of the mount namespace visible to privileged users. (CVE-2026-7867)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Debian 13 host has packages installed that are affected by a vulnerability as referenced in the dsa-6414 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6414-1                   security@debian.org     https://www.debian.org/security/                           Alberto Garcia     August 06, 2026                       https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : udisks2     CVE ID         : CVE-2026-7867

    The following vulnerability has been discovered in the UDisks storage     daemon:

    CVE-2026-7867

        Azizcan Dastan and Ozlem Ozan discovered a local privilege         escalation vulnerability in udisks2 involving the Filesystem.Mount         D-Bus method. Using the 'as-user' option, an unprivileged local         user can in some cases influence the mount execution path so that         a filesystem mount is performed in a privileged/root context         without the expected PolicyKit authorization behavior.

    For the stable distribution (trixie), this problem has been fixed in     version 2.10.1-12.1+deb13u2.

    We recommend that you upgrade your udisks2 packages.

    For the detailed security status of udisks2 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/udisks2

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
335131	AlmaLinux 10 : udisks2 (ALSA-2026:53435)	Nessus	Alma Linux Local Security Checks	Local	high
334844	RockyLinux 10 : udisks2 (RLSA-2026:53435)	Nessus	Rocky Linux Local Security Checks	Local	high
334814	Oracle Linux 10 : udisks2 (ELSA-2026-53435)	Nessus	Oracle Linux Local Security Checks	Local	high
334548	RHEL 10 : udisks2 (RHSA-2026:53435)	Nessus	Red Hat Local Security Checks	Local	high
333158	Linux Distros Unpatched Vulnerability : CVE-2026-7867	Nessus	Misc.	Local	high
333109	Debian dsa-6414 : gir1.2-udisks-2.0 - security update	Nessus	Debian Local Security Checks	Local	high

Detections

Analytics

CVE-2026-7867

high

Tenable Plugins

high

high

high

high

high

high