A flaw was found in GLib. The D-Bus client-side implementation of the DBUS_COOKIE_SHA1 SASL authentication mechanism does not validate the… (CVE-2026-58015)
A vulnerability in GLib's D-Bus client-side implementation of the DBUS_COOKIE_SHA1 SASL authentication mechanism allows a malicious D-Bus server to supply a cookie_context containing path traversal sequences. This flaw can cause the client to read arbitrary files and potentially leak sensitive data by verifying guessed file contents against a generated hash. The issue is identified as CVE-2026-58015 and has a CVSS score of 5.9 (medium severity). Red Hat has released security updates for affected GLib packages in Red Hat Enterprise Linux 8 and 9 to address this and related vulnerabilities.
AI Analysis
Technical Summary
CVE-2026-58015 is a path traversal vulnerability in GLib's D-Bus client-side DBUS_COOKIE_SHA1 SASL authentication mechanism. The client does not validate the cookie_context parameter received from the server, allowing a malicious D-Bus server to include path traversal sequences. This can lead to the client reading arbitrary files and exfiltrating sensitive data by comparing file contents against generated hashes. The vulnerability is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). Red Hat advisories RHSA-2026:49512 and RHSA-2026:55440 provide patches for affected GLib packages in Red Hat Enterprise Linux 8 and 9 respectively.
Potential Impact
The vulnerability allows a remote, unauthenticated attacker controlling a malicious D-Bus server to cause a GLib client to read arbitrary files on the client system. This can lead to sensitive data exposure without requiring user interaction or privileges. The CVSS 3.1 base score is 5.9, indicating a medium severity impact with high confidentiality impact but no integrity or availability impact.
Mitigation Recommendations
Red Hat has released official security updates for GLib packages in Red Hat Enterprise Linux 8 and 9 that address CVE-2026-58015. Users should apply these updates promptly to remediate the vulnerability. Detailed update instructions are available at https://access.redhat.com/articles/11258. No additional mitigations are required beyond applying the vendor-provided patches.
A flaw was found in GLib. The D-Bus client-side implementation of the DBUS_COOKIE_SHA1 SASL authentication mechanism does not validate the… (CVE-2026-58015)
Description
A vulnerability in GLib's D-Bus client-side implementation of the DBUS_COOKIE_SHA1 SASL authentication mechanism allows a malicious D-Bus server to supply a cookie_context containing path traversal sequences. This flaw can cause the client to read arbitrary files and potentially leak sensitive data by verifying guessed file contents against a generated hash. The issue is identified as CVE-2026-58015 and has a CVSS score of 5.9 (medium severity). Red Hat has released security updates for affected GLib packages in Red Hat Enterprise Linux 8 and 9 to address this and related vulnerabilities.
CVSS v3.1
Score 5.9medium
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-58015 is a path traversal vulnerability in GLib's D-Bus client-side DBUS_COOKIE_SHA1 SASL authentication mechanism. The client does not validate the cookie_context parameter received from the server, allowing a malicious D-Bus server to include path traversal sequences. This can lead to the client reading arbitrary files and exfiltrating sensitive data by comparing file contents against generated hashes. The vulnerability is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). Red Hat advisories RHSA-2026:49512 and RHSA-2026:55440 provide patches for affected GLib packages in Red Hat Enterprise Linux 8 and 9 respectively.
Potential Impact
The vulnerability allows a remote, unauthenticated attacker controlling a malicious D-Bus server to cause a GLib client to read arbitrary files on the client system. This can lead to sensitive data exposure without requiring user interaction or privileges. The CVSS 3.1 base score is 5.9, indicating a medium severity impact with high confidentiality impact but no integrity or availability impact.
Mitigation Recommendations
Red Hat has released official security updates for GLib packages in Red Hat Enterprise Linux 8 and 9 that address CVE-2026-58015. Users should apply these updates promptly to remediate the vulnerability. Detailed update instructions are available at https://access.redhat.com/articles/11258. No additional mitigations are required beyond applying the vendor-provided patches.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-hmpf-72wc-2r6x
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-58015"]
- Ecosystems
- []
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
Patch Information
Threat ID: 6a83335dbf8831d5392a652d
Added to database: 08/17/2026, 16:14:21 UTC
Last enriched: 08/17/2026, 16:29:57 UTC
Last updated: 08/18/2026, 00:41:14 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.