CVE-2026-104619

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-104619", "assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "state": "PUBLISHED", "assignerShortName": "suse", "dateReserved": "2026-10-02T04:18:56.078Z", "datePublished": "2026-11-10T09:27:53.111Z", "dateUpdated": "2026-11-12T17:44:23.451Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "shortName": "suse", "dateUpdated": "2026-11-10T09:27:53.111Z"}, "title": "PackageKit ZYpp rollback vulnerability", "datePublic": "2026-11-10T09:03:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-1328", "description": "CWE-1328 Security version number mutable to older versions", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-233", "descriptions": [{"lang": "en", "value": "CAPEC-233 Privilege Escalation"}]}], "affected": [{"vendor": "PackageKit", "product": "PackageKit", "packageName": "PackageKit", "repo": "https://github.com/PackageKit/PackageKit/", "modules": ["Zypp Backend"], "versions": [{"status": "affected", "version": "0", "lessThan": "1.4.1", "versionType": "rpm"}], "defaultStatus": "unaffected"}], "cpeApplicability": [{"operator": "OR", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:packagekit:packagekit:*:*:*:*:*:*:*:*", "versionStartIncluding": "0", "versionEndExcluding": "1.4.1"}]}]}], "descriptions": [{"lang": "en", "value": "Untrusted users could roll back security updates when using the PackageKit Zypp Backend before 1.4.1, allowing privilege escalation.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Untrusted users could roll back security updates when using the PackageKit Zypp Backend before 1.4.1, allowing privilege escalation."}]}], "references": [{"url": "https://bugzilla.suse.com/show_bug.cgi?id=1284389", "tags": ["issue-tracking"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "HIGH", "baseScore": 7.8, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}}], "credits": [{"lang": "en", "value": "Adam Simuntis (adamm)", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.5"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-12T17:44:11.486692Z", "id": "CVE-2026-104619", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-12T17:44:23.451Z"}}]}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "modules": ["Zypp Backend"], "packageName": "PackageKit", "product": "PackageKit", "repo": "https://github.com/PackageKit/PackageKit/", "vendor": "PackageKit", "versions": [{"lessThan": "1.4.1", "status": "affected", "version": "0", "versionType": "rpm"}]}], "source": "meissner@suse.de"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Untrusted users could roll back security updates when using the PackageKit Zypp Backend before 1.4.1, allowing privilege escalation."}], "id": "CVE-2026-104619", "lastModified": "2026-11-12T19:02:35.830", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "meissner@suse.de", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-104619", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-11-12T17:44:11.486692Z", "version": "2.0.3"}}]}, "published": "2026-11-10T10:16:42.590", "references": [{"source": "meissner@suse.de", "url": "https://bugzilla.suse.com/show_bug.cgi?id=1284389"}], "sourceIdentifier": "meissner@suse.de", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1328"}], "source": "meissner@suse.de", "type": "Secondary"}]}

{"bugzilla": {"description": "PackageKit: PackageKit: Privilege escalation via security update rollback in Zypp backend", "id": "2569677", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2569677"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.8", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-267", "details": ["A flaw was found in PackageKit. This vulnerability allows a local, unprivileged user to achieve privilege escalation by rolling back installed security updates through the Zypp backend. By downgrading system packages to earlier vulnerable versions, an attacker can reintroduce and exploit previously patched flaws to gain elevated privileges on the system."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-104619", "package_state": [{"cpe": "cpe:/a:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "PackageKit", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:rhel_els:6", "fix_state": "Not affected", "package_name": "PackageKit", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:rhel_els:7", "fix_state": "Not affected", "package_name": "compat-PackageKit08", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:rhel_els:7", "fix_state": "Not affected", "package_name": "PackageKit", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/a:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "PackageKit", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/a:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "PackageKit", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-11-10T09:27:53Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-104619\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-104619\nhttps://bugzilla.suse.com/show_bug.cgi?id=1284389"], "statement": "This vulnerability is rated as Important because an unprivileged local user could force package downgrades to reintroduce addressed security defects, potentially achieving administrative access. Red Hat Enterprise Linux utilizes the DNF backend for PackageKit rather than the Zypp backend, so standard installations do not compile or execute the vulnerable code path.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.4.1)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "PackageKit", "source": "cna", "vendor": "PackageKit"}, "product": "packagekit", "vendor": "packagekit"}], "created": "2026-11-11T15:45:21.715052+00:00", "updated": "2026-11-11T16:15:21.809172+00:00", "vendors": ["packagekit", "packagekit$PRODUCT$packagekit"]}