CVE-2026-23893

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23893", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-16T21:02:02.902Z", "datePublished": "2026-01-22T00:01:43.521Z", "dateUpdated": "2026-01-22T21:52:09.433Z"}, "containers": {"cna": {"title": "openCryptoki has improper link resolution before file access (link following)", "problemTypes": [{"descriptions": [{"cweId": "CWE-59", "lang": "en", "description": "CWE-59: Improper Link Resolution Before File Access ('Link Following')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/opencryptoki/opencryptoki/security/advisories/GHSA-j6c7-mvpx-jx5q", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/opencryptoki/opencryptoki/security/advisories/GHSA-j6c7-mvpx-jx5q"}, {"name": "https://github.com/opencryptoki/opencryptoki/commit/5e6e4b42f2b1fcc1e4ef1b920e463bfa55da8b45", "tags": ["x_refsource_MISC"], "url": "https://github.com/opencryptoki/opencryptoki/commit/5e6e4b42f2b1fcc1e4ef1b920e463bfa55da8b45"}], "affected": [{"vendor": "opencryptoki", "product": "opencryptoki", "versions": [{"version": ">= 2.3.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-22T00:01:43.521Z"}, "descriptions": [{"lang": "en", "value": "openCryptoki is a PKCS#11 library and provides tooling for Linux and AIX. Versions 2.3.2 and above are vulnerable to symlink-following when running in privileged contexts. A token-group user can redirect file operations to arbitrary filesystem targets by planting symlinks in group-writable token directories, resulting in privilege escalation or data exposure. Token and lock directories are 0770 (group-writable for token users), so any token-group member can plant files and symlinks inside them. When run as root, the base code handling token directory file access, as well as several openCryptoki tools used for administrative purposes, may reset ownership or permissions on existing files inside the token directories. An attacker with token-group membership can exploit the system when an administrator runs a PKCS#11 application or administrative tool that performs chown on files inside the token directory during normal maintenance. This issue is fixed in commit 5e6e4b4, but has not been included in a released version at the time of publication."}], "source": {"advisory": "GHSA-j6c7-mvpx-jx5q", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-22T21:51:56.296258Z", "id": "CVE-2026-23893", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-22T21:52:09.433Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-23893", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-01-22T21:51:56.296258Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-22T21:52:02.747Z"}}], "cna": {"title": "openCryptoki has improper link resolution before file access (link following)", "source": {"advisory": "GHSA-j6c7-mvpx-jx5q", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "opencryptoki", "product": "opencryptoki", "versions": [{"status": "affected", "version": ">= 2.3.2"}]}], "references": [{"url": "https://github.com/opencryptoki/opencryptoki/security/advisories/GHSA-j6c7-mvpx-jx5q", "name": "https://github.com/opencryptoki/opencryptoki/security/advisories/GHSA-j6c7-mvpx-jx5q", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/opencryptoki/opencryptoki/commit/5e6e4b42f2b1fcc1e4ef1b920e463bfa55da8b45", "name": "https://github.com/opencryptoki/opencryptoki/commit/5e6e4b42f2b1fcc1e4ef1b920e463bfa55da8b45", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "openCryptoki is a PKCS#11 library and provides tooling for Linux and AIX. Versions 2.3.2 and above are vulnerable to symlink-following when running in privileged contexts. A token-group user can redirect file operations to arbitrary filesystem targets by planting symlinks in group-writable token directories, resulting in privilege escalation or data exposure. Token and lock directories are 0770 (group-writable for token users), so any token-group member can plant files and symlinks inside them. When run as root, the base code handling token directory file access, as well as several openCryptoki tools used for administrative purposes, may reset ownership or permissions on existing files inside the token directories. An attacker with token-group membership can exploit the system when an administrator runs a PKCS#11 application or administrative tool that performs chown on files inside the token directory during normal maintenance. This issue is fixed in commit 5e6e4b4, but has not been included in a released version at the time of publication."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-59", "description": "CWE-59: Improper Link Resolution Before File Access ('Link Following')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-22T00:01:43.521Z"}}}, "cveMetadata": {"cveId": "CVE-2026-23893", "state": "PUBLISHED", "dateUpdated": "2026-01-22T21:52:09.433Z", "dateReserved": "2026-01-16T21:02:02.902Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-22T00:01:43.521Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "opencryptoki", "vendor": "opencryptoki", "versions": [{"status": "affected", "version": ">= 2.3.2"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:opencryptoki_project:opencryptoki:*:*:*:*:*:*:*:*", "matchCriteriaId": "88FDC076-2D79-4CAE-9002-05B35359D880", "versionStartIncluding": "2.3.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "openCryptoki is a PKCS#11 library and provides tooling for Linux and AIX. Versions 2.3.2 and above are vulnerable to symlink-following when running in privileged contexts. A token-group user can redirect file operations to arbitrary filesystem targets by planting symlinks in group-writable token directories, resulting in privilege escalation or data exposure. Token and lock directories are 0770 (group-writable for token users), so any token-group member can plant files and symlinks inside them. When run as root, the base code handling token directory file access, as well as several openCryptoki tools used for administrative purposes, may reset ownership or permissions on existing files inside the token directories. An attacker with token-group membership can exploit the system when an administrator runs a PKCS#11 application or administrative tool that performs chown on files inside the token directory during normal maintenance. This issue is fixed in commit 5e6e4b4, but has not been included in a released version at the time of publication."