CVE-2026-109970: Insertion of Sensitive Information into Externally-Accessible File or Directory in Red Hat Red Hat Enterprise Linux 10

This vulnerability arises from the clevis-luks-pkcs11-askpin script in Red Hat Enterprise Linux 10, which writes the PKCS#11 token PIN to a file without setting restrictive permissions, resulting in a world-readable file under default umask settings. Furthermore, the script does not reliably clean up the PIN file if it exits early, potentially leaving the PIN exposed. The CVSS 3.1 score is 4.7 (medium), reflecting local attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact.

An attacker with local access and low privileges could read the plaintext PKCS#11 token PIN from the world-readable file, compromising the confidentiality of the PIN. This could lead to unauthorized use of the token. There is no impact on integrity or availability. The vulnerability does not appear to be exploited in the wild at this time.

No explicit patch or remediation status is provided in the vendor advisory URL. Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-109970 for current remediation guidance. Until a fix is applied, restricting file permissions manually and ensuring cleanup of temporary PIN files after use may reduce exposure.