CVE-2026-59674 is a UNIX symbolic link following vulnerability (CWE-61) in the suricata package on openSUSE Tumbleweed. It enables a local user running with suricata privileges to escalate to root privileges by exploiting improper handling of symbolic links. The affected versions are openSUSE Tumbleweed releases prior to 8.0.5-2.1. The CVSS 4.0 vector indicates local attack vector with low complexity, no user interaction, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch is currently available to confirm remediation status.

Successful exploitation allows a local user with suricata privileges to escalate to root, resulting in full system compromise. This elevates the attacker's privileges from a limited user to the highest system level, posing a critical risk to system security and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict local access to trusted users only and monitor for suspicious activity related to suricata processes. Avoid running suricata with unnecessary elevated privileges if possible.