CVE-2026-58015 is a path traversal vulnerability in GLib affecting the D-Bus client-side implementation of the DBUS_COOKIE_SHA1 SASL authentication mechanism. The client does not properly validate the cookie_context parameter received from the server. A malicious D-Bus server can exploit this by sending a crafted cookie_context containing path traversal sequences, leading the client to read arbitrary files. This can result in exfiltration of sensitive data by comparing file contents against generated hashes. The vulnerability has a CVSS 3.1 base score of 5.9 (medium severity) with network attack vector, high attack complexity, no privileges required, no user interaction, and impacts confidentiality but not integrity or availability. Red Hat has issued an important security advisory with fixes available for affected versions.

The vulnerability allows a remote attacker controlling a malicious D-Bus server to cause a GLib client to read arbitrary files on the client system. This can lead to disclosure of sensitive information. There is no impact on integrity or availability. No known exploits in the wild have been reported.

A security update is available from Red Hat addressing this vulnerability. Users should apply the official patch as described in Red Hat Advisory RHSA-2026:49512. The advisory provides updated packages for affected Red Hat Enterprise Linux versions. Applying the update fully mitigates the issue.