}, {"lang": "es", "value": "openCryptoki es una librer\u00eda PKCS#11 y proporciona herramientas para Linux y AIX. Las versiones 2.3.2 y superiores son vulnerables al seguimiento de enlaces simb\u00f3licos cuando se ejecutan en contextos privilegiados. Un usuario del grupo de tokens puede redirigir operaciones de archivo a destinos arbitrarios del sistema de archivos al colocar enlaces simb\u00f3licos en directorios de tokens con permisos de escritura para el grupo, lo que resulta en escalada de privilegios o exposici\u00f3n de datos. Los directorios de tokens y de bloqueo son 0770 (con permisos de escritura para el grupo de usuarios de tokens), por lo que cualquier miembro del grupo de tokens puede colocar archivos y enlaces simb\u00f3licos dentro de ellos. Cuando se ejecuta como root, el c\u00f3digo base que maneja el acceso a archivos del directorio de tokens, as\u00ed como varias herramientas de openCryptoki utilizadas con fines administrativos, pueden restablecer la propiedad o los permisos en archivos existentes dentro de los directorios de tokens. Un atacante con membres\u00eda en el grupo de tokens puede explotar el sistema cuando un administrador ejecuta una aplicaci\u00f3n PKCS#11 o una herramienta administrativa que realiza chown en archivos dentro del directorio de tokens durante el mantenimiento normal. Este problema est\u00e1 solucionado en el commit 5e6e4b4, pero no ha sido incluido en una versi\u00f3n publicada en el momento de la publicaci\u00f3n."}], "id": "CVE-2026-23893", "lastModified": "2026-06-17T10:22:16.260", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L", "version": "3.1"}, "exploitabilityScore": 1.3, "impactScore": 5.5, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-23893", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-01-22T21:51:56.296258Z", "version": "2.0.3"}}]}, "published": "2026-01-22T01:15:52.310", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/opencryptoki/opencryptoki/commit/5e6e4b42f2b1fcc1e4ef1b920e463bfa55da8b45"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://github.com/opencryptoki/opencryptoki/security/advisories/GHSA-j6c7-mvpx-jx5q"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-59"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "openCryptoki: openCryptoki: Privilege Escalation or Data Exposure via Symlink Following", "id": "2431909", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431909"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.8", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L", "status": "draft"}, "cwe": "CWE-59", "details": ["A flaw was found in openCryptoki, a PKCS#11 library and tooling for Linux and AIX. A token-group user can exploit a symlink-following vulnerability by planting symbolic links in group-writable token directories. When an administrator runs a PKCS#11 application or administrative tool as root, it may reset ownership or permissions on existing files within these directories. This can lead to privilege escalation or the exposure of sensitive data."], "mitigation": {"lang": "en:us", "value": "To mitigate this issue, restrict membership of the token-group to only trusted administrators. This prevents untrusted local users from planting malicious symlinks in openCryptoki token directories. Changes to group membership typically require users to log out and log back in for the changes to take effect."}, "name": "CVE-2026-23893", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "opencryptoki", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Fix deferred", "package_name": "opencryptoki", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "opencryptoki", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "opencryptoki", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "opencryptoki", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-01-22T00:01:43Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-23893\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-23893\nhttps://github.com/opencryptoki/opencryptoki/commit/5e6e4b42f2b1fcc1e4ef1b920e463bfa55da8b45\nhttps://github.com/opencryptoki/opencryptoki/security/advisories/GHSA-j6c7-mvpx-jx5q"], "statement": "This vulnerability is rated Moderate for Red Hat because it requires a local attacker with `token-group` membership to plant symbolic links in group-writable token directories. Exploitation occurs when an administrator subsequently runs a privileged `openCryptoki` application or administrative tool, leading to privilege escalation or data exposure. Red Hat systems are affected if `openCryptoki` is installed and configured with group-writable token directories.", "threat_severity": "Moderate"}

{"analysis": {"en": {"generated_at": "2026-04-18T18:59:28.463202+00:00", "value": {"mitigation_remediation": ["Apply the security fix from commit 5e6e4b4; rebuild and deploy openCryptoki from source or use an updated release once available, ensuring the patched version is used for all trusted PKCS#11 operations.", "Restrict write access to token and lock directories by setting permissions to 0700 or removing group write permission; ensure only root and the daemon process have access to these directories.", "Remove any symbolic links from token directories and clean up existing symlinks, mitigating the CWE\u201159 path\u2011resolution flaw; verify that no token\u2011group user can create new symlinks in these directories by reviewing ACLs or applying a stricter policy."], "summary": {"action": "Patch", "impact": "Privilege Escalation"}, "threat_synthesis": {"affected_systems": "The issue affects the openCryptoki PKCS#11 library and its administrative tools on Linux and AIX for all releases 2.3.2 and newer.", "description_and_impact": "openCryptoki's token directory file operations resolve symbolic links when executing as a privileged user. A token\u2011group member can place symlinks that redirect file operations to arbitrary filesystem targets. This flaw allows the attacker to create or modify files with root ownership or change permissions on arbitrary files, leading to privilege escalation or data exposure.", "risk_and_exploitability": "The CVSS score of 6.8 and EPSS <1% suggest moderate severity but overall low exploitation probability. The vulnerability requires a token\u2011group user having write access to token directories, then the presence of an administrator running a maintenance operation such as chown on files inside the token directory while running as root. The flaw is local and is not currently listed in the CISA KEV catalog, indicating limited active exploitation."}}}}, "created": "2026-01-22T10:07:58.344940+00:00", "updated": "2026-04-18T19:00:08.057799+00:00", "vendors": ["opencryptoki_project", "opencryptoki_project$PRODUCT$opencryptoki"]}