CVE-2026-4158

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-4158", "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e", "state": "PUBLISHED", "assignerShortName": "zdi", "dateReserved": "2026-03-13T20:35:42.678Z", "datePublished": "2026-04-11T00:17:00.676Z", "dateUpdated": "2026-04-13T17:40:04.189Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e", "shortName": "zdi", "dateUpdated": "2026-04-11T00:17:00.676Z"}, "title": "KeePassXC OpenSSL Configuration Uncontrolled Search Path Element Local Privilege Escalation Vulnerability", "descriptions": [{"lang": "en", "value": "KeePassXC OpenSSL Configuration Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of KeePassXC. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.\n\nThe specific flaw exists within the configuration of OpenSSL. The product loads configuration from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of KeePassXC when run by a target user on the system. Was ZDI-CAN-29156."}], "affected": [{"vendor": "KeePassXC", "product": "KeePassXC", "versions": [{"version": "2.7.11", "status": "affected"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-427", "description": "CWE-427: Uncontrolled Search Path Element", "type": "CWE"}]}], "references": [{"url": "https://www.zerodayinitiative.com/advisories/ZDI-26-215/", "name": "ZDI-26-215", "tags": ["x_research-advisory"]}, {"url": "https://github.com/keepassxreboot/keepassxc/security/advisories/GHSA-4gr2-cr97-q9fx", "name": "vendor-provided URL", "tags": ["vendor-advisory"]}], "dateAssigned": "2026-03-13T20:35:42.731Z", "datePublic": "2026-03-16T21:39:32.593Z", "source": {"lang": "en", "value": "Xavier DANEST"}, "metrics": [{"format": "CVSS", "cvssV3_0": {"version": "3.0", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "baseScore": 7.3, "baseSeverity": "HIGH"}}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-13T17:39:53.737910Z", "id": "CVE-2026-4158", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-13T17:40:04.189Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-4158", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-13T17:39:53.737910Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-13T17:39:59.814Z"}}], "cna": {"title": "KeePassXC OpenSSL Configuration Uncontrolled Search Path Element Local Privilege Escalation Vulnerability", "source": {"lang": "en", "value": "Xavier DANEST"}, "metrics": [{"format": "CVSS", "cvssV3_0": {"version": "3.0", "baseScore": 7.3, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "KeePassXC", "product": "KeePassXC", "versions": [{"status": "affected", "version": "2.7.11"}], "defaultStatus": "unknown"}], "datePublic": "2026-03-16T21:39:32.593Z", "references": [{"url": "https://www.zerodayinitiative.com/advisories/ZDI-26-215/", "name": "ZDI-26-215", "tags": ["x_research-advisory"]}, {"url": "https://github.com/keepassxreboot/keepassxc/security/advisories/GHSA-4gr2-cr97-q9fx", "name": "vendor-provided URL", "tags": ["vendor-advisory"]}], "dateAssigned": "2026-03-13T20:35:42.731Z", "descriptions": [{"lang": "en", "value": "KeePassXC OpenSSL Configuration Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of KeePassXC. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.\n\nThe specific flaw exists within the configuration of OpenSSL. The product loads configuration from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of KeePassXC when run by a target user on the system. Was ZDI-CAN-29156."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-427", "description": "CWE-427: Uncontrolled Search Path Element"}]}], "providerMetadata": {"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e", "shortName": "zdi", "dateUpdated": "2026-04-11T00:17:00.676Z"}}}, "cveMetadata": {"cveId": "CVE-2026-4158", "state": "PUBLISHED", "dateUpdated": "2026-04-13T17:40:04.189Z", "dateReserved": "2026-03-13T20:35:42.678Z", "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e", "datePublished": "2026-04-11T00:17:00.676Z", "assignerShortName": "zdi"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "product": "KeePassXC", "vendor": "KeePassXC", "versions": [{"status": "affected", "version": "2.7.11"}]}], "source": "zdi-disclosures@trendmicro.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "KeePassXC OpenSSL Configuration Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of KeePassXC. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.\n\nThe specific flaw exists within the configuration of OpenSSL. The product loads configuration from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of KeePassXC when run by a target user on the system. Was ZDI-CAN-29156."}], "id": "CVE-2026-4158", "lastModified": "2026-06-17T10:56:04.927", "metrics": {"cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 1.3, "impactScore": 5.9, "source": "zdi-disclosures@trendmicro.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-4158", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-04-13T17:39:53.737910Z", "version": "2.0.3"}}]}, "published": "2026-04-11T01:16:17.620", "references": [{"source": "zdi-disclosures@trendmicro.com", "url": "https://github.com/keepassxreboot/keepassxc/security/advisories/GHSA-4gr2-cr97-q9fx"}, {"source": "zdi-disclosures@trendmicro.com", "url": "https://www.zerodayinitiative.com/advisories/ZDI-26-215/"}], "sourceIdentifier": "zdi-disclosures@trendmicro.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-427"}], "source": "zdi-disclosures@trendmicro.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.7.11"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "KeePassXC", "source": "cna", "vendor": "KeePassXC"}, "product": "keepassxc", "vendor": "keepassxc"}], "analysis": {"en": {"generated_at": "2026-04-11T02:24:06.450892+00:00", "value": {"mitigation_remediation": ["Check the KeePassXC project page or GitHub releases for an updated version that addresses the OpenSSL configuration issue, and upgrade as soon as one is available.", "If a patch cannot be applied immediately, limit the permissions of the directory from which KeePassXC loads its OpenSSL configuration so that only the current user can read or modify the file, and ensure the application is not run with elevated privileges.", "Verify that the environment variables or command\u2011line options that set OpenSSL configuration paths point to a secure, user\u2011owned directory, and remove any references to system\u2011wide insecure paths."], "summary": {"action": "Patch", "impact": "Local Privilege Escalation"}, "threat_synthesis": {"affected_systems": "Affected installations are those that run the KeePassXC application, specifically the KeePassXC:KeePassXC product family. No version range was specified in the CNA information, but the advisory references indicate that all actively supported releases are susceptible until a patch is released.", "description_and_impact": "The vulnerability arises from KeePassXC\u2019s use of OpenSSL. During startup, the application loads the OpenSSL configuration from a location that is not protected by the operating system. This omission allows an attacker who can already execute code at the current user level to supply a configuration file that contains an uncontrolled search path element. The threat model is local; the flaw is a classic CWE\u2011427\u202f\u2014\u202fUncontrolled Search Path Element.", "risk_and_exploitability": "The CVSS score of 7.3 indicates a high\u2011risk condition. Exploitability requires the attacker to first acquire low\u2011privilege code execution, which is a prerequisite that reduces the likelihood of remote attacks. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, which suggests it has not yet been widely exploited. Nevertheless, the combination of a local trusted process and the ability to inject arbitrary code warrants prompt attention."}}}}, "created": "2026-04-13T12:42:08.061558+00:00", "updated": "2026-04-13T12:56:52.977474+00:00", "vendors": ["keepassxc", "keepassxc$PRODUCT$keepassxc"]}