This vulnerability (CVE-2026-59674) concerns a symbolic link following issue (CWE-61) in the suricata package on openSUSE Tumbleweed. It enables a local user with suricata privileges to escalate to root privileges by exploiting improper handling of symbolic links. The CVSS 4.0 base score is 7.1, reflecting high severity with local attack vector, low attack complexity, no user interaction, and high impacts on confidentiality, integrity, and availability. The affected versions are those before 8.0.5-2.1, but the exact affected version range is not explicitly stated. No vendor advisory or patch information is currently available.

A user with suricata privileges on an affected openSUSE Tumbleweed system can escalate their privileges to root, potentially gaining full control over the system. This compromises confidentiality, integrity, and availability of the affected system components.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict suricata user privileges and monitor for suspicious activity related to symbolic link usage. Avoid running suricata with unnecessary elevated privileges.