A flaw was found in udisks2. A local attacker with an active console session can exploit insufficient authorization checking on the 'as-user' option in the org.freedesktop.UDisks2.Filesystem.Mount() D-Bus method. This allows the attacker to spoof the 'as-user' parameter, mounting filesystems on behalf of arbitrary users, including privileged accounts. This can lead to local privilege escalation through mount point injection and manipulation of the mount namespace visible to privileged users.

ubuntu_linux USN-8701-1: Ubuntu 24.04 LTS / Ubuntu 26.04 LTS / Ubuntu Pro Realtime 24.04 LTS : UDisks vulnerability (USN-8701-1)

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-2026_53435 advisory.

    * udisks2: udisks2: Local Privilege Escalation via as-user option spoofing (CVE-2026-7867)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:64798 advisory.

    The Udisks project provides a daemon, tools, and libraries to access and manipulate disks, storage     devices, and technologies.

    Security Fix(es):

    * udisks2: udisks2: Local Privilege Escalation via as-user option spoofing (CVE-2026-7867)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21704-1 advisory.

    This update for udisks2 fixes the following issue:

    - CVE-2026-7867: insufficient authorization checks on the `as-user` option in the       `org.freedesktop.UDisks2.Filesystem.Mount()` D-Bus method can lead to local privilege escalation     (bsc#1274430).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2104 advisory.

    Local privilege escalation via as-user mount spoofing

    NOTE: https://github.com/azqzazq1/CVE-2026-7867-disk2root (CVE-2026-7867)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:53435 advisory.

    * udisks2: udisks2: Local Privilege Escalation via as-user option spoofing (CVE-2026-7867)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:53435 advisory.

    * udisks2: udisks2: Local Privilege Escalation via as-user option spoofing (CVE-2026-7867)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-53435 advisory.

    [2.11.0-2.0.1.el10_2.1]
    - Enable btrfs support for OL supported arches [Orabug: 37464632]

    [2.11.0-2.1]
    - Rework fstab mount authorization for as-user (CVE-2026-7867) (RHEL-173437)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:53435 advisory.

    The Udisks project provides a daemon, tools, and libraries to access and manipulate disks, storage     devices, and technologies.

    Security Fix(es):

    * udisks2: udisks2: Local Privilege Escalation via as-user option spoofing (CVE-2026-7867)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 13 host has packages installed that are affected by a vulnerability as referenced in the dsa-6414 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6414-1                   security@debian.org     https://www.debian.org/security/                           Alberto Garcia     August 06, 2026                       https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : udisks2     CVE ID         : CVE-2026-7867

    The following vulnerability has been discovered in the UDisks storage     daemon:

    CVE-2026-7867

        Azizcan Dastan and Ozlem Ozan discovered a local privilege         escalation vulnerability in udisks2 involving the Filesystem.Mount         D-Bus method. Using the 'as-user' option, an unprivileged local         user can in some cases influence the mount execution path so that         a filesystem mount is performed in a privileged/root context         without the expected PolicyKit authorization behavior.

    For the stable distribution (trixie), this problem has been fixed in     version 2.10.1-12.1+deb13u2.

    We recommend that you upgrade your udisks2 packages.

    For the detailed security status of udisks2 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/udisks2

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
358962	Rocky Linux 10.2 [CIQ] Security Update: libudisks2 / libudisks2-debuginfo / libudisks2-devel / udisks2 / etc (crlsa-2026_53435)	Nessus	Rocky Linux Local Security Checks	Local	high
343800	RHEL 10 : udisks2 (RHSA-2026:64798)	Nessus	Red Hat Local Security Checks	Local	high
342119	openSUSE 16: libudisks2-0 / libudisks2-0-devel / libudisks2-0_btrfs / etc (openSUSE-SU-2026:21704-1)	Nessus	SuSE Local Security Checks	Local	high
341895	Amazon Linux 2023 : libudisks2, libudisks2-devel, udisks2 (ALAS2023-2026-2104)	Nessus	Amazon Linux Local Security Checks	Local	high
335131	AlmaLinux 10 : udisks2 (ALSA-2026:53435)	Nessus	Alma Linux Local Security Checks	Local	high
334844	RockyLinux 10 : udisks2 (RLSA-2026:53435)	Nessus	Rocky Linux Local Security Checks	Local	high
334814	Oracle Linux 10 : udisks2 (ELSA-2026-53435)	Nessus	Oracle Linux Local Security Checks	Local	high
334548	RHEL 10 : udisks2 (RHSA-2026:53435)	Nessus	Red Hat Local Security Checks	Local	high
333109	Debian dsa-6414 : gir1.2-udisks-2.0 - security update	Nessus	Debian Local Security Checks	Local	high

Detections

Analytics

CVE-2026-7867

high

Tenable Plugins

Coming Soon

high

high

high

high

high

high

high

high

high