CVE-2026-59674

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-59674", "assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "state": "PUBLISHED", "assignerShortName": "suse", "dateReserved": "2026-07-06T11:59:28.118Z", "datePublished": "2026-07-14T07:32:35.363Z", "dateUpdated": "2026-07-15T04:00:53.092Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "shortName": "suse", "dateUpdated": "2026-07-14T07:32:35.363Z"}, "title": "LPE from suricata user to root due to chown in %post in suricata packaging", "datePublic": "2026-07-14T07:30:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-61", "description": "CWE-61: UNIX Symbolic Link (Symlink) Following", "type": "CWE"}]}], "affected": [{"vendor": "SUSE", "product": "openSUSE Tumbleweed", "packageName": "suricata", "versions": [{"status": "affected", "version": "?", "lessThan": "8.0.5-2.1", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "SUSE", "product": "openSUSE Tumbleweed", "packageName": "suricata-devel", "versions": [{"status": "affected", "version": "?", "lessThan": "8.0.5-2.1", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "A UNIX Symbolic Link (Symlink) Following vulnerability in openSUSE Tumbleweed suricata package allows the suricata user to escalate to root.\n\n\n\n\n\n\nThis issue affects openSUSE Tumbleweed: from ? before 8.0.5-2.1; openSUSE Tumbleweed: from ? before 8.0.5-2.1.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<div>A UNIX Symbolic Link (Symlink) Following vulnerability in openSUSE Tumbleweed suricata package allows the suricata user to escalate to root.</div><div><br></div><p>This issue affects openSUSE Tumbleweed: from ? before 8.0.5-2.1; openSUSE Tumbleweed: from ? before 8.0.5-2.1.</p>"}]}], "references": [{"url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-59674"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "NONE", "exploitMaturity": "PROOF_OF_CONCEPT", "Safety": "NEGLIGIBLE", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 7.1, "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/S:N"}}], "credits": [{"lang": "en", "value": "Johannes Segitz (SUSE)", "type": "finder"}], "source": {"discovery": "INTERNAL"}, "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-14T00:00:00+00:00", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2026-59674"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-15T04:00:53.092Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-59674", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-07-14T12:33:06.540816Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-14T12:33:13.348Z"}}], "cna": {"title": "LPE from suricata user to root due to chown in %post in suricata packaging", "source": {"discovery": "INTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Johannes Segitz (SUSE)"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NEGLIGIBLE", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.1, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/S:N", "exploitMaturity": "PROOF_OF_CONCEPT", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "SUSE", "product": "openSUSE Tumbleweed", "versions": [{"status": "affected", "version": "?", "lessThan": "8.0.5-2.1", "versionType": "custom"}], "packageName": "suricata", "defaultStatus": "unaffected"}, {"vendor": "SUSE", "product": "openSUSE Tumbleweed", "versions": [{"status": "affected", "version": "?", "lessThan": "8.0.5-2.1", "versionType": "custom"}], "packageName": "suricata-devel", "defaultStatus": "unaffected"}], "datePublic": "2026-07-14T07:30:00.000Z", "references": [{"url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-59674"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "A UNIX Symbolic Link (Symlink) Following vulnerability in openSUSE Tumbleweed suricata package allows the suricata user to escalate to root.\n\n\n\n\n\n\nThis issue affects openSUSE Tumbleweed: from ? before 8.0.5-2.1; openSUSE Tumbleweed: from ? before 8.0.5-2.1.", "supportingMedia": [{"type": "text/html", "value": "<div>A UNIX Symbolic Link (Symlink) Following vulnerability in openSUSE Tumbleweed suricata package allows the suricata user to escalate to root.</div><div><br></div><p>This issue affects openSUSE Tumbleweed: from ? before 8.0.5-2.1; openSUSE Tumbleweed: from ? before 8.0.5-2.1.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-61", "description": "CWE-61: UNIX Symbolic Link (Symlink) Following"}]}], "providerMetadata": {"orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "shortName": "suse", "dateUpdated": "2026-07-14T07:32:35.363Z"}}}, "cveMetadata": {"cveId": "CVE-2026-59674", "state": "PUBLISHED", "dateUpdated": "2026-07-14T12:33:36.954Z", "dateReserved": "2026-07-06T11:59:28.118Z", "assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "datePublished": "2026-07-14T07:32:35.363Z", "assignerShortName": "suse"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageName": "suricata", "product": "openSUSE Tumbleweed", "vendor": "SUSE", "versions": [{"lessThan": "8.0.5-2.1", "status": "affected", "version": "?", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "packageName": "suricata-devel", "product": "openSUSE Tumbleweed", "vendor": "SUSE", "versions": [{"lessThan": "8.0.5-2.1", "status": "affected", "version": "?", "versionType": "custom"}]}], "source": "meissner@suse.de"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A UNIX Symbolic Link (Symlink) Following vulnerability in openSUSE Tumbleweed suricata package allows the suricata user to escalate to root.\n\n\n\n\n\n\nThis issue affects openSUSE Tumbleweed: from ? before 8.0.5-2.1; openSUSE Tumbleweed: from ? before 8.0.5-2.1."}, {"lang": "es", "value": "Una vulnerabilidad de seguimiento de enlace simb\u00f3lico (Symlink) de UNIX en el paquete suricata de openSUSE Tumbleweed permite al usuario suricata escalar a root.\n\nEste problema afecta a openSUSE Tumbleweed: desde ? antes de 8.0.5-2.1; openSUSE Tumbleweed: desde ? antes de 8.0.5-2.1."}], "id": "CVE-2026-59674", "lastModified": "2026-10-24T22:10:00.210", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NEGLIGIBLE", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "meissner@suse.de", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-59674", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-07-14T00:00:00+00:00", "version": "2.0.3"}}]}, "published": "2026-07-14T08:16:22.963", "references": [{"source": "meissner@suse.de", "url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-59674"}], "sourceIdentifier": "meissner@suse.de", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-61"}], "source": "meissner@suse.de", "type": "Secondary"}]}

{"bugzilla": {"description": "suricata: Suricata: Privilege escalation via symbolic link following", "id": "2499909", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499909"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.8", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-59", "details": ["A flaw was found in suricata. This vulnerability, related to improper handling of symbolic links, allows a local `suricata` user to escalate their privileges to root. By exploiting this, an attacker could gain full control over the affected system."], "mitigation": {"lang": "en:us", "value": "No mitigation is necessary for Red Hat's Suricata packages, as they do not contain the vulnerable packaging script described in this CVE. Refer to the upstream openSUSE advisory for guidance on affected openSUSE Tumbleweed systems (fixed in suricata 8.0.5-2.1)."}, "name": "CVE-2026-59674", "public_date": "2026-07-14T07:32:35Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-59674\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-59674\nhttps://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-59674"], "statement": "This issue is specific to the Suricata packaging shipped by openSUSE Tumbleweed: an unsafe recursive chown in the package's %post scriptlet follows symbolic links, allowing the local suricata user to escalate privileges to root during a package reinstall/upgrade. Red Hat's Suricata packages, built and maintained independently through Fedora and EPEL, do not contain this vulnerable packaging script and are not affected by this specific CVE.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,8.0.5-2.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "openSUSE Tumbleweed", "source": "cna", "vendor": "SUSE"}, "product": "opensuse_tumbleweed", "vendor": "suse"}], "created": "2026-07-14T08:30:05.649905+00:00", "updated": "2026-07-31T10:45:04.962956+00:00", "vendors": ["suse", "suse$PRODUCT$opensuse_tumbleweed"]}