CVE-2026-109971: Invocation of Process Using Visible Sensitive Information in Red Hat Red Hat Enterprise Linux 10

This vulnerability arises because the clevis-decrypt-pkcs11 script transmits the PKCS#11 token PIN as a command-line argument to the pkcs11-tool utility. Command-line arguments can be viewed by any local user through standard process listing commands or by inspecting the /proc filesystem, thereby exposing the sensitive PIN. The flaw affects Red Hat Enterprise Linux 10. The CVSS 3.1 base score is 4.7, reflecting a medium severity with local attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact.

The exposure of the PKCS#11 token PIN via command-line arguments allows any local user to obtain sensitive authentication credentials. This compromises the confidentiality of the token PIN, potentially enabling unauthorized access to cryptographic operations protected by the token. There is no impact on integrity or availability.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-109971 for current remediation guidance. Until a fix is available, restrict local user access to systems where this vulnerability exists to trusted personnel only.